The decision criticised information scattered across several documents and consent that was neither specific nor clearly informed. Check your own forms: one purpose per box, nothing ticked in advance, and plain words about what happens next.

What the French regulator decided

On Monday, France's data protection authority, the CNIL, fined Google 50 million euros under the GDPR, the European privacy regulation in force since last May.

The decision concerned how people setting up an account on an Android phone were told about the use of their data for personalised advertising, and how their consent to it was gathered.

It made two main findings. The information was spread across several documents, several clicks apart, and the consent obtained was neither specific nor clearly informed.

It is the largest fine under the regulation so far, and its reasoning is simple enough for any business to hold up against its own sign-up forms.

Why a Canadian business should read it

The GDPR is European law, but it reaches beyond Europe. It can apply to a business anywhere that offers goods or services to people in the European Union, or tracks their behaviour online.

A hotel taking bookings from Germany, or an online shop shipping to France, may well be covered. Whether yours is depends on what you do, and is a question for your lawyer.

Even where it does not apply, the decision is a clear signal. Canada's Privacy Commissioner has its own guidelines on meaningful consent, applied from the start of this year, and they point the same way.

What the decision objected to

The third is the one most small business forms share. A single box agreeing to the terms, the privacy policy and the newsletter is three agreements dressed up as one.

Bundled boxes on small business sites

Bundling turns up in ordinary places: a checkout where placing the order also signs the customer up for marketing, or a booking form whose one required box covers the terms and the newsletter together.

Consent given that way is hard to call a free choice, because the only way to refuse the newsletter is to refuse the booking.

The fix is cheap. One box per purpose, each unticked, each saying what it is for, and the booking goes through whether or not the newsletter box is ticked.

Vague purposes

Vagueness was another objection, and small business forms are full of it.

Phrases such as "to improve your experience", "for marketing purposes" or "with selected partners" tell a reader nothing they can act on.

Specific wording is shorter and clearer: a monthly email about new dates and occasional offers, unsubscribe at any time. A reader knows exactly what the box does.

If the purpose cannot be written plainly, that is worth noticing. It usually means nobody has decided what the information is for.

Cookie notices

Many sites show a banner saying that by continuing to browse, the visitor accepts cookies. European regulators have said that simply carrying on using a site is not a clear signal of consent.

Cookies a site needs to work, such as the one that keeps a shopping cart, are treated differently from those used for analytics and advertising.

Advertising cookies, the kind set by a Facebook pixel or a Google remarketing tag, are the same kind of personalised advertising this decision concerned. A notice that leaves them out, or assumes agreement, is the weak point.

A worked example

A kayak tour company on the coast takes many of its summer bookings from European visitors, through a form on its website.

The form ended with one required box: "I agree to the terms and conditions, the privacy policy and to receive news and offers." Nobody could book without ticking it, so every guest joined the newsletter.

The site also ran a Facebook pixel, added two summers ago for a campaign nobody repeated, and a banner announcing that continued browsing meant accepting cookies.

The owner noticed when a guest from Germany replied to a newsletter asking, politely, when he had agreed to receive it. The honest answer was that he had not, in any meaningful sense.

The form now has two boxes: a required one for the booking terms, and an unticked, optional one for the newsletter, worded in a single plain sentence.

The pixel was removed, since nobody was using it, and the banner now describes what the site actually sets.

Say it where it is asked

The other half of the decision was about where information lives. Spread across several documents, it might as well not exist.

The practical answer is layers: one plain sentence beside the box saying what the information is for, with a link to the full privacy policy for anyone who wants the detail.

The sentence does the work. Most people never open the policy, and the point of the decision was that they should not have to dig to understand the basic deal.

Keeping the evidence

Under the GDPR, a business has to be able to demonstrate that a person agreed, and CASL puts the same burden on the sender of a commercial email.

Keep a dated copy of each form's wording every time it changes, and check that the mailing service records when and how each person joined. When somebody asks when they agreed, the answer then takes a minute.

The counter-case

Not every business needs to change much.

A business with no European customers, no advertising pixels and a newsletter joined through a clear, unticked box is already close to what the decision expects.

And whether the GDPR applies to your business at all deserves a proper answer from a lawyer, not a guess from a news story.

But the wording checks cost little and help under any law: one purpose per box, nothing ticked in advance, and plain words beside each.

Checking your own forms

  1. List every form that collects an email address.
  2. Read each checkbox aloud.
  3. Split any box covering more than one thing.
  4. Untick anything ticked by default.
  5. Replace vague purposes with specific ones.
  6. Check what the cookie notice claims.
  7. Keep a dated copy of every wording.

Step three does the most good. A box that bundles the newsletter with the terms makes marketing a condition of doing business, which is the clearest problem in the decision and the easiest to fix.

Keeping a record of who agreed to what is covered in a mailing list nobody has cleaned since 2014.

Frequently asked questions

Why was Google fined under the GDPR?

France's regulator found that information about personalised advertising was spread across several documents, and that the consent gathered for it was neither specific nor clearly informed.

Does the GDPR apply to Canadian businesses?

It can, when a business offers goods or services to people in the European Union or tracks their behaviour. Whether it covers yours is a question for your lawyer.

What is bundled consent?

One box agreeing to several things at once, such as the terms, the privacy policy and a newsletter. It makes marketing a condition of buying, which is hard to call a free choice.

Are pre-ticked boxes acceptable for consent?

No. Consent has to be an active choice, so every marketing box should start unticked. A box already ticked records the business's preference, not the customer's.

Does continuing to browse count as consent?

European regulators have said it does not. Simply carrying on using a site is not a clear signal, particularly for advertising cookies such as pixels and remarketing tags.

How should consent be recorded?

Keep a dated copy of every form's wording whenever it changes, and make sure your mailing service records when and how each person joined.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Selling to customers in Europe?

Send us your sign-up and checkout forms. We will mark every box that bundles, pre-ticks or says too little.

Start a Conversation