GDPR Privacy FAQs: Can organizations rely on browser settings to gain consent to the deployment of cookies?

November 27, 2019

Likely not.

While the UK’s Privacy and Electronic Communications Regulation suggests that, in some circumstances, consent may be inferred when a subscriber amends or sets controls in an internet browser, the ICO has clarified that “[f]or consent to be clearly signified, it would need to be clear that users and subscribers had been prompted to consider their current browser settings.”1  This, in turn, would require some type of evidence that the subscriber made a change or was happy with the default.2  But since not everyone is familiar with these settings, other apps that adjust settings, and user access websites through various devices (such as smart tvs), the net result is that the ICO has effectively disavowed browser settings as a basis for consent.  In its most recent guidance, the ICO states “[i]n future you may well be able to rely on the user’s browser settings as part, or all, of the mechanism for satisfying yourself that you have consent to set cookies. For now, relying solely on browser settings will not be sufficient. Even when browser options are improved it is likely not all users will have the most up-to-date browser with the enhanced privacy settings needed for the settings to constitute an indication of consent.”3


This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf (at p. 30).

2. Id.

3. Id.

This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.