GDPR Privacy FAQs: Can organizations rely on browser settings to gain consent to the deployment of cookies?

Likely not.

While the UK’s Privacy and Electronic Communications Regulation suggests that, in some circumstances, consent may be inferred when a subscriber amends or sets controls in an internet browser, the ICO has clarified that “[f]or consent to be clearly signified, it would need to be clear that users and subscribers had been prompted to consider their current browser settings.”¹ This, in turn, would require some type of evidence that the subscriber made a change or was happy with the default.² But since not everyone is familiar with these settings, other apps that adjust settings, and user access websites through various devices (such as smart tvs), the net result is that the ICO has effectively disavowed browser settings as a basis for consent. In its most recent guidance, the ICO states “[i]n future you may well be able to rely on the user’s browser settings as part, or all, of the mechanism for satisfying yourself that you have consent to set cookies. For now, relying solely on browser settings will not be sufficient. Even when browser options are improved it is likely not all users will have the most up-to-date browser with the enhanced privacy settings needed for the settings to constitute an indication of consent.”³