EU consent requirements with data privacy laws: Checklist by country

EU-WIDE REGULATIONS AND GUIDELINES

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) protects the personal data of residents of the European Union and European Economic Area. The law is extraterritorial, so it applies to organizations even if they are not located in the EU. Privacy regulation requirements for the GDPR must be applied in addition to country-specific requirements, such as for data subjects’ consent (i.e. online user, customer, visitor, gamer, etc.)

Who needs to comply with the GDPR?

Any organization (not just commercial enterprises) that collects and processes the personal data of residents of the EU/EEA. Unlike the United States, there are no thresholds for GDPR compliance, like company revenue or number of people whose data is processed in a year. There are some exceptions to GDPR compliance, like for journalists or law enforcement, but overall, there are few exceptions for companies and other organizations that need user data.

Legal bases for personal data processing under the GDPR

The GDPR provides six options for legal bases for processing of personal data. Consent is one of the options.

• the data subject has given prior consent to the processing of his or her personal data for one or more specific purposes
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• processing is necessary for compliance with a legal obligation to which the controller is subject
• processing is necessary in order to protect the vital interests of the data subject or of another natural person
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

Organizations must be able to prove the necessity and validity of their choice of legal basis. A company cannot just choose legitimate interest to avoid the resource investment required to implement consent management, for example.

However, organizations that need to obtain consent must do so in a way that complies with the GDPR’s requirements, e.g. making consent choices clear and equal. They must also be able to prove — to data protection authorities or in the event of a data subject access request — that valid consent was obtained from users, including when and for what, and recording any changes to consent information over time.

Conditions for valid consent under the GDPR

Art. 7 GDPR outlines the conditions for legally valid consent. These requirements have been influential around the world on data privacy legislation and privacy guidelines.

In short: “Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data.”

ePrivacy Directive (ePD)

The ePrivacy Directive is considered the precursor to the ePrivacy Regulation. Passing of the latter continues to be delayed, though the ePD was significantly updated in 2009.

Colloquially known as the “cookie law”, the ePD influenced the adoption of consent banners. It addresses data privacy and protection in electronic communications and has several mandates:

• prioritizing confidentiality of communications over public networks
• requiring user consent for use of cookies and other tracking technologies
• setting guidelines for the security of electronic communication services
• regulating direct marketing practices

The ePrivacy Directive requires incorporation into national laws of EU member states, as a result enforcement across EU member countries has varied.

The conditions for valid consent under the ePrivacy Directive (and eventual ePrivacy Regulation), and who is required to comply are the same as those for the GDPR.

Digital Markets Act (DMA)

The Digital Markets Act came into force in late 2022 as part of the Digital Services Act Package of regulations. Its goals are to promote fair and competitive digital markets in the EU, and to enhance privacy and protections for consumers’ personal data.

The DMA directly targets six large and influential tech companies, designated “gatekeepers”. However, for those companies to meet regulatory compliance requirements, they need to set their own compliance requirements for all the third-party organizations that rely on their platforms, e.g. for data, audience access, ecommerce, advertising, and more.

Importantly, that includes the requirement of obtaining valid user consent for collection and processing of personal data, and also signaling that consent information to the platform or service, e.g. for Google Ads or Analytics. To comply with this requirement, companies need to implement a consent management platform (CMP) that collects user consent, and then signals that information to the platforms. In Google’s case, it requires implementing a Google-certified CMP integrated with the latest version of Google Consent Mode.

DMA compliance requirements for obtaining consent align with the requirements of the GDPR and ePrivacy Directive, which are also required in the EU.

EU-WIDE FRAMEWORKS AND POLICIES

IAB Europe Transparency & Consent Framework v2.2

Publishers serving ads on websites or in apps in the EU/EEA or UK are now required to have the latest version of the IAB’s Transparency & Consent Framework (TCF) implemented via integration with a consent management platform (CMP).

The TCF originally set industry standards to ensure transparency with users online regarding the collection of data for targeted advertising, as well as provide them control and enable valid consent mechanisms. The framework also standardizes working with vendors, reduces data privacy risks and enables compliance with regulations like the GDPR and ePrivacy Directive.

The update to the TCF v2.2 in late 2023 addresses criticisms and is designed to better meet the needs of regulators and users. Updates include:

• only consent can be selected as a legal basis for advertising and content personalization – legitimate interest can no longer be selected
• information about purposes and features has been made more user-friendly and less “legalese”
• vendor disclosures have been standardized and expanded to include categories of data collected, retention periods, and whether legitimate interest applies
• total number of vendors used by a publisher should be displayed on the first layer of the CMP UI
• consent management platform redesign is mandatory so that users have the ability to opt out of consent

Google EU user consent policy

Google’s EU user consent policy was introduced in 2015 and is a key component in their data privacy requirements for third parties using their platforms and services for marketing, analytics, etc. The policy aligns with the requirements of the GDPR (it was significantly updated when the law came into force) and ePrivacy Directive.

Google’s EU user consent policy applies to companies that operate websites and/or apps meeting the following criteria:

• use cookies or other local storage where legally required
• collect, share, and use personal data for ad personalization

Websites or apps that serve non-personalized ads that only use contextual information are still subject to the policy if they use cookies or mobile identifiers where legally required. Organizations using third parties to collect and/or process data must also employ “commercially reasonable efforts” to ensure they comply with the policy.

The policy has four main criteria pertaining to consent. Companies must:

• obtain legally valid consent (aligned with the GDPR’s requirements)
• retain consent records
• enable revocation of consent (with clear instructions)
• identify each party involved in data handling

Noncompliance with the policy can result in suspension of access to Google’s services, or contract termination. Additionally, noncompliance with EU regulatory requirements for user consent can result in fines and other penalties.

EU COUNTRY-SPECIFIC CONSENT LAWS AND GUIDELINES

All regulations and guidelines included are currently in effect in the countries listed.

Andorra data privacy laws and consent requirements

Protected groups: Website users (or equivalent)

Relevant cookie use: All cookies and similar tracking technologies used on websites and in apps, as well as smart devices like TVs, video game consoles, voice assistants, network-connected vehicles, etc.

Consent definition: Any specific, informed and unambiguous expression of free will by which the data subject consents, by means of a statement or a clear affirmative action, to the processing of personal data concerning him or her.

Prior consent: Yes, in most cases, though that explicit wording is not used.

Consent withdrawal: Yes, users can withdraw consent any time, and it must be as easy to do so as to give consent.

Cookie duration:

• session-based cookies – deleted at the end of a session (closing the browser window)
• permanent cookies – most have an expiry date for automatic deletion, the guideline does not provide a specific duration
• third-party cookies – duration depends on the party using the third-party cookie, they are also responsible to fulfill requirements on their own website
• maximum storage: twenty-five (25) months is the maximum recommended time

Austria data privacy laws and consent requirements

Protected groups: Website users

Relevant cookie use: All cookies and similar tracking technologies used on websites that collect personal data. Website operators using cookies or other tracking technologies are responsible for data privacy compliance with the use of those data processing services (with some exceptions) in accordance with Arts. 4 (7) and 26 GDPR.

Consent definition: Follows GDPR consent requirements, and consent must be obtained prior to setting all “technically unnecessary” cookies. Data collected by cookies should not be qualified as personal or non-personal by default and definitions will depend on each case.

Prior consent: Yes, in most cases.

Consent withdrawal: Yes, users can withdraw consent any time, and it must be as easy to do so as to give consent.

Cookie duration: No explicit guidelines.

Belgium data privacy laws and consent requirements

Protected groups: Focuses on privacy in device use, so not explicitly user-focused, but all users of devices from which data can be tracked/collected.

Relevant cookie use: All cookies and similar tracking technologies used on devices, so all companies doing tracking via devices

Consent definition: Follows GDPR and ePrivacy Directive consent requirements for prior consent for use of all but strictly necessary cookies (includes cookies which are absolutely necessary to provide a service that the user has expressly requested and/or to send a communication via an electronic communications network)

Prior consent: Yes, in most cases.

Consent withdrawal: Yes, users can withdraw consent at any time, and it must be as easy as giving consent. Users should also be informed about the ability to withdraw when initially requested to provide consent.

Cookie duration: Cookies cannot be kept beyond the time necessary to fulfill the expressed purpose. No cookies can have an indefinite retention period. Cookies exempt from requiring consent must have a duration directly related to the expressed purpose for use and be configured to expire as soon as no longer needed for that purpose.

Czechia data privacy laws and consent requirements

Protected groups: Data subjects, e.g. website users

Relevant cookie use: All cookies and similar tracking technologies used on websites.

Consent definition: “Consent should above all be free, specific, informed, and unequivocal. The data subject must have the simple option of not giving consent, without this implying harm for him (e.g. unavailability of website content).”

Prior consent: Yes, in most cases, though that explicit wording is not used. Consent is not required for the use of technical cookies, but that exception only applies to the storage and reading of cookies in the user’s browser.

Consent withdrawal: Data subjects can revoke consent to personal data processing at any time, and doing so must be as easy as giving consent. If consent is granted via a consent banner, for example, requiring withdrawal of consent via a different format, e.g. sending an email cannot be required. Ideally, changing or withdrawing consent should be accessible via an easy to find and use button or link.

“Consent to the processing of personal data can be revoked by the data subject at any time, and the withdrawal of consent must be as easy as giving it. In the case of granting consent via the cookie bar, it cannot be accepted that the withdrawal of consent is only possible, for example, by telephone. Ideally, there should be an easily accessible button or link on the website with which consent can be withdrawn.”

Cookie duration: The data protection authority considers a lifespan of six months to be reasonable in principle. That period can be shorter if one or more processing purposes significantly change or the website operator can no longer monitor previous consent (or rejection) preferences, e.g., due to the user deleting cookies on their device.

Denmark data privacy laws and consent requirements

Protected groups: Website visitors

Relevant cookie use: All cookies and similar tracking technologies used on websites.

Consent definition: “A freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject signifies his or her agreement to personal data relating to him or her being processed.”

Prior consent: Yes, in most cases. “Consent of the data subject(s) must be obtained before the controller starts processing the data to which the consent relates”. Only necessary cookies required for the website to function (e.g. shopping cart) can be set without consent.

Consent withdrawal: Yes, consent can be withdrawn at any time and it must be as easy as giving it, and once consent is withdrawn, data processing must cease immediately.

Cookie duration: Not addressed, though users must be provided information about when each cookie expires.

Finland data privacy laws and consent requirements

Protected groups: End users, e.g. for websites and apps

Relevant cookie use: This applies to cookies and similar technologies used by service providers when creating and operating websites or other electronic communications services, like mobile apps.

Consent definition: “Any voluntary, individualized, informed and unambiguous expression of will by which the data subject accepts the processing of his personal data by giving a statement expressing consent or by taking an action clearly expressing consent.” The conditions for valid consent are the same as for the GDPR.

Prior consent: Yes, in most cases. Consent is not required for “essential” cookies, but it’s recommended to include information about them and their use. Essential uses for cookies include:

• enabling the website to function correctly, e.g. shopping cart
• if the sole purpose of storing or using the data is to carry out the transmission of a message in communication networks
• storing and using the data is necessary for the service provider to provide a service that the subscriber or service user has specifically requested
• if analytics cookies are categorized as strictly necessary for the provision of the service in question, the service provider must be able to provide clear justification for the procedure and ensure that the user’s privacy
• is protected, e.g. ensuring data collected through analytics is not shared with third parties or that individual visitors cannot be identified

Consent withdrawal: Changing or withdrawing consent (or refusing it in the first place) must be as easy to do as giving it.

Cookie duration:

• Session-specific cookies – stored on the user’s device only during the use of the site or service, removed when the browser is closed. Can enable ecommerce, for example, wherein the site can “remember” user activity for a short time.
• Permanent cookies – stored on the user’s device until the time specified for each cookie or until the user manually deletes them. Can “remember” user preferences for the site, like language or login credentials for a longer period of time.

France data privacy laws and consent requirements

Protected groups: Focuses on privacy re. end user devices, so any computer, phone, etc. users on which companies use trackers.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition:

• Uses the GDPR definition.
• While lack of explicit action cannot be construed as consent, silence can be construed as explicit denial of consent.
• Pre-ticked boxes cannot be construed as valid consent.
• Cookie walls cannot likely be used to obtain valid consent due to the likelihood of infringing on the user’s consent freedom, but they are not universally prohibited.
• Companies need to be able to prove valid consent at any time.

Prior consent:

• Yes, “before any action aimed at storing information or accessing information stored in the equipment terminal of a subscriber or user, apart from the applicable exceptions”
• References the GDPR and ePrivacy Directive regarding valid consent and the requirement to clearly and comprehensively notify users prior to collecting data.
• Essential cookies/trackers do not require consent, but use must be strictly limited; they include audience and performance measurement, navigation detection issues, technical optimization, etc.
• Consent withdrawal: Yes, consent can be withdrawn at any time and it must be as easy to do so as it was to give it. It also must be as easy to deny consent initially (e.g. same action or number of steps) as to give consent.

Cookie duration:

• CNIL recommends consent renewal every six months for publishers.
• CNIL recommends that the lifetime of the trackers should be limited to a duration allowing a relevant comparison of audiences over time, as is the case for a 13-month period.
• Tracker duration should not be automatically extended for new visits.
• Information collected through trackers should be kept for a maximum period of 25 months.

Germany data privacy laws and consent requirements

Protected groups: Focuses on privacy regarding end user devices, so any computer, phone, etc. users on which companies use trackers.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition:

• Uses the GDPR definition.
• If personal data is not processed, the GDPR does not apply, but the TTDSG still does.

Prior consent: Yes, in most cases, with conditions.

• GDPR and TTDSG consent can be “bundled” with a single button click (accept or reject). However, for consent to be valid (e.g. device access and data processing for marketing purposes) users must be informed about the two distinct consent requests: access (under the TTDPA) and processing (under the GDPR).
• There are two options for accessing data without consent. Art. 6 para. 1 lit. f GDPR is not enough for the TTDSG. Consent is not required if a message is transmitted via a public telecommunications network or if the user desires the service.

Consent withdrawal: Required, and should be as easy to withdraw as it is to give consent.

Cookie duration: Not explicitly stated, but cookie duration must be part of the information communicated to users, and consent renewal every 6 to 12 months is recommended.

Greece data privacy laws and consent requirements

Protected groups: Focuses on privacy re. end user devices, so any computer, phone, etc. users on which companies use trackers.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc., even if personal data is not collected.

Consent definition: Uses GDPR definition.

Prior consent: Yes, in most cases.

• Consent is not required for trackers that are necessary for the website to function, or if it’s a service explicitly requested by the user, for example:
  • identifying and/or maintaining content or user-provided information for the duration of the session (e.g. shopping cart)
  • connection to services that require prior authentication
  • security
  • load balancing
  • user preferences for website appearance and experience, e.g. language, search history, etc.
• Browser settings that allow the use of cookies are not considered consent.
• If the user does not make a choice, no non-essential cookies should be used.

Consent withdrawal: Yes, consent can be withdrawn at any time, and it must be as easy to do so as to give it. It also must be as easy to deny consent initially (e.g., the same action or number of steps) as to give consent.

Cookie duration: Not explicitly stated, but cookie duration must be part of the information communicated to users, and consent renewal every 6 to 12 months is recommended.

Ireland data privacy laws and consent requirements

Protected groups: Focuses on privacy re. end user devices, so any computer, phone, etc. users on which companies use trackers.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition: Uses GDPR definition, and also ePrivacy Directive definition: “The law applies to any storage of information on a user’s device or equipment, as well as to access to any information already stored on the equipment – this means through the use of browser cookies or other technologies such as device fingerprinting or the use of pixels or similar devices. It is irrelevant whether the information stored or accessed consists of, or contains, personal data. The ePrivacy Regulations apply when any information is stored on or accessed from the device.”

Prior consent: Yes, in most cases, and its requirement for cookie use is explicit.

Consent withdrawal: Required, users must be informed how they can withdraw consent, and should be as easy to withdraw as it is to give consent. Also cannot be bundled, e.g. with terms and conditions.

Cookie duration: Six months for cookie use requiring consent. For other cookies, lifespan should be proportional to their purpose and no longer than necessary to fulfill the purpose.

Italy data privacy laws and consent requirements

Protected groups: Focuses on privacy re. end user devices, so any computer, phone, etc. users on which companies use trackers.

Relevant cookie use: “all the entities providing their users with publicly accessible online services through electronic communications networks or else operating websites that rely on cookies and/or other tracking tools”

Consent definition: Uses GDPR definition.

Prior consent: Yes, in most cases, and its requirement for cookie use is explicit.

Consent withdrawal: Required, or modifying consent choices or providing consent after rejecting it. It must be provided in a simple, easy, and user-friendly way accessible via the website footer, and that is as easy as giving consent.

Cookie duration: Not explicitly referenced, recommended to err on as short a period of time as is necessary to fulfill the purpose of the specific cookie type and/or processing operations.

Latvia data privacy laws and consent requirements

Protected groups: Users who use services and whose data is collected on websites, etc.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition: Uses GDPR definition.

Prior consent: Yes, in most cases, and its requirement for cookie use is explicit.

Consent withdrawal: This is required. Users must be informed how they can withdraw consent, and it should be as easy to withdraw as it is to give consent.

Cookie duration: “There is no specific time limit for how long consent is valid. The length of time consent is valid depends on the context, the scope of the original consent and what the data subject expects. If the processing activities change or evolve significantly, the original consent will no longer be valid. In that case, a new consent must be obtained. If the processing activities change or evolve significantly, the original consent will no longer be valid. In that case, a new consent must be obtained.”

Netherlands data privacy laws and consent requirements

Protected groups: Users of websites, or equivalent, e.g. apps, etc.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition: Uses GDPR definition.

Prior consent: Yes, in most cases. Consent can be provided in writing, by ticking a box, clicking a button or link, filling out an electronic form, sending an email, providing an electronic signature or scanned document with a signature, or verbal consent.

Consent withdrawal: Yes, and it has to be as easy to withdraw consent as it was to give consent.
Cookie duration: No explicit time period is provided, but users must be notified about the duration of all cookies set.

Spain data privacy laws and consent requirements

Protected groups: Users of websites, mobile applications, or other platforms. (Contractual agreements are also required with third parties.)

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition: Uses GDPR definition.

Prior consent: Yes, in most cases. Cookies used for the purpose of obtaining traffic or performance statistics may be exempt from consent requirements under specific conditions:

• use is limited to what is strictly necessary for the provision of the service
• processing must be carried out exclusively on behalf of the publisher and used only to produce anonymous statistical data
• use of these cookies/trackers must not result in data being matched with other processing operations or transmitted to third parties
• aggregate tracking of the navigation of the person using different applications or browsing different websites is prohibited

Consent withdrawal: Required, at any time, as easily as it is to give consent, and users must be provided with information on how to do so.

Cookie duration:

• Duration or lifetime of cookies or similar technologies must be limited to a period that allows meaningful comparison of audiences over time, e.g. 13 months. Duration cannot automatically be extended if users make new visits to the site.
• Information collected via cookies or other tracking technologies will not be retained for more than 25 months. (Best practices state no more than 24 months.)
• Lifetime and retention periods will be subject to periodic review to limit it to what is strictly necessary.

Sweden data privacy laws and consent requirements

Protected groups: Users of websites, mobile applications, etc.

Relevant cookie use: All cookies and trackers used on devices, e.g. websites, apps, etc.

Consent definition: Uses GDPR definition, and granular consent options for specific purposes are required.

Prior consent: Yes, with no exceptions for necessary cookies.

Consent withdrawal: Yes, and it must be as easy as giving consent. Users must also be provided clear information on how to withdraw consent or otherwise change preferences. Revoking consent cannot have negative consequences for users, e.g., no longer being able to access the website.

Cookie duration: No explicit time period provided.

NON-EU COUNTRY-SPECIFIC CONSENT LAWS AND GUIDELINES

Norway data privacy laws and consent requirements

Protected groups: Website users.

Relevant cookie use: All cookies and similar tracking technologies used on websites that collect personal data.

Consent definition: Follows GDPR definition and requirements. Storage and processing of information is not permitted unless the user is informed about, and has consented to, which information is processed, the purpose(s) of the processing, and who processes the information.

Prior consent: Yes, in most cases.

Consent withdrawal: Yes, at any time.

Cookie duration:

• Session-based cookies: deleted after the end of the session, i.e. when the user closes the browser.
• Persistent cookies: not deleted after the end of the session and often contain information about authentication, language settings, and menu selections. Most permanent cookies have an expiry date when they are automatically deleted after a certain period. However, the guidelines do not set a specific expiration date.
• Third-party cookies: can be session-based or persistent, but they’re set by someone other than the website operator. Their duration is dependent on the third-party vendor, who is also responsible for providing relevant information about their cookies’ use, their identity, duration, etc.

Switzerland data privacy laws and consent requirements

Protected groups: Swiss citizens.

Relevant cookie use: Yes, in some cases when personal data is collected and processed, and also if data is transferred across international borders.

Consent definition: Uses GDPR requirements.

Prior consent:

• Yes, in some cases. However, it is not always necessary to obtain consent from users before collecting or processing personal data. Though there are other legal bases, it is always necessary to inform them about the controller and processing.
• Prior consent is always required for processing:
  • of sensitive data
  • for high-risk profiling by a private person
  • for profiling by a federal body (government)
  • with data transfers to third countries where there is not adequate data protection

Consent withdrawal: Yes, at any time.

Cookie duration: There are no explicit guidelines, but data must be deleted or anonymized when the processing purpose has been fulfilled.

United Kingdom data privacy laws and consent requirements

Protected groups: Individuals whose personal data is processed.

Relevant cookie use: The cookie rules apply to the subscriber or user’s “terminal equipment” e.g. computer or mobile phone. The subscriber is the person who pays the bill for the use of an online service, and the user is the person who uses a device to access an online service.

Consent definition: Uses GDPR definition and requirements.

Prior consent: Yes, in most cases.

Consent withdrawal: Yes, users must be able to withdraw consent at any time as easily as they gave it, and receive information about how consent can be withdrawn, and how cookies already set can be removed.

Cookie duration: There are no explicit guidelines, but it will depend on the service and the purpose of the processing for the data the cookie collects (and for which user consent is required). It should be limited to the minimum time necessary to fulfill the purpose of processing. Cookie duration may also affect exemptions in Regulation 6(4).