Should registered users accept cookie consent in GDPR?
<p>I want to use cookie consent for saving user language, currency and affiliate marketing purpose.</p>
<p>Can I store data without consent of the registered users? They are registered so do I need to take consent from them.</p>

<p>Yes, you still need consent (opt-in).</p>
<h2 id="cookies-usually-require-consent-but-not-always-qzt6">Cookies usually require consent, but not always.</h2>
<p>There are two relevant laws at play here: GDPR makes general rules about the processing of personal data, and ePrivacy has specific rules about cookies and similar technologies, regardless of whether the cookies involve personal data.</p>
<p>The ePrivacy directive was implemented in your EU member state (or the UK) in national law. The national laws contain the authoritative rules on this matter. But in general:</p>
<ul>
<li>Accessing or storing any information (such as cookies) on the end user's device requires consent.</li>
<li>Consent is defined by the GDPR.</li>
<li>You do not need consent if the access/storage is <em>strictly necessary</em> for a service <em>explicitly requested</em> by the user (“functional cookies”).</li>
</ul>
<p>Using cookies to store site preferences such as user language is strictly necessary for a service explicitly requested by the user, so you do not need consent for this. You must still make your use of cookies transparent to the user.</p>
<p>Setting cookies for marketing purposes is not strictly necessary to provide the service, so you always require consent for them.</p>
<h2 id="registered-users-dont-automatically-give-consent-o9zr">Registered users don't automatically give consent.</h2>
<p>You now raise the interesting question if this is also the case if the user is already registered. <strong>Yes, you still need consent (opt-in).</strong></p>
<p>This is due to the way how the GDPR defines “consent”. Consent is not general or vague agreement. Agreement with your terms of service or privacy policy is not consent in the sense of the GDPR. Instead, consent is defined in Art 4(11) GDPR to be (emphasis mine):</p>
<blockquote>
<p>any freely given, <strong>specific, informed and unambiguous indication</strong> of the data subject’s wishes by which he or she, by a statement or by a <strong>clear affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her</p>
</blockquote>
<p>Art 7 GDPR adds further conditions for consent. (1) You are responsible for demonstrating that the user has given valid consent. (2) The request for consent should be clearly distinguishable from other matters (i.e. not buried in a larger document) and should be presented “in an intelligible and easily accessible form, using clear and plain language.” (3) Withdrawing consent must be as easy as giving it. (4) In general, you cannot make access to a service conditional on unrelated consent. I.e. you can't force your users to consent to marketing cookies in order to use the app. The users must have an actual choice, or the consent isn't freely given.</p>
<p>Supervisory authorities have produced extensive guidance on the matter of consent.
If you're in the UK, consider the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/" rel="noreferrer">ICO Guide to Consent</a> and <a href="https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/" rel="noreferrer">Guidance on the use of cookies and similar technologies</a>.
If you're in the EU/EEA, consider the <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en" rel="noreferrer">EDPB Guidelines 05/2020 on Consent (PDF)</a>.</p>
<p>To summarize why agreement with your terms of service is not consent to marketing cookies:</p>
<ul>
<li>Agreement to such large documents is not sufficiently <em>specific</em>.</li>
<li>The consent would not be sufficiently <em>informed</em>. You cannot expect users to actually read all your legal documentation. You must present information in an intelligible manner, possibly with multiple layers (compare <a href="https://ec.europa.eu/newsroom/article29/items/622227/en" rel="noreferrer">WP29 Guidelines on Transparency, endorsed by EDPB</a>).</li>
<li>Agreement to your terms of service is not an <em>unambiguous indication</em> that the user wants these cookies.</li>
<li>If consent to marketing cookies is a <em>condition</em> of using your service, the consent is likely invalid.</li>
</ul>
<p>The consequence is that cookie consent is usually obtained via separate consent management tools that provide detailed explanations about different categories of cookies, and let the user select which specifically categories of cookies they want to consent to, if any.</p>
<h2 id="outside-of-cookies-consent-is-just-one-legal-basis-among-many-kkkt">Outside of cookies, consent is just one legal basis among many.</h2>
<p>In this context, you might ask “if getting consent is so difficult, but GDPR requires that I have consent, how does that work?” It is a common misconception that the GDPR requires consent for everything – the ePrivacy requirement that most cookies need consent is one of the exceptions. In general, GDPR offers a choice of six categories of legal bases for processing in Art 6 GDPR, and consent is just one of them. In many cases, an online service will process personal data because it is necessary to fulfil a <em>contract</em> with the user, or because there is a <em>legitimate interest</em> for the processing (and the legitimate interest outweighs the user's interests). For example, reasonable security measures such as keeping logfiles can be based on a legitimate interest and do not require consent.</p>

gdpr consent cookies