A compact consent tools overview with facts, practical tests and further information on consent tools for websites. Insider tip: Using a consent tool almost always means your website will contain significant legal defects.
Introduction
In several places, including social media, I offered a 100 euro reward to anyone who could show me a website with a consent tool that is legally compliant. The condition was that the website uses more than just Matomo, to put it briefly. I never had to pay the 100 euros. I even offered not to be petty. It was not about a privacy policy being slightly incorrect, but about the big picture, that is, the number of defects. Ten minor defects would no longer be acceptable, and neither would one major defect. Loading external Google Fonts is also not permitted (after consent it makes no sense).
Using consent tools is a terrible idea if you do not know exactly what you are doing, both technically and legally
My claim, which can be backed up in theory and in practice
Some people do not understand that consent tools, as they are commonly built, are inherently unsuitable for making websites compliant with data protection law. These people actually believe that all it takes is a correct configuration of the cookie tool to solve almost all problems. That is bullshit, as I can prove in theory and in practice.
Consent tools overview: the facts
- Processes that require consent are (short summary):
- Avoidable data transfers without a data processing agreement or similar (Art. 5(1)(c) GDPR) or
- No legitimate interest and no other legal basis (Art. 6 GDPR) or
- Use of cookies that are not technically necessary: § 15(3) TMG (due to the BGH ruling and the ePrivacy Directive) or
- Data transfers to unsafe third countries (Art. 44 GDPR).
- Conclusion: Cookies are only part of the whole problem. Consent tools essentially only look at cookies
- This is why cookie popups are doomed to fail. In brief:
- Cookies are set by services and do not exist on their own
- The loading of services cannot be reliably prevented
- Cookies cannot be blocked
- The information required under Art. 13 GDPR often cannot be provided
- The purposes of cookies must be explained, but are often unknown
- Besides loading processes and disclosure requirements, there are further rules to comply with, which consent tools apparently have never heard of. Example: accessibility of the privacy policy
- Everything about cookies
- Cookies are not text files, as many privacy policies claim
- Google Tag Manager is not a cookieless domain, because it is wrong on two counts
- A risk-based approach makes little sense on the internet
- Almost every website that uses a popular consent tool has significant legal defects – because of the consent tool. Evidence and proof: see the articles, practical tests and facts linked here
Practical tests
- Practical test of all common cookie tools. Even the websites of large companies and of consent tool vendors that use their own tool are of shamefully poor quality
- Borlabs Cookie: Not recommended, in my opinion because of its minimal suitability
- UserCentrics: Potential data transfer to unsafe third countries in order to obtain consent, because of hosting by Google, a certificate from Google USA and data storage potentially worldwide. UserCentrics would therefore itself require consent!
- OneTrust: Potential data transfer to unsafe third countries in order to obtain consent. OneTrust would therefore itself require consent!
- Cookiebot: Several contradictions between marketing claims and reality, no data processing agreement offered, so probably full liability for the user of Cookiebot
Miscellaneous
- This is how to check consent tools
- The funniest cookie descriptions: https://dr-dsgvo.de/cookie-popups-die-besten-cookie-beschreibungen-en/
- Alternatives to Google tools
- Free consent tool by Dr. DSGVO (only use it if you absolutely have to ask for consent)
Recommendations
- Remove all tools from your website that have no real benefit. Example: Google Maps makes no sense on many websites
- External Google Fonts must effectively not be used. Use local fonts!
- Google Tag Manager does not need to be loaded empty (and must not be loaded without consent)
- For many popular tools there are privacy-friendly alternatives. If you absolutely want to use an interactive map on your website, use my privacy-compliant map
- Do not use a consent tool unless services that require consent cannot sensibly be avoided
- If you absolutely want to use a consent tool, check it with my checklist
- Run a website check
Key takeaways of this article
Websites with consent tools often have significant legal defects.
Many common consent tools themselves require consent.
Many tools are superfluous and should be removed.
Use privacy-friendly alternatives to Google tools.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
