Consent Management Platforms Under the GDPR: Processors and/or Controllers?

TY - GEN

T1 - Consent Management Platforms Under the GDPR

T2 - 9th Annual Privacy Forum, APF 2021

AU - Santos, Cristiana

AU - Nouwens, Midas

AU - Toth, Michael

AU - Bielova, Nataliia

AU - Roca, Vincent

N1 - Funding Information: Acknowledgements. We would like to thank Daniel Woods, Triin Siil, Johnny Ryan and anonymous reviewers of ConPro’21 and APF’21 for useful comments and feedback that has lead to this paper. This work has been partially supported by the ANR JCJC project PrivaWeb (ANR-18-CE39-0008) and by the Inria DATA4US Exploratory Action project. Publisher Copyright: © 2021, Springer Nature Switzerland AG.

PY - 2021

Y1 - 2021

N2 - Consent Management Providers (CMPs) provide consent pop-ups that are embedded in ever more websites over time to enable streamlined compliance with the legal requirements for consent mandated by the ePrivacy Directive and the General Data Protection Regulation (GDPR). They implement the standard for consent collection from the Transparency and Consent Framework (TCF) (current version v2.0) proposed by the European branch of the Interactive Advertising Bureau (IAB Europe). Although the IAB’s TCF specifications characterize CMPs as data processors, CMPs factual activities often qualifies them as data controllers instead. Discerning their clear role is crucial since compliance obligations and CMPs liability depend on their accurate characterization. We perform empirical experiments with two major CMP providers in the EU: Quantcast and OneTrust and paired with a legal analysis. We conclude that CMPs process personal data, and we identify multiple scenarios wherein CMPs are controllers.

AB - Consent Management Providers (CMPs) provide consent pop-ups that are embedded in ever more websites over time to enable streamlined compliance with the legal requirements for consent mandated by the ePrivacy Directive and the General Data Protection Regulation (GDPR). They implement the standard for consent collection from the Transparency and Consent Framework (TCF) (current version v2.0) proposed by the European branch of the Interactive Advertising Bureau (IAB Europe). Although the IAB’s TCF specifications characterize CMPs as data processors, CMPs factual activities often qualifies them as data controllers instead. Discerning their clear role is crucial since compliance obligations and CMPs liability depend on their accurate characterization. We perform empirical experiments with two major CMP providers in the EU: Quantcast and OneTrust and paired with a legal analysis. We conclude that CMPs process personal data, and we identify multiple scenarios wherein CMPs are controllers.

KW - Consent

KW - Consent management providers

KW - Data controllers

KW - GDPR

KW - IAB Europe TCF

UR - http://www.scopus.com/inward/record.url?scp=85111015053&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-76663-4_3

DO - 10.1007/978-3-030-76663-4_3

M3 - Article in proceedings

AN - SCOPUS:85111015053

SN - 9783030766627

T3 - Lecture Notes in Computer Science

SP - 47

EP - 69

BT - Privacy Technologies and Policy - 9th Annual Privacy Forum, APF 2021, Proceedings

A2 - Gruschka, Nils

A2 - Antunes, Luís Filipe

A2 - Rannenberg, Kai

A2 - Drogkaris, Prokopios

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 17 June 2021 through 18 June 2021

ER -