Page 65 - CBM18

~ Spotlight On ~

in the terminal equipment of a user (so-called cookie walls)”.
Abandoned cart emailing is a type of direct marketing – a
The problem with cookie walls is that, in essence, acceptance of potentially invasive one. So, if carried out too light-heartedly, it
cookies becomes a condition to enjoy a service, and this is not may fall short of complying with data protection laws, especially
acceptable under the GDPR. The guidelines of the European the European GDPR and the UK Data Protection Act.
Data Protection Board are not legally binding but are taken
into serious consideration by the national privacy supervising Unless the customer has clearly consented to receive an
authorities. It is a form of so-called “soft law”. abandoned cart email, which is usually quite unlikely, the only
legal ground on which abandoned cart emailing seems to be
A more acceptable consent flow mechanism is a cookie banner consistent with the GDPR is a legitimate interest.
(or cookie pop-up), enabling users to accept all advertising
cookies, reject all advertising cookies or select which cookies to Legitimate interest is the most flexible of the six lawful grounds
accept (“cherry-picking”). Whatever consent flow mechanism for data processing. It can be the most appropriate basis when:
a platform adopts, this must allow users to express an • The processing is not required by law but is of a clear
unambiguous indication of wishes. benefit to you or others; and
• There’s a limited privacy impact on the concerned
The European Data Protection Board, again, has specified individual; and
further on the matter: scrolling through a website to make • The individual should reasonably expect you to use their
a cookie banner disappear does not represent a clear and data in that way; and
affirmative action indicating consent to the use of advertising • You cannot, or do not want to, give the individual full
cookies. Moreover, this type of consent flow does not make it upfront control (i.e., consent) or bother them with
easy to withdraw consent to cookies. disruptive consent requests when they are unlikely to object
to the processing.
How often should we get consent? It depends. You need
to ask for consent at the first visit and, for sure, if you have To ascertain whether you can send abandoned cart emails
implemented new cookies, for which consent was not given in based on legitimate interest, you should carry out two tests:
the first place. Many “off-the-shelf” consent mechanisms that the necessity and balancing test. First, you must demonstrate
use preference cookies may default to a certain expiration period, the necessity of the processing. The burden is also on you to
such as 90 days or so. You need to verify whether this timeframe demonstrate that your interests are balanced with those of the
is appropriate for your website or platform. concerned individual.

A quite controversial consent mechanism is based on the so- So, by applying the principles of legitimate interest to abandoned
called “cookie-or-pay-walls”. This is when users are given the cart emailing, we should draw some conclusions:
opportunity to refuse cookies, but only if they pay a fee to visit • It is better if the privacy policy refers to the possibility for
the site. Our friends at the European Data Protection Board the user to receive abandoned cart emails; and
have stated that there is no valid consent when the data subject • The user must be entitled to easily opt-out from abandoned
has no real choice, feels compelled to consent or will endure cart emailing; and
negative consequences if they do not consent. This interpretation • Abandoned cart emailing seems more appropriate for
of the GDPR leads us to believe that cookie-or-pay-walls are not returning customers than mere prospects; and
fully consistent with existing EU privacy law. • This type of direct marketing should not be used unless
the customer has inserted their email in the checkout
More broadly speaking, the best consent mechanism is the one process (so any other way to obtain the email address of the
that enables users to expressly accept all advertising cookies, customer should be deemed as not regular); and
reject all advertising cookies or select which cookies to accept in • Browse abandonment tools are not consistent with the
a free and unambiguous way. GDPR, as in this case, the user has not entered a sales
negotiation where you obtained their email.
Another hot topic related to user consent is “abandoned cart
emailing”. Some merchants use abandoned cart emailing These recommendations will help you to implement direct
strategies to optimise sales. This happens when a customer starts marketing strategies that are compliant with the strict
the purchase process by adding products to the cart but then fails requirements of EU privacy law. However, an evaluation of
to complete checkout; then, the merchant sends an unsolicited whether your direct marketing strategies are consistent with the
reminder of the pending sale to the customer (or, perhaps, we applicable law should be carried out on a case-by-case basis and
should say “prospect” at this stage). with the help of professional legal advice. ••

Alan Rhode is a co-founder at Taxmen, the one-stop-shop for legal and tax services to the e-commerce industry.

65