The German government has proposed a new Consent Management Ordinance (“Einwilligungsverwaltungsverordnung”, “EinwV”) to establish a framework for authorized consent management services that allow users to share their preferences across different websites. In this article we will take a look on what the ordinance is and how it may affect websites.
The new Consent Management Ordinance in short
The new ordinance lays out some general ideas:
- Users should be able to permanently store and manage their consent decisions with an authorized consent management service
- The tool should allow users to declare their consent (or no consent) once and communicate this decision to all digital service providers
- The aim is to prevent users from being misled by consent banners that use dark patterns or misleading designs
Flaws of the consent management ordinance
While the ideas behind the ordinance are good, the implementation has some important flaws:
1. No Central Consent Management tools available
At the moment there are no central consent management tools available and it is unclear if there ever will be such tools. It is unlikely that end-users will want to pay for such a tool and there is no real incentive for any company to develop such a tool.
2. No incentive for publishers to support it
The ordinance specifically leaves it optional to websites to support such tools – or to ignore it. This means that end-users that have a tool, will not automatically be able to use it on all websites and thus making it less attractive to end-users. At the same time it is unlikely that publisher will want to support it at all: It is likely that only users that want to reject data processing will install such tools. If a publisher would support the use of such tools, they will most likely lose acceptance rate, marketing data or advertising revenues. Hence it is likely that websites will not support such tools.
3. No industry standards to support it
There are a handfull of standards that may be used but none solves all the issues. Some standards such as the IAB TCF specifically forbids a general consent mechanism across website. Other standards aim at flexibility and therefore lack a centralized approach. With the lack of support through publishers (see above) it is unlikely that a general standard can be developed.
4. Legal concerns
A general consent mechanism requires that the consent for the purpose, the processed data and all other factors is unified. The reality is that many websites have very different vendorlists, process data for very different purposes and use very different sets of data on this processing. It is unlikely that a central approach is able to cover all these different scenarios.
5. “Made in Germany”
The ordinance is only applicable in Germany and for german companies. In reality most websites have (at least a small amount of) international traffic from other countries. Even if central tools are supported – users outside of germany may not be able or even allowed to use the same aproach.
What shall websites do now?
Nothing. As outlined above, there is no requirement for websites to support any of this. The lack of standards and tools also means that there is currently nothing that can be done.
Are websites required to support this?
No. It is optional for websites to support this. If websites want to start existing standards such as GPC or DNT, they can do this via the CMP settings but there is no legal requirement for this.
Is this the end of cookie banners?
No. A website will still needs a cookie banner due to various reasons:
- Not all end-users will use a central tool – websites will still need to have a cookie banner to allow consent for users that dont have a tool.
- The ordinance only affects Germany – international websites or websites with international traffic will still need a cookie banner.
- There is no incentive for websites to support it. As outlined above, support will most likely have a negative impact on a websites’ revenues and therefore most websites will not support it.
- Even if all users would use a central consent management tool, the website will still need to use the cookie banner to enable/disable blocking of vendors and cookies.
We are keeping an eye on developments
At consentmanager, we’re actively monitoring the development of this new regulation. When clear, industry-wide standards emerge, we’ll be ready to integrate them into our platform.
In the meantime, CMPs remain essential for managing user consent in an effective and compliant manner. We will continue to provide our customers with the tools they need to meet privacy standards and remain compliant.
You can find the official publication of the Regulation in German here: https://bmdv.bund.de/SharedDocs/DE/Anlage/Gesetze/Gesetze-20/entwurf-einwilligungsverwaltungsverordnung.pdf
