Consent Processing

Most people are familiar with the basics of online consent. Indeed, “consent” is a fundamental part of processing user data. It has a special place at the heart of digital privacy theory.

Early privacy scholars like Alan Westin advocated for a “notice and choice” model of user privacy that’s still popular today. In this model, consent is the key that unlocks a processor or business’s ability to leverage user data.

Given the importance of consent, it shouldn’t be surprising that there’s plenty of legal wrangling over how it’s defined. In the past, simply visiting a website might have considered an implied form of consent, in other words, it suggested the website could use visitors’ data however they wished. That’s not the case any more.

GDPR and “Informed Consent”

Now, the gold standard for consent is called “informed consent.” Under GDPR, this means:

• Consent is freely given. Any withholding information or inappropriate pressure can invalidate the idea of “freely given consent.”
• Consent is specific, informed, and unambiguous. In other words, there can be no question about what is being consented to, and there can be no open-ended statements leaving the scope of the consent undefined.

The CCPA’s “Do Not Sell My Personal Information” & Modern Consent Processing

The CCPA’s “Do Not Sell” is an attempt at solving modern questions of online consent. Typically the user journey for managing consent preferences for a given company is long and circuitous. If a user wants to withdraw their consent regarding the selling of their personal data, they might have to visit multiple web pages and complete multiple different request forms, each of which would be processed by a different business department.

CCPA seeks to remedy this by making companies feature one big “Do Not Sell My Personal Information” button on their homepage and in their privacy policy. The aim is make it easier for users to manage their preferences so that exercising rights of their data doesn’t take as much effort.

You can learn more about the CCPA’s “Do Not Sell” provision in our dedicated article.

The “Do Not Sell” Button

One of the most discussed aspects of CCPA is the design of the “Do Not Sell” button. There’s been confusion over how the button should look because of ambiguity in the user choice. Do users check a box to say “Yes, do not sell my information”? Or un-check a box to say “No, do not sell my information”? Faced with calls for clarification from the public, the California Attorney General’s Office issues additional guidance on the button, including the below example of acceptable design:

The confusion around “Do Not Sell” interaction design -which wasn’t fully alleviated by the image above, speaks to the need to for clear guidance and ongoing dialog between privacy authorities and relevant business stakeholders.