Global Privacy Control: limitations as a GDPR refusal mechanism

Stunned to see that Global Privacy Control won’t work as a refusal mechanism under the GDPR / Digital Omnibus, as it doesn’t support active change notifications.

Some context:

While the GDPR contains a “data subject request forwarding” obligation regarding erasure, rectification & rectification requests, it doesn’t in relation to consent withdrawal (or objections).

In the Proximus judgment of 27 October 2022 (C‑129/21), though, the EU Court of Justice foresaw such a mechanism for “unique consent” withdrawal, based on Art. 5(2) & 24 GDPR on accountability:

Where […] various controllers rely on the single consent of the data subject in order to process his or her personal data for the same purpose, it is sufficient, in order for that data subject to withdraw such consent, that he or she contacts, for the purposes of the withdrawal requested, any one of the controllers which rely on that same consent” (para 84)

It’s not hard to imagine this going further despite the specific context (purpose-specific consent re phone guides under Art. 12 ePrivacy Directive, not controller-specific consent).

Next, in the IAB Europe case, the Belgian DPA stated in para. 439 that “the withdrawal of consent is never immediate and thus cannot be considered effective” where “the withdrawal of a consent via a CMP will only take effect as soon as the vendor concerned reads the new values in the modified TC String via the CMP API” (CMPs, consent management platforms, being “at the intersection between users and participating adtech vendors, who receive their personal data and then process them for their own purposes”).

Para 438 linked this to the inability for consent to be withdrawn as easily as it was given (Art. 7 GDPR).

The result? An EventListener approach became mandatory through the TCF 2.2, to force real-time verifications.

=> So auto-forwarding of consent withdrawal signals has already been demanded by authorities in certain cases (notably re online choices), and courts seem open to the idea.

Yet Global Privacy Control / GPC does not support this.
If A says “yes” today, website B can rely on that signal forever, even if A switches to “no”, as long as A doesn’t revisit B. The signal is taken into account – as long as no new visit takes place. So if A changes his/her choice globally, it potentially has no impact for days, weeks or even months.

Fixing would seem to require A’s browser to notify *all* websites previously visited of the updated signal. (Which could be fun in terms of data consumption for all mobile users, for instance, and which wouldn’t resolve situations where someone’s browsing history has been deleted.)

I wasn’t convinced that the GPC could be a solution to the Digital Omnibus’s GDPR 88b proposal, but this seems to make it worse.

Perhaps the fix is then to get rid of 88b altogether – or to make it more flexible.

More on GPC & 88b: https://lnkd.in/ekB47RDx