The Federal Ministry of Justice and Consumer Protection published the final report of the research project “Innovative Data Protection Consent Management” it initiated on Monday. The commissioned institute for consumer policy ConPolicy comes to the conclusion that, contrary to the notion of “click-tired” users annoyed by constant cookie banners, there are definitely “practical options” for an opt-in, which are legally compliant with the provisions of the General Data Protection Regulation (GDPR) and implement it intuitively.
The experts at ConPolicy have it as part of the study tested a relevant model for the online area with a specific web design together with Miele and Deutsche Telekom and presented a sample solution based on the results. According to the information provided by the scientists, this takes into account many of the demands they have made. Accordingly, the use of a service must in principle also be possible without consent to further processing of personal data. “Data-saving default settings” should be made for the aspects relevant to consent.
Overall, according to the report, an opt-in procedure should be easy to use, user-group-specific and compatible with different end devices. In general, the model should “not distract from the essentials”. The developers should refrain from “manipulating or framing” the content using, for example, “dark patterns”. A “data protection cockpit” should be made available for the subsequent administration of the granted consents and data processing as well as for easier handling of usage rights.
According to the institute, a representative online survey carried out as part of the project shows that the vast majority of consumers are clearly in favor of individual choices and settings. It is a myth that everything is clicked. Providers that allowed a differentiated opt-in were considered more trustworthy. The great majority of the participants consider it problematic if they can use a service “only with consent to data processing that is not required”. The ministry hopes that the results will provide “an important impetus for companies” to adapt the exemplary process presented. With the GDPR, the legislator has made it clear that consumers have a right to transparency and the necessary information must be “understandable without studying law”.