Yes, provided that the “opt-out” selection is the default when the banner loads and no behavioural or analytics cookies load prior to an “opt-in” by the data subject.
A data subject’s consent to the use of analytics or behavioural cookies must be a valid “affirmative act.” Thus, if the data subject is presented with notice of the use of behavioural and analytics cookies, and the data subject must “check” or “tick” boxes to consent to the use of these cookies, that consent is likely valid. It is not valid, however, to “pre-check” boxes on behalf of the data subject.1 Put another way, the default setting for the data subject must be “opt-out” not “opt-in.”
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. GDPR, Recital 32; see https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf (published 3 July 2019) (“If the cookies you set aren’t exempt . . . then you can only use consent – and this must be of the GDPR standard. This is also the case whether or not personal data is involved.”).
[View source.]
