Summary

• The ePrivacy Regulation doubles down on the approach that has irritated internet users with ubiquitous consent banners and other forms of consent requests over the past five years. By failing to revise this consent approach in favour of the principles-based approach of the GDPR, the ePrivacy Regulation will trigger even more irritating consent pop ups than the ePrivacy Directive.
• IAB Europe recommends to amend Article 8(1) ePR to fully align it with the principles-based approach of the GDPR on lawful processing, including processing necessary for a legitimate interest where the fundamental rights of a data subject are not overriding. Currently rules of Article 8(1) deviate from the rules of the GDPR by imposing a rigid set of consent-centered specific exceptions. While IAB Europe does not consider it necessary to change principles adopted as recently as those of the GDPR, any changes should respect the flexibility and diversity of legal processing under the GDPR.
• IAB Europe recommends that the ePrivacy Regulation maintains the clarification found in the current ePrivacy Directive that access to an online service may be made conditional on the well- informed consent of the user to data processing for advertising purposes not strictly technically necessary for provision of that service but which are necessary for the monetisation model chosen by that service.
• IAB Europe warns strongly against mandating browsers to provide the option to block processing at a technical level. The effect in most cases would be that services could not function properly without users changing their browser settings, resulting in more user irritation as websites would prompt users to change their browser settings.
• IAB Europe welcomes the intention of the European Commission to address the “overload of consent requests for internet users” by allowing users to express their consent on a general basis. However, it is doubtful that this would reduce the amount of notices users receive as they are mandatory under the GDPR. In addition, users would still face specific consent requests, such as consent banners or consent walls, where they do not consent on a general basis.

For additional information, please contact Matthias Matthiesen, Senior Manager – Privacy & Public Policy at IAB Europe (matthiesen@iabeurope.eu, +32 (0) 2256 7507)