Why Consent?

And is Consent mandatory? The question is legit and we’re happy that you ask. As one of the legal bases under Art. 6 GDPR, Consent is definitely very important. Therefore, there are a number of factors that make Consent indeed, mandatory.

Ultimately, the decision of if and where you will rely on consent as a legal basis under GDPR, can be made upon a risk assessment. We put together the key elements which we consider as massive arguments pro Consent.

Consent Driving Factors to Consider

The following factors should be considered when you make your decision as to whether you will rely on consent or not
Vendors

Big vendors like Google, Facebook and many iab vendors make Consent a mandatory as part of their terms.

Complaints

If non-compliant, data subjects, NGO’s, consumer organizations and competitors have the right to sue you.

Legal interpretation

As a Controller, you have to decide on which legal basis you rely for processing personal data.

Data Authorities

Data authorities all over Europe have started to publish statements on how and where Consent applies.

Vendors

If you want to continue using the services of certain vendors, you will have to be able to proof consent to them
Google

Google EU User Consent Policy

When you use certain Google products, like DoubleClick, Adsense or Firebase, Google enforces their EU user consent policy.

In conclusion, you cannot use the Google services unless you have obtained a proper informed consent of your users – BEFORE you start tracking.

Facebook

Facebook Custom Audiences Terms

Requires Consent:

The advertiser is the controller and therefor responsible for obtaining the Consent

iab Vendors

iab Vendor: TheTradeDesk Terms

There are more than 400 vendors supporting the iab Consent & Transparency Framework, e.g. Criteo, Adition or Taboola. Certain vendors will only serve your ads, if you can transfer the consent technically, which means you will need a CMP that supports the technical format of the iab Framework.

Learn More:

Complaints

If you want to continue using the services of certain vendors, you will have to be able to proof consent to them
Data Subjects

Data Subject can file a complaint in case of a data violation

Filing a complaint is very easy and possible online on the website of the responsible data authority.

Competitors

Competitors can file a complaint in case of a data violation

NGOs / Consumer Organizations

Data Protection Activist Max Schrems (noyb.eu) sued Facebook, Google, WhatsApp for € 8 billion because of „forced consent“. His next target is „ficticious consent“

Data Protection Authorities

Data Protection Authorities are legally bind to investigate every complaint filed
Concrete Requirement

The British Data Protection Authority, ICO is very clear on the use of cookies and the need of consent for that

Random Audit

Many data protection authorities are actively auditing your GDPR-compliance