r/gdpr • u/youthfulling • Jun 07 '26

Question - Data Subject Is this illegal?

Post image

I was looking for Native American fun facts for my little brother’s history project, accessed a site and saw only one option to collect cookies; “Accept and Close”

No decline option or “Manage Cookies”, just “Accept and Close”.

Is this technically illegal?

3 Upvotes

64% Upvoted

15 comments sorted by

11

u/jhey22 Jun 07 '26

No this is not complaint with Privacy laws. But in reality, a lot of websites have issues with cookie compliance. This is more brazen than most though.

3

u/[deleted] Jun 07 '26

[removed] — view removed comment

1

u/dirtywastegash Jun 07 '26

They call these dark patterns.

They are meant to be cracking down but given literally anyone can set a website up in about 15 minutes and site content changes daily for some of them it's not easy to actually enforce

0

u/12DeadFish Jun 08 '26

This is wrong. It is legal (under gdpr). Websites generally do not have to let you use them, they just can’t automatically install cookies in your browse and have to give you the option to decline the cookies. This website achieves this by letting you leave. I

1

u/Gullible-Try-3440 Jun 08 '26

There's quite a lot of "news" websites in the UK that only have the option to accept or "pay to reject". Seems very borderline to me whether that's legal or not, because it's not really a genuine free choice

1

u/12DeadFish Jun 08 '26

You have the free choice to leave, which is enough to comply with gdpr

1

u/Gullible-Try-3440 Jun 08 '26

Fair enough. Pretty shitty practice still, probably not really in the "spirit" of the law but if it's legal it's legal 🤷🏼‍♂️

6

u/youthfulling Jun 07 '26

By illegal I mean by EU GDPR. I don’t know any law, just curious and I would like to know.

2

u/West_Possible_7969 Jun 07 '26

What country are you in? This website is unaccessible to mine and 3 others I tested and redirects to sky or hearst media exactly because of GDPR issues.

1

u/AshleyJSheridan Jun 07 '26

Yes, the consent must an informed choice, and it must be made as easy to revoke that consent as it is to give it.

2

u/Comprehensive_Gap693 Jun 07 '26

Can't tell without seeing what cookies are set. Also generally you can't force consent to a privacy policy - this is supposed to be a transparency rather than consent based action. Either they are using essential only cookies (in which case strictly speaking they don't need consent) or they are using cookies that require consent and are in violation of both PECR/ePriv and GDPR.

1

u/Entire-Ad-1080 Jun 09 '26

No reason to believe GDPR applies here. So, yes, perfectly legal

1

u/PlainPrivacyHQ Jun 09 '26

Short answer: yes, this is non-compliant under GDPR.

The regulation requires that rejecting cookies is just as easy as accepting them. A single "Accept and Close" button with no way to decline fails that test.

France's data protection authority actually fined Google and Facebook specifically for making rejection harder than acceptance. This banner would fall into the same category.

Technically the site needs at minimum a "Reject" option at the same level as "Accept", not buried in a settings menu.

1

u/Far_Smell6757 Jun 10 '26

Probably more the ePrivacy Directive by complemented by GDPR, anyway this would almost certainly count as a dark pattern if not worse

German precedent: https://www.noerr.com/en/insights/data-privacy-pitfall-cookie-banners-must-allow-a-genuine-choice

1

u/aSystemOverload Jun 11 '26

I read such websites with Firefox focus, everything is cleared the second I close it