Support expanded user actions (optional) as user consent #144
Description
The CMP working group is aligned that the CMP should provide optional configurations that allow the implementer of the CMP to decide on which set of user actions may be considered confirmation of consent:
Each action should be considered a unique configuration:
Clicking on ‘Accept All’ (primary screen)
Clicking on ‘Ok, continue to site’ (secondary/tertiary screens)
Clicking outside of the CMP UX
Closing the CMP UX
Navigating elsewhere within the same site
Note:
If a user undertakes any of these actions on the primary screen, they will be giving their full consent to all vendors/purposes.
If a user undertakes any of these actions on the secondary/tertiary screens they will confirming their existing preferences.
There is a separate conversation around whether the CMP should persist a user’s historic consent preferences on the primary screen that is not being addressed right now.
At this stage the following two user actions will not be included in these configuration options. These may be considered later depending on feedback:
Scrolling - (borderline legally allowed as user could be searching for CMP)
Time without interacting whilst actively interacting with the CMP UX ( should be picked up by above)
Default Configurations
The default configurations for the above actions are as follows:
Clicking on ‘Accept All’ providing the user has not customised the purposes/vendors they consent to - ON
Clicking on ‘Ok, continue to site’ providing the user has not customised the purposes/vendors they consent to - ON
Clicking outside of the CMP UX - OFF
Closing the CMP UX - OFF
Navigating elsewhere within the same site - OFF
It will be up to the publisher to take responsibility to decide if they want to take a relaxed or conservative approach to which user actions should be considered consent.
The CMP will take responsibility for detecting these actions as opposed to relying on a signal from the publisher which could be open to abuse and non-compliance.
If a publisher has opted to get global consent for their vendor’s, consent gained by actions 3-5 will set consent as a first party cookie so as not to diminish the integrity of the global cookie. This approach may be re-assessed at a later date.
Open Questions:
Should additional disclosure language be added if the publisher has configured actions 3-5 as ‘ono’ to describe the behaviour of the CMP to the user?