{"id":338,"date":"2021-09-13T11:24:44","date_gmt":"2021-09-13T09:24:44","guid":{"rendered":"https:\/\/stage.usercentrics.com\/?post_type=knowledge&p=13763"},"modified":"2025-06-26T14:29:31","modified_gmt":"2025-06-26T12:29:31","slug":"edpb-guidelines-for-consent","status":"publish","type":"knowledge","link":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/","title":{"rendered":"European Data Protection Board guidelines for consent"},"content":{"rendered":"

On May 4, 2020, the European Data Protection Board (EDPB) published its updated <\/span>Guidelines on consent for the use of websites<\/span><\/a>, bringing legislation one step closer to its goal of achieving a uniform interpretation of data protection rules across the EU. In this article, we have compiled a summary of the most important points.<\/span><\/p>\n\n\n

The EDPB’s current guidelines – what you need to know<\/h2>\n\n\n

The EDPB reconfirms many of the existing rules, including the requirements for <\/span>GDPR-compliant user consent<\/span><\/a>:<\/span><\/p>\n

Among other requirements, legally abiding consent must be given in a voluntary, explicit and granular manner.\u00a0 <\/strong>In the context of the GDPR, voluntary refers to an action, for example, in the form of an opt-in.\u00a0<\/span><\/p>\n

Scrolling a website does not count towards a form of valid consent<\/span><\/h3>\n

The user must actively and explicitly consent to the processing of their data. Scrolling without additional action or browsing further on the website is therefore not an explicitly confirming action.\u00a0<\/span><\/p>\n

Voluntary consent also means that the user must be granted genuine freedom of choice. If the user refuses to disclose their data, this must not result in any disadvantages to them. As a rule, a disadvantage exists not only if the user is prevented from visiting a website, but also if the provision of a product or service is linked to the granting of the user’s consent without offering an appropriate alternative for the consent.\u00a0<\/span><\/p>\n

If there are different purposes for data processing, the EDPB believes that the solution for valid consent lies in granularity, i.e., separating and obtaining consent on a granular basis for each purpose.<\/span><\/p>\n

Cookie walls only permitted in exceptional cases<\/span><\/h3>\n

The EDPB regards the forced interaction with a banner, mostly in the form of cookie walls, as being extremely questionable. However, the EDPB permits such walls if the user is given the option to choose to decline and can use the website either way.<\/span><\/p>\n

As previously ruled by the European Court of Justice (ECJ) in the <\/span>Planet49 case<\/span><\/a>, the EDPB <\/span>further confirms that “active action” in the context of consent can only take place through an opt-in.<\/strong> A pre-ticked box, where the user must instead take action to opt-out, namely to prevent processing, does not constitute legally effective consent.\u00a0<\/span><\/p>\n

Offering incentives\u00a0<\/span><\/h3>\n

For the topic of incentives, the EDPB outlines appropriate procedures for when and if they can be offered to obtain consent. However, the user should not be influenced to the extent that a well-considered decision seems practically impossible.<\/span><\/p>\n

Tighter restrictions for the right to information<\/span><\/h3>\n

More stringent requirements arise for website operators with regards to the duty to provide information. For example, in the case of a multi-layer cookie banner, a website provider must inform the user about the identity of the controller and the purposes of the processing in the first information level or layer of the cookie banner. If the information obligation is not complied with, the controller will not be able to prove that consent has been obtained in compliance with data protection requirements.<\/span><\/p>\n\n\n

Conclusion<\/h2>\n\n\n

The current EDPB guidelines clearly reveal that the requirements for obtaining consent have become more stringent. What is particularly noteworthy are the EDPB statements on practical implementation. What can be taken from here is that the EDPB wants to pass on the responsibility of the legislator to find a legally practicable solution to the responsible parties involved. The conclusion is clear: not only do website operators have to comply with various regulations in order to be able to prove legally binding user consent, they must also find user-friendly solutions that can be implemented in practice.\u00a0<\/span><\/p>\n

O<\/span>ne thing is for certain: if a website operator actually complies with all the GDPR regulations on consent, the user experience will be compromised. This is because the website visitor would be faced with overcrowded cookie banners on every website, and even technically savvy users would probably reach their tolerance limits.\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

The EDPB therefore sees the task of collecting GDPR-compliant consent \u2013 while having “consent fatigue” in mind \u2013 as the responsibility of the website operator, as stated in the following excerpt: <\/span>\u201cThe GDPR places upon controllers the obligation to develop ways to tackle this issue.\u201d\u00a0<\/strong><\/p>\n\n

\n
\n \n\n<\/svg>\n <\/div>\n
\n
About EDPS – background knowledge and positioning<\/div>\n

The European Data Protection Board (EDPB), as an independent European body, promotes cooperation between EU data protection authorities and the consistent application of data protection rules throughout the European Union.<\/span><\/p>\n

\u00a0With the enactment of the General Data Protection Regulation, Article 29 of the data privacy group was replaced. The current guidelines do not initially result in any mandatory rules for data controllers within the scope of the GDPR. However, it is foreseeable that if the European data protection authorities use the guidelines as a benchmark for assessing the legal compliance of data controllers, they will – at least indirectly – have a binding effect on data controllers in the future.<\/span><\/p>\n <\/div>\n<\/div>\n\n\n\n\n

Autoren: Jana Krahforst & Carolin Wei\u00dfofner, Legal Team Usercentrics<\/b><\/p>\n

DISCLAIMER: <\/span>The implementation of a data protection-compliant implementation of a Consent Management Platform is ultimately at the discretion of the respective data protection officer or legal department. <\/span><\/em>These explanations therefore do not constitute legal advice. They merely serve to support you with information about the current legal situation when implementing a Consent Management Platform solution. If you have any legal questions, you should consult a qualified attorney.<\/span><\/em><\/p>","protected":false},"excerpt":{"rendered":"

In this article, we have compiled a summary of the most important points from the European Data Protection Board’s, new guidelines for Consent.<\/p>\n","protected":false},"featured_media":2091,"template":"","meta":{"_acf_changed":false,"editor_notices":[],"footnotes":""},"tags":[],"magazine_issue":[],"magazine_tag":[],"resource_tag":[14,63,13],"class_list":["post-338","knowledge","type-knowledge","status-publish","has-post-thumbnail","hentry","resource_tag-privacy","resource_tag-legal-news","resource_tag-regulations"],"acf":[],"yoast_head":"European Data Protection Board (EDPB) Consent Guidelines<\/title>\n<meta name=\"description\" content=\"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.\" \/>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"European Data Protection Board (EDPB) Consent Guidelines\" \/>\n<meta property=\"og:description\" content=\"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/\" \/>\n<meta property=\"og:site_name\" content=\"Usercentrics - US\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/usercentrics\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-26T12:29:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/09\/EDPB.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"European Data Protection Board (EDPB) Consent Guidelines\" \/>\n<meta name=\"twitter:description\" content=\"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/09\/EDPB.png\" \/>\n<meta name=\"twitter:site\" content=\"@usercentrics\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/\",\"name\":\"European Data Protection Board (EDPB) Consent Guidelines\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2021\\\/09\\\/European-Data-Protection-Board-guidelines-for-consent.svg?v=9887092ab3d25850\",\"datePublished\":\"2021-09-13T09:24:44+00:00\",\"dateModified\":\"2025-06-26T12:29:31+00:00\",\"description\":\"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/\"}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/#primaryimage\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2021\\\/09\\\/European-Data-Protection-Board-guidelines-for-consent.svg?v=9887092ab3d25850\",\"contentUrl\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2021\\\/09\\\/European-Data-Protection-Board-guidelines-for-consent.svg?v=9887092ab3d25850\",\"caption\":\"European Data Protection Board guidelines for consent\",\"copyrightNotice\":\"\u00a9 Copyright 2026 Usercentrics GmbH\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Usercentrics GmbH\"},\"creditText\":\"Image: Usercentrics GmbH\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"European Data Protection Board guidelines for consent\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/edpb-guidelines-for-consent\\\/\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/#website\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/\",\"name\":\"Usercentrics - US\",\"description\":\"Consent Management Platform (CMP) Usercentrics\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/?s={search_term_string}\"}}],\"inLanguage\":\"en-US\"}]}<\/script>","yoast_head_json":{"title":"European Data Protection Board (EDPB) Consent Guidelines","description":"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"European Data Protection Board (EDPB) Consent Guidelines","og_description":"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.","og_url":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/","og_site_name":"Usercentrics - US","article_publisher":"https:\/\/www.facebook.com\/usercentrics","article_modified_time":"2025-06-26T12:29:31+00:00","og_image":[{"url":"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/09\/EDPB.png","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_title":"European Data Protection Board (EDPB) Consent Guidelines","twitter_description":"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.","twitter_image":"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/09\/EDPB.png","twitter_site":"@usercentrics","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/","url":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/","name":"European Data Protection Board (EDPB) Consent Guidelines","isPartOf":{"@id":"https:\/\/usercentrics.com\/us\/#website"},"primaryImageOfPage":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/#primaryimage"},"image":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/#primaryimage"},"thumbnailUrl":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/09\/European-Data-Protection-Board-guidelines-for-consent.svg?v=9887092ab3d25850","datePublished":"2021-09-13T09:24:44+00:00","dateModified":"2025-06-26T12:29:31+00:00","description":"In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.","breadcrumb":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/"}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/#primaryimage","url":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/09\/European-Data-Protection-Board-guidelines-for-consent.svg?v=9887092ab3d25850","contentUrl":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/09\/European-Data-Protection-Board-guidelines-for-consent.svg?v=9887092ab3d25850","caption":"European Data Protection Board guidelines for consent","copyrightNotice":"\u00a9 Copyright 2026 Usercentrics GmbH","creator":{"@type":"Organization","name":"Usercentrics GmbH"},"creditText":"Image: Usercentrics GmbH"},{"@type":"BreadcrumbList","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Resources","item":"https:\/\/usercentrics.com\/us\/resources\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/usercentrics.com\/us\/knowledge-hub\/"},{"@type":"ListItem","position":3,"name":"European Data Protection Board guidelines for consent","item":"https:\/\/usercentrics.com\/us\/knowledge-hub\/edpb-guidelines-for-consent\/"}]},{"@type":"WebSite","@id":"https:\/\/usercentrics.com\/us\/#website","url":"https:\/\/usercentrics.com\/us\/","name":"Usercentrics - US","description":"Consent Management Platform (CMP) Usercentrics","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/usercentrics.com\/us\/?s={search_term_string}"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge\/338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge"}],"about":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/types\/knowledge"}],"version-history":[{"count":0,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge\/338\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/media\/2091"}],"wp:attachment":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/media?parent=338"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/tags?post=338"},{"taxonomy":"magazine_issue","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/magazine_issue?post=338"},{"taxonomy":"magazine_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/magazine_tag?post=338"},{"taxonomy":"resource_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/resource_tag?post=338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}