The right to refuse cookies on websites

[bakerstreet]

As I understand it, I think as part of GDPR and other consumer law, web users have the right to refuse cookies and websites must offer the chance for users to avail themselves of this refusal.

However, I’ve noticed in recent weeks that there are a number of sites which – whilst offering users the chance to refuse cookies – suggest you must now pay for the privilege or subscribe to their services in order to remain anonymous/refuse cookies.

I know there are ways around this (like anonymous browsing and privacy applications) but in principle are those websites which are charging for the ability to refuse cookies adhering to current regulations?

 

[Broucek]

I'd wondered that too

 

[lachlan]

I don't believe GDPR is relevant but under the cookie laws I understand it should be as easy to reject cookies as it is to accept them so any website asking you to pay (!!) to avoid cookies would be in breach.

 

[dosxuk]

As I understand it, I think as part of GDPR and other consumer law, web users have the right to refuse cookies and websites must offer the chance for users to avail themselves of this refusal.

However, I’ve noticed in recent weeks that there are a number of sites which – whilst offering users the chance to refuse cookies – suggest you must now pay for the privilege or subscribe to their services in order to remain anonymous/refuse cookies.

You have misunderstood, almost completely, the role of GDPR over cookies.

Firstly, you have no right to absolutely opt out of cookies. Sites are able to place cookies without asking for permission and remain fully compliant with GDPR.

Secondly, while you have to be given the option to decline a company from storing data about you, they also have the option to decline serving you with data.

At it's roots, this is no different to any other business interaction - you might have the option to go into a shop with no top on, just as they have the option of not serving you in that state. You can decline to allow somewhere to monetize your visit, and they can decline to provide you with a service.

 

[Bevan Price]

As I understand it, I think as part of GDPR and other consumer law, web users have the right to refuse cookies and websites must offer the chance for users to avail themselves of this refusal.

However, I’ve noticed in recent weeks that there are a number of sites which – whilst offering users the chance to refuse cookies – suggest you must now pay for the privilege or subscribe to their services in order to remain anonymous/refuse cookies.

I know there are ways around this (like anonymous browsing and privacy applications) but in principle are those websites which are charging for the ability to refuse cookies adhering to current regulations?

My attitude is that any such website that charges me to avoid cookies is one which I will not need to use.

Sites that tell us that cookies are "for our benefit", or "to improve our browsing experience" are mostly liars - they are mostly for "them" to snoop on us. I set browsers to "delete cookies on exit" where that option is allowed.

 

[dangie]

When you click on ‘Decline Cookies’ how do you know you are actually declining Cookies? The website builder can configure that link to whatever they wish. Most would be none the wiser.

 

[gswindale]

I don't think I've ever seen a site offer me the option to reject cookies for a small payment! How would that work in any case? Would it not need a cookie to store that information?

 

[35B]

I don't think I've ever seen a site offer me the option to reject cookies for a small payment! How would that work in any case? Would it not need a cookie to store that information?

I subscribe to the Times, and this is a change they’ve recently introduced. For a “small payment” of £6.99 per month, I can access the subscription I’ve already paid for without personalisaton cookies. They are admirably frank about this being so they can sell advertising.

My subscription is at risk for a range of reasons, and they’ve added one more to that list. However, what they are doing is as far as I’m aware legal, and I have a free choice about whether I access that newspaper and the price I pay for it.

On a technical note, certain “necessary” cookies are allowed to be placed regardless of consent. I find it interesting and frustrating that they do not include the sort of personalisation cookies that might, for example, allow the website to remember the choices that I’ve made and stop hassling me.

 

[AM9]

I subscribe to the Times, and this is a change they’ve recently introduced. For a “small payment” of £6.99 per month, I can access the subscription I’ve already paid for without personalisaton cookies. They are admirably frank about this being so they can sell advertising.

My subscription is at risk for a range of reasons, and they’ve added one more to that list. However, what they are doing is as far as I’m aware legal, and I have a free choice about whether I access that newspaper and the price I pay for it.

On a technical note, certain “necessary” cookies are allowed to be placed regardless of consent. I find it interesting and frustrating that they do not include the sort of personalisation cookies that might, for example, allow the website to remember the choices that I’ve made and stop hassling me.

I wonder if somebody will come up with some sort of auto cookie deleter. I'm thinking of hitting an icon on the toolbar which places a marker on all cookies on the current site including 3rd party ones. When you've finished with the site, hitting the icon will delete all those marked cookies that have been placed. I've no idea whether that would work or whether the site owners could circumvent it's actions.

 

[MotCO]

Sites that tell us that cookies are "for our benefit", or "to improve our browsing experience" are mostly liars - they are mostly for "them" to snoop on us. I set browsers to "delete cookies on exit" where that option is alallowed.

Are there any benefits in accepting cookies? I always thought it was so that adverts you receive on websites would be more tailored to your interests, or so that it was easier to access that website in the future. Is this the case? If not, I'd like the 'cancel all cookies when I leave the website' option.

 

[greatkingrat]

Cookies don't have to be advertising related. For example this forum will use cookies so you don't have to log in again every time you visit the forum, and to keep track of what threads you have and haven't read.

 

[AM9]

Cookies don't have to be advertising related. For example this forum will use cookies so you don't have to log in again every time you visit the forum, and to keep track of what threads you have and haven't read.

That's why a toolbar butto enabling all cookies downloaded during the present visit to be purged would be helpful, - clearly, members of RUK are less likely to use the facility on this site,..

 

[Fenchurch SP]

That's why a toolbar butto enabling all cookies downloaded during the present visit to be purged would be helpful, - clearly, members of RUK are less likely to use the facility on this site,..

Firefox can be set up to delete all cookies when you close the browser. I use it most of the time and use a different browser for certain sites which I want to use cookies on.

 

[najaB]

I know there are ways around this (like anonymous browsing and privacy applications) but in principle are those websites which are charging for the ability to refuse cookies adhering to current regulations?

I suspect not, but someone will need to bring a legal challenge.

 

[takno]

The European Union are threatening action against Facebook for doing this. Facebook are classified as a large-scale gatekeeper though, and therefore have much stronger restrictions on what they can do, and the terms on which they give access. Moreover the EU only controls what happens in Europe - our legislation continues to be based on earlier European legislation, but we aren't part of their enforcement regime.

It's unlikely you'd be able to do anything against smaller companies charging for cookie avoidance, firstly because there's a good chance it's not illegal, and secondly because the regulator aren't that likely to take the case on.

Ultimately the internet doesn't pay for itself, and if you're not willing to put your hand in your pocket then you can't reasonably expect to prevent site owners from making money advertising to you. The cookies are unfortunately necessary to making advertising profitable.

 

[AM9]

The European Union are threatening action against Facebook for doing this. Facebook are classified as a large-scale gatekeeper though, and therefore have much stronger restrictions on what they can do, and the terms on which they give access. Moreover the EU only controls what happens in Europe - our legislation continues to be based on earlier European legislation, but we aren't part of their enforcement regime.

It's unlikely you'd be able to do anything against smaller companies charging for cookie avoidance, firstly because there's a good chance it's not illegal, and secondly because the regulator aren't that likely to take the case on.

Ultimately the internet doesn't pay for itself, and if you're not willing to put your hand in your pocket then you can't reasonably expect to prevent site owners from making money advertising to you. The cookies are unfortunately necessary to making advertising profitable.

There is a difference between advertisers placing cookies relating to their products, but the current level of harvesting contacts goes far beyond that where the trade is primarily selling personal details.

 

[island]

French news websites have been doing the "pay to refuse cookies" thing for years and don't seem to have suffered any interference for it.

 

[nw1]

You have misunderstood, almost completely, the role of GDPR over cookies.

Firstly, you have no right to absolutely opt out of cookies. Sites are able to place cookies without asking for permission and remain fully compliant with GDPR.

Secondly, while you have to be given the option to decline a company from storing data about you, they also have the option to decline serving you with data.

At it's roots, this is no different to any other business interaction - you might have the option to go into a shop with no top on, just as they have the option of not serving you in that state. You can decline to allow somewhere to monetize your visit, and they can decline to provide you with a service.

Really? See https://gdpr.eu/cookies/. It appears that, aside from strictly necessary cookies (maintaining user sessions, such as login sessions, being the primary use of such cookies) you MUST receive user's consent and you MUST allow users to access the service even if they refuse certain cookies. To quote the site:

Cookie compliance​

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

• Receive users’ consent before you use any cookies except strictly necessary cookies.
• Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
• Document and store consent received from users.
• Allow users to access your service even if they refuse to allow the use of certain cookies
• Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

 

[takno]

Really? See https://gdpr.eu/cookies/. It appears that, aside from strictly necessary cookies (maintaining user sessions, such as login sessions, being the primary use of such cookies) you MUST receive user's consent and you MUST allow users to access the service even if they refuse certain cookies. To quote the site:

My reading of that page is that the GDPR says essentially nothing about cookies other than that they should be considered PII and are therefore in scope. There isn't anything in that to say that you can't as a matter of principle classify the data collected as legitimate interest, or even contractual, and no sense in which the management of those cookies has to be performed via banners rather than the normal opt-out channels. The post you are replying to is therefore entirely in agreement with the page you quoted.

As you note, there is some more interesting stuff in the ePrivacy directive, but that's a completely different piece of legislation, and one where the UK has traditionally taken an extremely slack approach

 

[Peter Mugridge]

While on the subject, someone sent me this... is it actually legal to demand payment to refuse cookies?!

Given it's The Scum, I suspect it's not legal and they're seeing if they can get away with it...?

 

[najaB]

While on the subject, someone sent me this... is it actually legal to demand payment to refuse cookies?!

I think the consensus reached earlier in the thread is that, since your use of their site is entirely discretionary, they aren't breaking any laws by declining to serve you the content for free.

Payment comes either in the form of accepting advertising cookies or handing over some cash.

 

[takno]

While on the subject, someone sent me this... is it actually legal to demand payment to refuse cookies?!

Given it's The Scum, I suspect it's not legal and they're seeing if they can get away with it...?

View attachment 168184

I think the consensus view is that for non-gatekeeper sites the only thing that would make it illegal is some indicative but not very clear articles in European law, but outside og GDPR. These largely haven't been put into clear directives in national law and see zero enforcement.

In the UK they are certainly on very safe ground, since the government is in several cases loosening these kinds of protections in a couple of bills making their way through parliament. Our own Data Protection authorities are also not very interventionist, and aren't bound to follow the decisions of other more interventionist authorities in other European countries.

In most cases you can of course largely achieve more effective protection by using ad blockers and Privacy Badger in a suitable browser, and in this particular case by not visiting garbage websites.

 

[westv]

Cookies don't have to be advertising related. For example this forum will use cookies so you don't have to log in again every time you visit the forum, and to keep track of what threads you have and haven't read.

Yes, they are invaluable. As to other cookies, I couldn't care less about them really.

 

[swt_passenger]

While on the subject, someone sent me this... is it actually legal to demand payment to refuse cookies?!

Given it's The Scum, I suspect it's not legal and they're seeing if they can get away with it...?

They’re not the only national doing this, I’ve seen a few using the same options recently.

 

[35B]

While on the subject, someone sent me this... is it actually legal to demand payment to refuse cookies?!

Given it's The Scum, I suspect it's not legal and they're seeing if they can get away with it...?

View attachment 168184

I had the same from the Times a couple of months ago. It stinks (especially as I'm already a paid subscriber), but I think it's legal. What I found interesting was how much my permission was rated at, which would have added a sizeable percentage to my subscription cost.

 

[Bevan Price]

I had the same from the Times a couple of months ago. It stinks (especially as I'm already a paid subscriber), but I think it's legal. What I found interesting was how much my permission was rated at, which would have added a sizeable percentage to my subscription cost.

Your subscription is effectively a contract with the publisher of The Times. Is it legal for them to change the terms of that contract until your current subscription expires ?

 

[greatkingrat]

While on the subject, someone sent me this... is it actually legal to demand payment to refuse cookies?!

Given it's The Scum, I suspect it's not legal and they're seeing if they can get away with it...?

I suspect the overlap between people who are concerned about cookies and people who read the Sun is very small.

 

[JamesT]

Your subscription is effectively a contract with the publisher of The Times. Is it legal for them to change the terms of that contract until your current subscription expires ?

If the terms and conditions agreed to initially allow for unilateral changes (with suitable notice etc.), then it’s entirely legal.

 

[35B]

Your subscription is effectively a contract with the publisher of The Times. Is it legal for them to change the terms of that contract until your current subscription expires ?

I've no idea, and couldn't be bothered to dig on the point. It's not something that I regard as a showstopper.

 

[island]

Interesting. I also subscribe to the Times and can reject cookies (whilst logged in) without paying anything extra.