Tracking via cookies means gathering personal data, the exact thing GDPR regulates. GDPR says that data must not be collected except on one of a few lawful bases, one of which is consent. Article 7 clause 4 of the GDPR says:
When assessing whether consent is freely given, utmost account shall be taken of whether […] the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
to me this reads like: “consent does not count if you need to agree in order to access a service” and that they imagined consent as being, “yes, you can have my personal data to serve me personalised ads, because I’d rather have personalised ads than generic ones,” which some people (probably not many here!) do think. However, it’s only expressed as “account shall be taken” when determining whether consent was “freely given” and the lawful basis does not specify that consent must be “freely given,” which is where I imagine these kinds of gaps creep in.
Tracking via cookies means gathering personal data, the exact thing GDPR regulates. GDPR says that data must not be collected except on one of a few lawful bases, one of which is consent. Article 7 clause 4 of the GDPR says:
to me this reads like: “consent does not count if you need to agree in order to access a service” and that they imagined consent as being, “yes, you can have my personal data to serve me personalised ads, because I’d rather have personalised ads than generic ones,” which some people (probably not many here!) do think. However, it’s only expressed as “account shall be taken” when determining whether consent was “freely given” and the lawful basis does not specify that consent must be “freely given,” which is where I imagine these kinds of gaps creep in.