<p><span class="fw-semibold" style="color: #808080; font-size: 18pt;">In a groundbreaking update, the European Data Protection Board (EDPB) adopted <span style="color: #1ab394;"><a href="https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf" style="color: #1ab394;">new guidelines</a></span> on October 7, 2024, clarifying and tightening the requirements around cookie consent and data tracking.</span></p>
<p>This regulatory change makes one thing clear: reliance on third-party cookie consent solutions is no longer just risky – it's a direct compliance issue. Yet, companies still invest in these outdated solutions.</p>
<p>Here’s why this is happening, the risks involved, and the alternatives available.</p>
<h2>Privacy Standards at a Turning Point</h2>
<p>Following a comprehensive public review, the new October 2024 guidelines emphasize the need for unambiguous, explicit, and specific user consent before any data is stored or accessed on a user's device. These changes reflect the European Union's strengthened stance on upholding privacy standards and reducing dependencies on tracking technologies that often sidestep user consent. Under these rules, pre-ticked consent boxes, implied consent, and even certain types of "necessary" tracking common in many third-party solutions are deemed insufficient.</p>
<h2>Why Companies Persist with Non-Compliant Solutions</h2>
<p>The widespread reliance on third-party consent solutions stems from inertia and misinformation. Many companies assume that any consent banner suffices for compliance, unaware of the deeper regulatory requirements demanding clear and specific consent mechanisms. Additionally, some believe that popular third-party vendors guarantee compliance when, in fact, recent audits reveal that many such tools fail to align with the latest legal standards.</p>
<h2>The High Cost of Non-Compliance</h2>
<p>Failing to adhere to these new guidelines exposes companies to severe financial and reputational risks. GDPR and ePrivacy Directive fines can reach up to €20 million or 4% of global turnover, whichever is higher. As regulators increase their scrutiny of third-party tracking practices, the likelihood of enforcement actions grows. Non-compliant organizations may face these penalties along with a significant loss of consumer trust.</p>
<h2>The Persistence of Non-Compliant Solutions</h2>
<p>The regulatory framework has often lagged behind technological developments, allowing ambiguities to persist. Consequently, third-party providers continue to operate despite failing to comply with the specifics of GDPR and the new ePrivacy standards. The lack of immediate, consistent enforcement has allowed these solutions to thrive, creating a false sense of security for companies that use them.</p>
<h2>Moving to First-Party, Privacy-Focused Tools&nbsp;</h2>
<p>As scrutiny of third-party tracking increases, businesses are better served by first-party consent and analytics tools. A first-party approach improves data accuracy, supports compliance with privacy laws, and establishes greater trust. Privacy-focused solutions like AesirX’s Privacy-First Foundation – which includes consent management and analytics – align with current privacy guidelines and offer a solid alternative to third-party cookies.</p>
<h2>What Can Businesses Do Now?</h2>
<p>To stay privacy-compliant, companies can take a few simple steps, such as:</p>
<ul>
<li aria-level="1">Audit Current Practices: Evaluate their existing tracking and consent mechanisms to identify third-party dependencies.</li>
<li aria-level="1">Adopt First-Party Solutions: Implement tools that allow for direct and transparent user relationships.</li>
<li aria-level="1">Commit to User Privacy: Show a genuine commitment to privacy, now a cornerstone of brand loyalty and digital trust.</li>
</ul>
<p>In our privacy-conscious online world, relying on outdated third-party tools is not sustainable. Instead, businesses should invest in first-party, privacy-compliant solutions that build trust and meet the latest regulatory standards.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab391;"><a href="https://twitter.com/VikingTechGuy" style="color: #1ab391;">VikingTechGuy</a></span>&nbsp;</p>
<p>Creator, AesirX.io</p>
<p style="text-align: center;"><strong>AesirX Privacy Scanner for WordPress:</strong> <br />Check if your WordPress or Joomla site complies with the ePrivacy Directive and GDPR by<br /> using <span style="color: #1ab391;"><a href="https://privacyscanner.aesirx.io/" style="color: #1ab391;">AesirX Privacy Scanner</a></span>, which detects non-compliant elements like cookies and trackers.</p>

Why Are Companies Still Paying for Non-Compliant Cookie Consent Solutions?

Blog Aesirx

Companies are still paying for non-compliant cookie consent solutions, despite the latest EDPB guidelines. Learn why and explore compliant alternatives.

 Why Are Companies Still Paying for Non-Compliant Consent?

<p><span class="fw-semibold" style="color: #808080; font-size: 18pt;">The European Data Protection Board (EDPB) has officially adopted the updated Guidelines 02/2024 on the technical scope of Article 5(3) of the ePrivacy Directive on October 7, 2024.</span></p>
<p>These new guidelines follow the initial draft, Guidelines 02/2023, which was released for public consultation on November 14, 2023. After receiving valuable feedback during the consultation process, the final guidelines are now sharper, clearer, and more comprehensive, addressing new technologies and providing more precise interpretations of data tracking and consent.</p>
<p>These guidelines have always been binding for national Data Protection Authorities (DPAs), guiding them on the enforcement of Article 5(3), which regulates how consent is obtained when accessing information stored on users' devices. However, after the public hearing, the guidelines are not only better but also more technically aligned with the latest developments in tracking technologies, making them highly practical for businesses adapting to today's fast-changing digital world.</p>
<p>In this article, I will break down the key updates from the Guidelines 02/2024, compare them with the previous version, and explain how they sharpen the application of Article 5(3). This is critical for businesses and digital platforms that handle data through cookies, device fingerprinting, and various tracking technologies.</p>
<h2>Key Updates in the 2024 Guidelines</h2>
<p>After the public consultation, the 02/2024 Guidelines include several refinements to better address modern tracking technologies and enable robust compliance with the ePrivacy Directive.</p>
<h3>1. Broader Scope of "Information" Definition</h3>
<p>One of the most important refinements is the expanded definition of "information". While the 2023 version already made it clear that Article 5(3) covers more than just personal data, the 2024 guidelines go further by confirming that non-personal data (e.g., MAC addresses, IP addresses) also requires user consent. This reinforces the idea that any stored information on a user's device, even if not tied to identifiable personal data, falls under the ePrivacy Directive's protection.</p>
<p>For example, this means that hidden identifiers or device-generated data, such as network interface identifiers or device sensors, must now explicitly require consent before being accessed.</p>
<h3>2. Enhanced Clarity on "Gaining Access" and "Storage"</h3>
<p>The final guidelines provide more technical depth in defining the terms "gaining access" and "storage". Both actions — storing information on a device and gaining access to it — must meet the requirements of Article 5(3), even if carried out by different entities. This update clears up any ambiguity by emphasizing that both actions trigger the need for consent, and they can happen independently.</p>
<p>Additionally, whether information is locally processed on the device or stored by the user or third party, if accessed by another entity, it constitutes "gaining access," thus requiring prior consent.</p>
<h3>3. Revised Analysis of Technical Use Cases</h3>
<p>The final guidelines maintain the use cases introduced in the 2023 version but expand the technical depth for each, providing clearer examples of how Article 5(3) applies in specific scenarios.</p>
<ul>
<li><strong>Pixel and URL Tracking:</strong> The 02/2024 guidelines give more detailed treatment to tracking pixels and URL tracking, confirming that both require explicit consent. This is critical for businesses using email marketing or website analytics tools, where tracking pixels are used to monitor user interactions.</li>
<li><strong>IP-based Tracking:</strong> The guidelines now clearly state that even tracking technologies based solely on IP addresses are subject to Article 5(3). This is particularly important for businesses using geolocation services or IP-based marketing, as they must ensure compliance when tracking users' IPs.</li>
<li><strong>Intermittent IoT Reporting:</strong> A key refinement in the 02/2024 guidelines is the expanded treatment of IoT (Internet of Things) devices. These guidelines clarify that when data from IoT devices is stored locally and later transmitted to a server, consent is required under Article 5(3). This was not as clearly outlined in the previous version, making it crucial for industries that rely on connected devices.</li>
</ul>
<h3>4. Strengthened Guidelines for Local Data Processing</h3>
<p>The 02/2024 guidelines clarify that local processing on devices (such as browsers or smartphones) falls within the scope of Article 5(3) when the processed data is later accessed by a third party via client-side APIs. This means that businesses using local data processing technologies, like JavaScript-based processing, must obtain consent before accessing any locally processed information.</p>
<h2>What the Updated Guidelines Mean for Businesses</h2>
<p>The updated Guidelines 02/2024 mark a significant improvement in both the clarity and application of Article 5(3) of the ePrivacy Directive. For businesses, this means two things:</p>
<ol>
<li><strong>Greater responsibility in how tracking technologies are implemented:</strong> From IP tracking to IoT devices and pixel-based tracking, all mechanisms that store or access information on user devices must now follow even stricter consent requirements.</li>
<li><strong>Compliance requires ongoing vigilance:</strong> As new tracking technologies emerge, businesses need to continuously assess their compliance with Article 5(3). The guidelines now provide a strong foundation, but the digital landscape is always evolving, and staying compliant requires forward planning and flexibility.</li>
</ol>
<p>The 02/2024 guidelines are not just an incremental update; they represent a significant shift towards greater accountability for businesses involved in data processing and tracking technologies.</p>
<p>The Guidelines 02/2024 reflect the increasing complexity of the digital ecosystem, addressing new forms of tracking and clarifying what constitutes "gaining access" to information. For businesses, this means a clearer framework for compliance with Article 5(3) of the ePrivacy Directive, but also a reminder that compliance is not optional — it is a requirement that demands constant attention.</p>
<p>Moving forward, companies that proactively align with these updated guidelines will not only avoid regulatory scrutiny but also build trust and transparency with their users, gaining a competitive advantage in an increasingly privacy-conscious market.</p>
<h2>Conclusion</h2>
<p>The adoption of the Guidelines 02/2024 sets a new bar for data protection and privacy compliance across Europe. While compliance is a legal necessity, it also represents an opportunity for businesses to build stronger, more transparent relationships with their users. The updated guidelines provide clear rules for handling tracking technologies and data access, so that businesses can operate effectively while respecting user privacy.</p>
<p>For anyone managing data, from marketers to compliance officers, understanding and implementing these guidelines will be crucial to managing data privacy in the years ahead.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab394;"><a href="https://twitter.com/VikingTechGuy" target="_blank" rel="noopener" style="color: #1ab394;">VikingTechGuy</a></span></p>
<p>Creator, <span style="color: #1ab394;"><a href="http://aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">AesirX.io</a></span></p>
<p><em><strong>AesirX Privacy Scanner for WordPress:</strong> Check your WordPress site complies with the ePrivacy Directive and GDPR by using <span style="color: #1ab394;"><a href="https://privacyscanner.aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">AesirX Privacy Scanner</a></span>, which detects non-compliant elements like cookies and trackers.</em></p>

New EDPB Guidelines on ePrivacy Directive: Sharper, Clearer, and More Comprehensive After Public Consultation

Blog Gothard

New EDPB Guidelines on ePrivacy Directive

<p><span class="fw-semibold" style="color: #808080; font-size: 18pt;">As a website owner, you might process user data to prevent fraud or improve user experience without needing consent – this is considered “legitimate interest.”</span></p>
<p>In October 2024, the European Data Protection Board (EDPB) released <span style="color: #1ab394;"><a href="https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en" style="color: #1ab394;">Guidelines 1/2024 on processing personal data based on Article 6(1)(f) GDPR</a></span>, known as the legitimate interest basis. These guidelines emphasize the need to carefully assess and document when legitimate interest can be used for personal data processing.</p>
<p>For website owners, this directly affects consent management, analytics, and tools like Meta Pixel, which track user behavior. While GDPR permits processing based on legitimate interest, the ePrivacy Directive imposes stricter rules when accessing users' devices (e.g., cookies).</p>
<h2>Three Conditions for Legitimate Interest;</h2>
<p>Website owners must meet three conditions to rely on legitimate interest:</p>
<ol>
<li aria-level="1"><strong>Pursuit of a legitimate interest:</strong> The interest must be lawful, specific, and articulated (e.g., improving security).</li>
<li aria-level="1"><strong>Necessity of processing:</strong> Processing must be necessary to achieve the legitimate interest.</li>
<li aria-level="1"><strong>Balancing test:</strong> Fundamental rights and freedoms of the data subject must not override the interest pursued.</li>
</ol>
<h2>What Legitimate Interest Can Be Used For</h2>
<p>Legitimate interest is a flexible legal basis that can be used for a variety of processing activities, provided that the conditions are met and the rights of data subjects are respected. Some common scenarios where legitimate interest may be applicable include:</p>
<ol>
<li aria-level="1"><strong>Fraud Prevention and Security:</strong> Website owners may process personal data to detect and prevent fraud or ensure the security of their services. For instance, monitoring login attempts to identify suspicious activity can be a legitimate interest.</li>
<li aria-level="1"><strong>Direct Marketing:</strong> Processing personal data for direct marketing purposes, such as sending promotional emails to customers, can be considered a legitimate interest. However, users must be provided with an easy way to opt out of such communications.</li>
<li aria-level="1"><strong>Customer Relationship Management (CRM):</strong> Maintaining customer records for customer service purposes, such as tracking interactions or providing support, can be done under legitimate interest, provided it does not override the individual's privacy rights.</li>
<li aria-level="1"><strong>Employee Monitoring:</strong> Monitoring employee performance or ensuring compliance with workplace policies can be a legitimate interest, provided it is proportionate and employees are informed.</li>
<li aria-level="1"><strong>Business Improvement and Analytics:</strong> Processing data to improve products, services, or user experience, such as analyzing user feedback or website performance, can fall under legitimate interest, as long as it meets the balancing test.</li>
</ol>
<h2>ePrivacy Directive and Consent Requirement</h2>
<p>Under <span style="color: #1ab394;"><a href="https://www.edpb.europa.eu/system/files/2023-11/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_en.pdf" style="color: #1ab394;">Article 5(3) of the ePrivacy Directive</a></span>, accessing or storing information on users' devices (e.g., cookies) requires explicit consent, unless it is strictly necessary for a requested service (e.g., saving cart items).</p>
<h2>Practical Examples for Website Owners</h2>
<h3>1. Consent Management and Analytics</h3>
<ul>
<li aria-level="1"><strong>Google Analytics:</strong> Even if improving services via analytics serves your legitimate interest, Article 5(3) of the ePrivacy Directive requires explicit consent before placing cookies. A consent banner is mandatory for compliance.</li>
<li aria-level="1"><strong>Detailed Scenario</strong>: Suppose a website uses Google Analytics to understand user behavior and improve content. While the site owner may argue that this analysis is in their legitimate interest to enhance user experience, the ePrivacy Directive mandates obtaining explicit consent before placing tracking cookies on users' devices.</li>
<li aria-level="1"><strong>Takeaway:</strong> Legitimate interest for analytics does not exempt you from consent requirements under the ePrivacy Directive.</li>
</ul>
<h3>2. Meta Pixel and Targeted Advertising</h3>
<ul>
<li><strong>Meta Pixel:</strong> Tracking users across websites for targeted ads cannot solely rely on legitimate interest. Explicit consent is required since third-party cookies are used for cross-site tracking.</li>
<li aria-level="1"><strong>Detailed Scenario:</strong> A retail website installs Meta Pixel to track visitors and send them targeted ads on Facebook. The website owner may believe that targeted advertising is in their legitimate interest for better marketing efficiency. However, as cross-site tracking is involved, explicit user consent must be obtained to comply with the ePrivacy Directive.</li>
<li aria-level="1"><strong>Takeaway:</strong> Meta Pixel requires explicit user consent, even if legitimate interest could be claimed under GDPR.</li>
</ul>
<h3>3. First-Party Analytics</h3>
<ul>
<li aria-level="1"><strong>AesirX Analytics:</strong> While first-party analytics reduce privacy risks, consent is still necessary if cookies or local storage are involved.</li>
<li aria-level="1"><strong>Detailed Scenario:</strong> A website switches to AesirX Analytics to reduce dependency on third-party tracking. Despite using first-party data, explicit consent is still required if cookies are placed or data is stored locally on users' devices.</li>
<li aria-level="1"><strong>Takeaway:</strong> First-party solutions offer better control but do not eliminate the need for consent.</li>
</ul>
<h3>4. Email Marketing and User Segmentation</h3>
<ul>
<li aria-level="1"><strong>Newsletter Subscription:</strong> Sending targeted email campaigns based on user activity can be seen as a legitimate interest. However, segmentation based on behavior tracked through cookies still requires explicit consent under the ePrivacy Directive.</li>
<li aria-level="1"><strong>Detailed Scenario:</strong> A business sends personalized newsletters based on users' browsing history on its website. While email marketing might serve a legitimate interest, tracking user behavior to segment the audience involves cookies that require explicit consent.</li>
<li aria-level="1"><strong>Takeaway:</strong> Consent is needed for tracking-based segmentation, even if the emails themselves serve a legitimate interest.</li>
</ul>
<h3>5. Customer Support Chatbots</h3>
<ul>
<li aria-level="1"><strong>Chatbots:</strong> Using chatbots to provide customer support may fall under legitimate interest, but storing chat interactions or analyzing user behavior for improvements involves data processing that may require explicit consent.</li>
<li aria-level="1"><strong>Detailed Scenario:</strong> A website uses a chatbot for customer inquiries and stores user interactions to improve support quality. While the use of a chatbot may be considered a legitimate interest, storing and analyzing these conversations necessitates explicit user consent to comply with data protection regulations.</li>
<li aria-level="1"><strong>Takeaway:</strong> While chatbots can be used for legitimate interests like improving customer support, consent is required for storing or analyzing conversations.</li>
</ul>
<h2>Key Considerations for Website Owners</h2>
<ul>
<li aria-level="1"><strong>Balancing Test:</strong> Evaluate user expectations and risks to privacy when relying on legitimate interest.</li>
<li aria-level="1"><strong>Transparency:</strong> Clearly inform users about the data being collected, why it's collected, and how they can object.</li>
<li aria-level="1"><strong>Documenting Legitimate Interest:</strong> Properly document why processing is necessary and the safeguards in place. Include an assessment of privacy risks in your Data Protection Impact Assessment (DPIA).</li>
</ul>
<h2>Legitimate Interest Isn't a Free Pass</h2>
<p>The EDPB’s guidelines make it clear that legitimate interest is not a blanket legal basis, particularly for accessing users’ devices. Website owners must tread carefully, understanding that compliance with both GDPR and the ePrivacy Directive is about more than just ticking boxes – it's about building user trust. Recognize when consent is mandatory, document legitimate interests meticulously, and be proactive in balancing privacy with business needs.&nbsp;</p>
<p>By prioritizing transparency, actively obtaining consent, and regularly reviewing data practices, businesses can stay ahead of regulatory scrutiny and foster genuine user loyalty in a privacy-first world.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab394;"><a href="https://twitter.com/VikingTechGuy" target="_blank" rel="noopener" style="color: #1ab394;">VikingTechGuy</a></span></p>
<p>Creator, AesirX.io</p>
<hr />
<h4>Short Summaries on Recent rulings from CJEU:</h4>
<p><span style="color: #1ab394;"><a href="https://www.linkedin.com/posts/ronnikc_language-of-document-activity-7248137955322552320-IAG-/" target="_blank" rel="noopener" style="color: #1ab394;">Case C‑621/22 (KNLTB vs. Autoriteit Persoonsgegevens)</a></span></p>
<p><span style="color: #1ab394;"><a href="https://www.linkedin.com/posts/ronnikc_language-of-document-activity-7248139684864794624-izKq/" target="_blank" rel="noopener" style="color: #1ab394;">Case C‑21/23 (ND vs. DR)</a></span></p>
<p><span style="color: #1ab394;"><a href="https://www.linkedin.com/posts/ronnikc_language-of-document-activity-7248159070665277440-MdaG/" target="_blank" rel="noopener" style="color: #1ab394;">Case C‑200/23 (OL and the Bulgarian Registration Agency)</a></span></p>
<p><span style="color: #1ab394;"><a href="https://www.linkedin.com/posts/ronnikc_language-of-document-activity-7248161372453122049-9llx/" target="_blank" rel="noopener" style="color: #1ab394;">Case C‑446/21 (Maximilian Schrems and Meta Platforms Ireland Ltd)</a></span></p>
<p style="text-align: center;"><br /><strong>AesirX Privacy Scanner for WordPress:</strong><br />Check your WordPress site complies with the ePrivacy Directive and GDPR by using<span style="color: #1ab394;"> <a href="https://privacyscanner.aesirx.io/" style="color: #1ab394;">AesirX Privacy Scanner</a></span>, which detects non-compliant elements like cookies and trackers.</p>

EDPB's 2024 Guidelines on Legitimate Interest: Key Takeaways for Website Owners

 Learn key takeaways from EDPB's 2024 guidelines on legitimate interest, and how they affect consent management, analytics, and tracking for website owners.

EDPB ‘24 Guidelines: Legitimate Interest for Web Owners

EDPB 2024 Guidelines on Legitimate Interest: Key Takeaways for Website Owners

<p><span class="fw-semibold" style="color: #808080; font-size: 18pt;">Last week, we took an<span class="white-space-pre"> </span><span style="color: #1ab391;"><a href="https://aesirx.io/blog/aesirx/press-release-aesirx-launches-consent-shield-for-wordpress-to-prevent-unauthorized-data-collection" target="_self" class="app-aware-link" style="color: #1ab391;">exciting step</a></span><span class="white-space-pre"> </span>towards making the internet a safer place for everyone. Today, I want to explore why blocking unauthorized trackers is so crucial, and how you can use the new AesirX Consent Shield to do just that – with a practical example using JetPack.</span></p>
<h2 id="ember60" class="ember-view reader-text-block__heading-3">The Problem with Third-Party Trackers on WordPress</h2>
<p id="ember61" class="ember-view reader-text-block__paragraph">WordPress, as one of the most popular website platforms, often relies on plugins that add extra functionality, like analytics, sharing buttons, and more. However, many of these plugins, including popular ones like<span class="white-space-pre"> </span><strong>JetPack</strong>, use third-party scripts, beacons, and pixel trackers that collect user data without explicit consent. These scripts can gather personal information, including location, behavior, and preferences, creating serious privacy concerns.</p>
<p id="ember62" class="ember-view reader-text-block__paragraph">JetPack, for instance, offers many useful features but also loads numerous third-party hosts that can collect data. This can expose website owners to significant compliance risks, particularly with stringent privacy laws like GDPR and the ePrivacy Directive.</p>
<h2>How AesirX Consent Shield Protects User Privacy</h2>
<p id="ember64" class="ember-view reader-text-block__paragraph"><strong>AesirX Consent Shield for WordPress</strong><span class="white-space-pre"> </span>is designed to tackle these privacy challenges head-on. It detects and blocks unauthorized trackers until visitors provide explicit consent, ensuring that privacy control is always in the hands of your users. By implementing our Consent Shield, WordPress site owners can avoid the risks of unauthorized data collection, stay compliant with regulations, and maintain trust with their audience.</p>
<h2 id="ember65" class="ember-view reader-text-block__heading-3">JetPack as an Example: Blocking Unauthorized Third-Party Scripts</h2>
<p id="ember66" class="ember-view reader-text-block__paragraph">Let's use<span class="white-space-pre"> </span><strong>JetPack</strong><span class="white-space-pre"> </span>as a practical example. JetPack includes several useful features, but it also loads scripts from third-party services that could be used for tracking. With AesirX Consent Shield, you can:</p>
<ul>
<li><strong>Automatically Detect Third-Party Plugins</strong>: Consent Shield will scan your WordPress site and identify all active plugins, including JetPack, and detect any third-party scripts they load.</li>
<li><strong>Block Unauthorized Scripts</strong>: You can configure Consent Shield to block scripts from JetPack's third-party hosts until users provide consent, ensuring that no data is collected without permission.</li>
<li><strong>Domain and Path-Based Script Blocking</strong>: Consent Shield allows you to specify which domains or paths to block, providing targeted control over what content is loaded on your site. This means you can block specific hosts loaded by JetPack that may pose privacy risks until your visitors explicitly agree.</li>
</ul>
<h2 id="ember68" class="ember-view reader-text-block__paragraph"><strong>Configuring Consent Shield to Block JetPack's Third-Party Hosts</strong></h2>
<p id="ember69" class="ember-view reader-text-block__paragraph">To help you get started, we’re including a visual of the WP configuration that shows how to add the two x third-party domains to the blocking URL function and use the automated plugin blocking feature in combination for JetPack to ensure that consent is set. This will ensure JetPack stats, which are loaded from a third-party URL, are blocked until consent has been given.</p>
<p><img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/example-of-wordpress-configuration-set-up-to-block-the-load-of-3rd-party-hosts.png" alt="example of wordpress configuration set up to block the load of 3rd party hosts" width="1063" height="1000" /></p>
<h2 id="ember71" class="ember-view reader-text-block__paragraph"><strong>The Importance of Blocking Beacons, Pixel Trackers, and JavaScript Files</strong></h2>
<p id="ember72" class="ember-view reader-text-block__paragraph">The widespread use of pixel trackers, beacons, and other third-party scripts has resulted in extensive abuse of user data, often without users’ knowledge. These scripts can track every interaction a user makes on a website, including personal information such as location, behaviors, and preferences – leading to a profound loss of user privacy. Such misuse has become a major point of concern for regulatory bodies, resulting in significant fines for companies that fail to comply with GDPR and other privacy laws.</p>
<p id="ember73" class="ember-view reader-text-block__paragraph">For example, recent penalties imposed on major companies for using trackers without proper consent have highlighted the urgency for website owners to implement robust consent mechanisms.<span class="white-space-pre"> </span><strong>AesirX Consent Shield for WordPress</strong><span class="white-space-pre"> </span>allows businesses to prevent these violations by blocking such scripts until proper user consent is obtained, offering a practical solution to one of the most pressing privacy challenges in the digital landscape today.</p>
<h2 id="ember74" class="ember-view reader-text-block__paragraph"><strong>Simple, Quick Setup</strong></h2>
<p id="ember75" class="ember-view reader-text-block__paragraph">Setting up the Consent Shield is easy – install our plugin, configure plugin detection and blocking, and customize the consent banner for your site. In just a few steps, you’re providing visitors with real privacy protections while ensuring that your business or your clients business avoids the pitfalls of non-compliance.</p>
<h2 id="ember76" class="ember-view reader-text-block__paragraph"><strong>Join Us on This Privacy Mission</strong></h2>
<p id="ember77" class="ember-view reader-text-block__paragraph">The AesirX Consent Shield is a step towards better digital trust and ethical data practices. If you're as passionate about privacy as I am, I invite you to learn more and join our mission to make privacy-first the new default.</p>
<p id="ember78" class="ember-view reader-text-block__paragraph">Check out our<span class="white-space-pre"> </span><span style="color: #1ab391;"><a href="https://aesirx.io/documentation/analytics/how-to/using-aesirx-consent-shield-for-privacy-compliance-on-wordpress" target="_self" class="app-aware-link" style="color: #1ab391;">How-To Guide on setting up AesirX Consent Shield for WordPress</a></span><span class="white-space-pre"> </span>and let’s keep the internet privacy-compliant, one WordPress site at a time!</p>
<p id="ember79" class="ember-view reader-text-block__paragraph">Ronni K. Gothard Christiansen //<span class="white-space-pre"> </span><span style="color: #1ab391;"><a href="https://twitter.com/VikingTechGuy" target="_self" class="app-aware-link" style="color: #1ab391;">VikingTechGuy</a></span><span class="white-space-pre"> </span></p>
<p id="ember80" class="ember-view reader-text-block__paragraph">Creator,<span class="white-space-pre"> </span><span style="color: #1ab391;"><a href="http://aesirx.io/" target="_self" class="app-aware-link" style="color: #1ab391;">AesirX.io</a></span></p>
<p id="ember81" class="ember-view reader-text-block__paragraph"><strong>AesirX Early Agency Adopter Program</strong><span class="white-space-pre"> </span>is now open, read all about the<span class="white-space-pre"> </span><span style="color: #1ab391;"><a href="https://aesirx.io/partner" target="_self" class="app-aware-link" style="color: #1ab391;">advantages and benefits</a></span><span class="white-space-pre"> </span>of becoming an early adopter of privacy-focused solutions and help your clients avoid risk of fines and negative attention while earning up to 25% commission on licenses.</p>

Why Blocking Unauthorized Trackers Matters in WordPress

Why blocking unauthorized trackers is so crucial, and how you can use the new AesirX Consent Shield to do just that.

Why Blocking Unauthorized Trackers Matters in WordPressbo

<p><span class="fw-semibold" style="color: #808080; font-size: 18pt;">In the heart of Copenhagen on <strong>September 27, 2024</strong>, European digital policymakers from the D9+ gathered for a pivotal Ministerial Meeting, setting the course for the future of the Digital Single Market (DSM). The outcomes of this meeting highlight significant shifts in how Europe approaches digital transformation, privacy, and innovation, with implications that will ripple across industries and borders.</span></p>
<p>As technology continues to evolve at a breakneck speed, the D9+ countries are focused on responsible, fair, and secure digitalization. The <span style="color: #1ab391;"><a href="https://www.svensktnaringsliv.se/skolforum/6l2hgg_d9-declaration-for-ministerial-meeting-in-copenhagen-approvedpdf_1221270.html/D9%252B+Declaration+for+Ministerial+Meeting+in+Copenhagen+%2528approved%2529.pdf" style="color: #1ab391;">declaration issued</a></span> during this meeting outlines several crucial areas where the EU intends to strengthen its regulatory framework and reinforce its commitment to a privacy-first digital ecosystem. Here are the key takeaways and what they mean for businesses, innovators, and consumers across Europe.</p>
<h2>Advancing the Digital Single Market</h2>
<p>Over the past few years, the DSM has seen a flurry of legislative advancements with the introduction of groundbreaking regulations, including the AI Act, Data Act, Cyber Resilience Act, Digital Services Act, and the revised eIDAS Regulation. These frameworks aim to harmonize Europe’s approach to digital services, data management, and security.</p>
<p>However, as technology evolves, so too must the regulatory landscape. The D9+ countries are keenly aware of the need for vigilance in addressing emerging risks and opportunities in the digital space. As the declaration emphasizes, "the digital domain is one of constant change," and keeping pace with new developments is essential for maintaining a coherent and secure DSM.</p>
<h2>Risk-Based, Evidence-Based Regulation</h2>
<p>One of the strongest messages from the meeting was the commitment to risk-based and evidence-based regulation. This means that future laws must be founded on solid evidence, addressing only real, demonstrated issues, and must avoid stifling innovation. Regulations should aim to:</p>
<ul>
<li aria-level="1">Reduce burdens on businesses.</li>
<li aria-level="1">Promote new business models and technological innovation.</li>
<li aria-level="1">Ensure that digital rights, particularly the rights of vulnerable groups such as children, are upheld in a proportionate and balanced manner.</li>
</ul>
<p>This emphasis on balance is vital as Europe seeks to build a competitive digital economy while ensuring that innovation does not come at the expense of user privacy or data security.</p>
<h2>Key Priorities for the Next European Commission</h2>
<p>The D9+ countries also called on the upcoming European Commission to prioritize implementing the recently adopted regulations and to review the existing digital regulatory framework for effectiveness, efficiency, and coherence. Two specific areas were highlighted for immediate attention:</p>
<ul>
<li aria-level="1"><strong>Strengthened Framework on Cookies and Online Tracking:</strong> As digital consumers, we are all familiar with the concept of "cookie fatigue" – those endless pop-up consent boxes. The current regulatory framework is outdated and creates consent fatigue, legal uncertainty, and dark patterns that confuse users. The D9+ emphasized the urgent need to harmonize regulations, making online tracking more transparent and manageable, especially when it comes to protecting children from unwanted tracking.</li>
<li aria-level="1"><strong>Realizing the Potential of EUDI Wallets:</strong> The European Digital Identity (EUDI) Wallet is set to revolutionize the Single Market by enabling seamless identity verification across borders. The D9+ views the successful implementation of EUDI Wallets as a key priority for creating a more integrated and accessible digital market, making it easier for citizens and businesses alike to engage in cross-border digital activities.</li>
</ul>
<h2>Implications for Businesses: Embrace Privacy-First Strategies</h2>
<p>For businesses, the outcomes of the D9+ Ministerial Meeting signal a clear directive: embracing privacy-first strategies is no longer optional – it’s essential for survival in today's digital environment. The EU's push towards a privacy-centric framework requires businesses to move away from third-party data and excessive tracking practices that have dominated digital marketing and analytics for years. Instead, businesses must adopt first-party solutions that align with regulatory demands and foster greater customer trust.</p>
<p><span style="color: #1ab391;"><a href="https://privacyscanner.aesirx.io/first-party" target="_blank" rel="noopener" style="color: #1ab391;">AesirX’s First-Party Foundation</a></span> provides a comprehensive suite of tools that enable businesses to collect and analyze first-party data without compromising privacy. A key differentiator of AesirX’s approach is that consumers maintain control over their data. In the AesirX data model, users can make informed decisions about how their data is shared, with consent mechanisms ensuring that data is processed only with explicit, informed consent. While businesses may handle user data, they do so in a transparent, privacy-preserving manner. AesirX provides the infrastructure for this secure exchange without directly accessing or storing the data itself​​.</p>
<p>Solutions like AesirX Analytics &amp; CMP and AesirX Shield of Privacy work together to offer privacy-compliant analytics and decentralized consent management, enabling businesses to process data securely and ethically while ensuring that users remain in control of their personal information. The AesirX Shield of Privacy (SoP) adds a pseudonymization layer, ensuring that sensitive user data – such as personal identifiers or location information – is masked during processing. This allows businesses to analyze customer behavior and gain valuable insights through <span style="color: #1ab391;"><a href="https://analytics.aesirx.io" target="_blank" rel="noopener" style="color: #1ab391;">AesirX Analytics &amp; CMP</a></span> while ensuring full compliance with privacy regulations​​.</p>
<p>With AesirX Analytics &amp; CMP, businesses can utilize first-party data collected through explicit consent facilitated by AesirX’s decentralized consent model. This allows businesses to operate transparently while allowing users to retain control of their data, creating an ecosystem where trust is built on informed data ownership. Through AesirX Analytics &amp; CMP, businesses can optimize their strategies using user-approved data, further aligning with GDPR and ePrivacy Directive requirements​​.</p>
<p><span style="color: #1ab391;"><a href="https://aesirx.io/blog/analytics/concordium-s-zero-knowledge-proof-in-aesirx-analytics" target="_blank" rel="noopener" style="color: #1ab391;">Concordium’s zero-knowledge proof (ZKP) technology</a></span> plays a crucial role in enhancing age and country verification processes. By leveraging indirect ZKP, businesses can verify user information such as age or country of residence without revealing sensitive personal data. This is particularly important for companies operating across borders or managing sensitive customer interactions. Through the AesirX infrastructure, which integrates Concordium’s blockchain ID technology, businesses can ensure that verification processes are compliant, secure, and privacy-preserving, enabling them to build trust with users while adhering to strict regulatory frameworks​​.</p>
<h2>Why a Privacy-First Strategy is Essential for Competitiveness</h2>
<p>As consumers become more privacy-conscious, adhering to regulations like the GDPR and ePrivacy Directive is not just a compliance necessity – it’s a strategic imperative. Studies indicate that 68% of consumers globally are concerned about their online privacy, and businesses that proactively adopt privacy-first strategies are poised to differentiate themselves by fostering greater trust and loyalty​​.</p>
<p>The move towards privacy-first approaches is about more than avoiding regulatory penalties; it’s about building a competitive advantage. Businesses that invest in privacy-enhancing technologies like first-party data solutions, decentralized consent mechanisms, and pseudonymization layers such as the AesirX Shield of Privacy will be seen as ethical, trustworthy, and secure – key factors in earning consumer loyalty in the digital age​. As regulations tighten, businesses that fail to prioritize privacy risk not only hefty fines – which have already exceeded €2.1 billion in 2023 – but also reputational damage that could significantly impact customer retention and market standing​.</p>
<p>With <span style="color: #1ab391;"><a href="https://aesirx.io" target="_blank" rel="noopener" style="color: #1ab391;">AesirX’s decentralized consent model and privacy-first infrastructure</a></span>, consumers retain significant control over their data, with businesses processing data only with explicit and informed consent. By leveraging AesirX Analytics &amp; CMP, businesses can enhance their operations using user-authorized data, gaining insights that drive growth while maintaining full compliance with privacy laws​​. Additionally, with Concordium’s ZKP-based age and country verification, businesses can confirm key user details without exposing sensitive information, enhancing trust and regulatory compliance​​.</p>
<h2>A More Resilient and Sustainable Digital Future</h2>
<p>The D9+ meeting underscores Europe’s commitment to a privacy-centric digital transformation, where innovation, regulation, and consumer trust must coexist. The future of Europe’s digital market will be built on sustainable practices, where businesses that embrace privacy-first strategies and first-party solutions will thrive.</p>
<p>Businesses need to re-evaluate their data practices, ensuring that privacy and security are built into their operations from the ground up. This means investing in technologies that offer real-time compliance monitoring, secure identity management, and transparent consent mechanisms. Those who do will not only navigate the regulatory landscape with ease but also build stronger customer relationships by aligning with the values of privacy, transparency, and trust​​​.</p>
<p>By adopting privacy-first tools such as <span style="color: #1ab391;"><a href="https://shield.aesirx.io" target="_blank" rel="noopener" style="color: #1ab391;">AesirX Shield of Privacy</a></span>, which includes pseudonymization for user data, and integrating privacy into the core of their digital strategies through AesirX Analytics &amp; CMP, businesses will not only avoid regulatory pitfalls but also gain a competitive edge in a market that increasingly values ethical data practices​​.</p>
<p>While businesses still handle data to some extent, AesirX’s infrastructure ensures that all data interactions are transparent and occur with explicit consent, allowing users to retain ownership and control over their personal information. This data flows through AesirX Shield of Privacy into AesirX Analytics &amp; CMP, creating a compliant ecosystem where businesses can leverage data insights without compromising on user trust or privacy. Concordium’s zero-knowledge proofs further enhance these processes, allowing businesses to carry out age and country verifications without needing to expose users’ private data​​.</p>
<p>As Europe continues to refine its digital policies, now is the time for businesses to reimagine their data strategies, build privacy into their core operations, and capitalize on these regulations as opportunities for growth and differentiation. The D9+ Ministerial Meeting in Copenhagen marks a pivotal moment in Europe’s digital journey, and businesses that proactively embrace these changes will be best positioned to succeed in the years ahead.</p>
<p>Gaining a competitive edge and aligning with the values of privacy, transparency, and trust that are becoming central to European consumers is critical for future growth.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab391;"><a href="https://twitter.com/VikingTechGuy" style="color: #1ab391;">VikingTechGuy</a>&nbsp;</span></p>
<p>Creator, AesirX.io</p>

The Future of Europe's Digital Transformation: Key Insights from the D9+ Ministerial Meeting in Copenhagen

The D9+ Ministerial Meeting is shaping Europe’s digital future with privacy-first regulations, changing business strategies and building consumer trust.

The Future of Europe's Digital Transformation: Key Insights from the D9 Ministerial Meeting in Copenhagen

<p><span class="fw-semibold" style="color: #808080; font-size: 18pt;">As a dedicated open-source advocate with over 25 years of experience and the creator of AesirX, I've seen the real impact of collaboration in building strong, lasting ecosystems. Open source isn’t just about sharing code; it embodies a philosophy of collective growth, mutual respect, and the unwavering belief that we’re part of something much bigger than ourselves. <span style="color: #1ab394;"><a href="https://techcrunch.com/2024/09/22/matt-mullenweg-calls-wp-engine-a-cancer-to-wordpress-and-urges-community-to-switch-providers/" style="color: #1ab394;">Recent events at WordCamp US</a></span> have highlighted how important these values are, particularly through Matt Mullenweg’s courageous stance in addressing significant community issues.</span></p>
<h2>Supporting Matt Mullenweg: Courage and Commitment</h2>
<p>I want to extend my heartfelt support to Matt Mullenweg for his bold decision to call out WP Engine on stage at WordCamp US. Addressing such a pivotal and contentious subject in a public forum takes immense courage, and it underscores Matt’s unwavering commitment to the integrity and sustainability of the WordPress ecosystem. By tackling these issues directly, Matt has emphasized the need to uphold fairness and transparency within our community. His actions set a precedent for open dialogue, accountability, and a collective effort to cultivate a healthier ecosystem.</p>
<h2>Focusing on Contribution and Fairness in the Open Source Ecosystem</h2>
<p>In the spirit of fostering a more equitable and collaborative environment, it’s essential to examine what true contribution means within the open-source community. Contributions are the lifeblood of projects like WordPress, ensuring their growth, sustainability, and continuous improvement. However, the current dynamics within the WordPress community raise important questions about fairness and the proportionality of contributions from different stakeholders.</p>
<h2>WP Engine's Contributions: A Critical Examination</h2>
<p>WP Engine, a major player in the WordPress hosting space, claims to contribute 40 hours per week to the WordPress project under the "Five for the Future" initiative. On the surface, this may seem commendable. However, when we dig deeper, the context reveals a different story. WP Engine generates nearly half a billion USD in revenue annually, predominantly built on the foundation of WordPress. Yet, their contribution of 40 hours per week, equivalent to a single full-time resource, falls short of what one would expect from a company of their stature and financial success.</p>
<p>The success of WP Engine is inherently tied to WordPress’s growth, yet their limited contribution in terms of development hours raises concerns about their commitment to maintaining the long-term vitality of the platform that underpins their business.</p>
<p>This disparity raises a pressing question: Is WP Engine's contribution a genuine effort to support the WordPress ecosystem, or is it a strategic move to leverage the "Five for the Future" initiative for marketing and branding purposes? When a company benefits so significantly from an open-source project, it bears a proportional responsibility to give back. A single full-time resource, while beneficial, does not align with the scale of WP Engine's impact and revenue.</p>
<h2>The Free Rider Phenomenon</h2>
<p>Smaller organizations and individual contributors often invest a substantial portion of their limited resources – sometimes 5-10 hours per week or more – into projects like WordPress. These contributions are driven by a deep understanding and appreciation of what we are collectively building. They represent sacrifices and a commitment to ensuring that the platform remains free, open, and accessible to all.</p>
<p>When large companies like WP Engine contribute at a rate that appears disproportionate to their benefits, it creates an imbalance within the community. It creates a perception of free-riding, where contributions are seen not as genuine support but as token gestures to reap marketing benefits. This undermines the efforts of smaller contributors, who invest significantly more relative to their means, often without the same level of recognition or reward.</p>
<h2>Proposing a Tiered Contribution Model</h2>
<p>To address these disparities and for a more fair and balanced contribution landscape, I propose the implementation of a Tiered Contribution Model based on company revenue. This model aims to align contributions with the financial benefits companies derive from the WordPress ecosystem, promoting equity and sustainability within our community.</p>
<ul>
<li aria-level="1"><strong>Tier 1:</strong> Up to $1 Million USD Annual Revenue<br /><strong>Contribution Expectation:</strong> 1-2 hours per week or more</li>
<li aria-level="1"><strong>Tier 2:</strong> $1 Million to $10 Million USD Annual Revenue<br /><strong>Contribution Expectation</strong>: 10-20 hours per week or more</li>
<li aria-level="1"><strong>Tier 3:</strong> $10 Million to $100 Million USD Annual Revenue<br /><strong>Contribution Expectation:</strong> 100-200 hours per week or more</li>
<li aria-level="1"><strong>Tier 4:</strong> $100 Million to $1 Billion USD Annual Revenue<br /><strong>Contribution Expectation:</strong> 1,000-2,000 hours per week or more</li>
<li aria-level="1"><strong>Tier 5</strong>: Above $1 Billion USD Annual Revenue<br /><strong>Contribution Expectation:</strong> 2,000+ hours per week or more</li>
</ul>
<p>Additionally, contributions that exceed the expected levels for each tier should be eligible for special recognition. This not only rewards companies that go above and beyond their basic contributions but also encourages others to strive for higher levels of support. Openness in reporting contributions should not only be expected but actively encouraged, as open-source thrives on the transparency and trust that come with accountability.</p>
<h2>Automattic: Leading by Example</h2>
<p>While there is considerable discussion about how both Automattic and WP Engine may confuse users regarding the WordPress brand – Automattic with WordPress.com and WP Engine with its focus on managed hosting services – it is crucial to highlight the positive impact Automattic has had on the WordPress ecosystem. Automattic is nearing 4,000 hours of contribution, setting a high standard for other companies to follow. Their substantial support underlines the importance of leading by example in the open-source community. Despite the brand confusion issues, Automattic's dedication to contributing back to WordPress exemplifies the kind of commitment needed to sustain and grow our shared platform.</p>
<h2>The Importance of Proportional Contribution</h2>
<p>Open-source ecosystems thrive on the principle of reciprocity. Those who benefit the most from the community should contribute back in ways that reflect their usage and impact. For WP Engine, this means going beyond the minimum requirements and ensuring that their contributions are meaningful and proportionate to their revenue and influence.</p>
<p>A more balanced approach would involve WP Engine scaling their contributions to match the value they derive from WordPress. This could include increasing their development hours, funding critical initiatives, sponsoring events, or providing resources that directly benefit the broader community. Such actions would not only enhance the platform but also reinforce the company's commitment to the principles of open source.</p>
<h2>Fostering a Collaborative and Equitable Community</h2>
<p>To maintain the integrity and sustainability of the WordPress ecosystem, it’s essential to address these disparities in contribution. Here are a few steps the community can take:</p>
<ul>
<li aria-level="1">Establish Clear Contribution Guidelines: Define what constitutes meaningful contributions, especially for larger companies, to keep their efforts aligned with the community's needs.</li>
<li aria-level="1">Enhance Transparency: Encourage companies to openly share their contributions and the impact they have on the project. Transparency strengthens trust and accountability.</li>
<li aria-level="1">Promote Equitable Participation: Make sure that all contributors, whether individuals or organizations, feel valued and empowered to contribute in ways that best suit their capabilities and resources.</li>
</ul>
<h2>Building Together with Integrity</h2>
<p>Open source thrives on the genuine contributions of its community members. While every contribution, big or small, is vital, these efforts must align with the benefits received. Companies like WP Engine have a responsibility to lead by example, showing that true contribution extends beyond fulfilling obligations – it reflects a commitment to the project’s success and the community's well-being.</p>
<p>To strengthen our ecosystem, let’s connect our actions with our values. Establishing clear contribution guidelines and promoting transparency will help ensure a sustainable future for WordPress. As we face these challenges, we must reaffirm our dedication to fairness, transparency, and authentic collaboration.</p>
<p>As a small-tech, privacy-first startup, AesirX, like many independent organizations, strives to make meaningful contributions. I personally contribute 5 hours per week, and we encourage voluntary participation from our partners and staff to keep supporting the ecosystem that supports us.</p>
<p>I invite the WordPress community, contributors, and organizations to reflect on their own contributions and join the conversation about creating a more equitable, sustainable open-source future.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab394;"><a href="https://twitter.com/VikingTechGuy" style="color: #1ab394;">VikingTechGuy</a>&nbsp;</span></p>
<p>Creator, AesirX.io</p>

The True Essence of Contribution in Open Source: A Call for Fairness and Authenticity

Advocating for fairness in open source, this blog explores the need for proportional contributions in WordPress and calls for greater transparency

The True Essence of Contribution: A Call for Fairness

AesirX First-Party Foundation: The Alternative to Non-Compliance for WordPress Website Owners

Shifting from third-party to first-party solutions is the key to staying compliant, avoiding penalties, and maintaining the trust of your users.

<p><strong><span style="font-size: 14pt;">In a groundbreaking ruling, the Court of Justice of the European Union (CJEU) has placed tighter restrictions on how businesses can process personal data without consent, tightening the rules around "legitimate interest".&nbsp;</span></strong></p>
<p><span style="color: #1ab394;"><a href="https://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=290003&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1803871" style="color: #1ab394;">This decision in Joined Cases C-17/22 and C-18/22</a></span>, dated 12 September 2024, highlights stricter boundaries for data sharing, particularly in sensitive cases like contact details. The Court examined the application of Article 6(1) and the circumstances under which personal data processing may be lawful, particularly when consent is absent.</p>
<p>Here’s a breakdown of the key findings and what they mean for GDPR compliance.</p>
<h2>Key Points and Analysis</h2>
<h3>1. Context of the Case</h3>
<p>The case concerns an investment fund set up as a limited partnership offering shares to the public. The plaintiffs, who are partners in the fund, requested access to the contact details of other partners with indirect shareholdings through a trust company. The trust companies refused, arguing that the request was economically driven and could harm other partners. The referring court asked for guidance on applying Article 6(1) of the GDPR, focusing on the legitimacy of processing personal data in such a scenario.</p>
<h3>2. Article 6(1) GDPR: Lawfulness of Processing Personal Data</h3>
<p>Article 6(1) of the GDPR outlines six conditions under which the processing of personal data can be lawful. These include:</p>
<ul>
<li aria-level="1">Consent of the data subject (point (a))</li>
<li aria-level="1">Processing necessary for the performance of a contract (point (b))</li>
<li aria-level="1">Compliance with a legal obligation (point (c))</li>
<li aria-level="1">Legitimate interest pursued by the data controller or a third party (point (f))</li>
</ul>
<p>The Court examined how points (b), (c), and (f) applied to this case.</p>
<h3>3. Point (b): Processing Necessary for Contract Performance</h3>
<p>The plaintiffs argued that accessing the contact details of other partners was necessary for exercising their rights under the partnership contract, such as negotiating the purchase of shares or coordinating partner resolutions.</p>
<ul>
<li aria-level="1"><strong>Court’s Response:</strong> The Court clarified that for processing under point (b) to be justified, it must be "objectively indispensable" for fulfilling the contract. Processing that is merely helpful or convenient is not enough. In this case, the investment and trust agreements explicitly prohibited sharing personal data with other partners, so the requested data processing was not necessary for the contract's performance.</li>
<li aria-level="1"><strong>Conclusion on Point (b):</strong> The Court ruled that disclosing the contact details of other partners does not meet the necessity threshold for contract performance, especially if the contract explicitly forbids such disclosure.</li>
</ul>
<h3>4. Point (f): Legitimate Interests of the Data Controller or Third Party</h3>
<p>The plaintiffs also argued that their request was justified by legitimate interests, such as the economic interest of entering into share purchase negotiations or coordinating resolutions with other partners.</p>
<ul>
<li aria-level="1"><strong>Court’s Response:</strong> The Court applied the three-part test for legitimate interest under Article 6(1)(f):
<ul>
<li aria-level="2"><strong>Legitimate interest:</strong> The Court acknowledged that a wide range of interests can be considered legitimate, and the plaintiffs' interest in contacting other partners for business purposes could be legitimate.</li>
<li aria-level="2"><strong>Necessity:</strong> The Court emphasized that processing must be "strictly necessary" to achieve the legitimate interest. Here, the Court suggested alternative methods, such as the plaintiffs requesting the trust company to pass on their contact details to other partners, leaving it up to the partners to decide whether to engage. This alternative would be less intrusive and still serve the legitimate interests of the plaintiffs.</li>
<li aria-level="2"><strong>Balancing of interests:</strong> The Court ruled that even if a legitimate interest exists, it must not override the fundamental rights and freedoms of the data subjects (the other partners). The Court noted that the partners with indirect shareholdings had a reasonable expectation of confidentiality, and this expectation likely outweighed the plaintiffs' interests.</li>
</ul>
</li>
<li aria-level="1"><strong>Conclusion on Point (f):</strong> The Court held that while the plaintiffs may have a legitimate interest, the processing of personal data in this case was not strictly necessary, and the interests or fundamental rights of the data subjects (partners) took precedence.</li>
</ul>
<h3>5. Point (c): Compliance with a Legal Obligation</h3>
<p>The referring court also raised the possibility of a legal obligation under national law that might require the disclosure of partners’ contact details. In some national case law, there may be an obligation to disclose such information, particularly within the context of transparency in partnerships.</p>
<ul>
<li aria-level="1"><strong>Court’s Response:</strong> The Court stated that any legal obligation to process personal data must be based on clear, precise, and foreseeable national law, as required by Article 6(3) GDPR. Additionally, such a legal obligation must meet an objective of public interest and be proportionate. The referring court must verify whether such a legal obligation exists under national law and whether it meets these criteria.</li>
<li aria-level="1"><strong>Conclusion on Point (c):</strong> The Court deferred to the national court to determine whether a legal obligation exists under national law, but stressed that such an obligation must comply with the requirements of clarity, precision, and proportionality as set out in EU law.</li>
</ul>
<h2>Final Judgment and Conclusions</h2>
<ul>
<li aria-level="1"><strong>Point (b) (Performance of a Contract):</strong> The processing of personal data for disclosing partners' contact information is not justified under this provision, especially when the contract explicitly prohibits such disclosure.</li>
<li aria-level="1"><strong>Point (f) (Legitimate Interest):</strong> While the plaintiffs may have a legitimate interest in contacting other partners, the disclosure of their personal data is not strictly necessary, and the data subjects' (partners') right to confidentiality takes precedence.</li>
<li aria-level="1"><strong>Point (c) (Compliance with a Legal Obligation):</strong> The Court left it to the national court to determine whether such an obligation exists under national law, subject to the condition that the law is clear, precise, and proportionate.</li>
</ul>
<h2>The Role of Consent: Key Takeaways</h2>
<p>This judgment reinforces that consent remains a cornerstone of lawful data processing under the GDPR.&nbsp;</p>
<p>While alternative grounds like legitimate interest may sometimes justify processing, the lack of consent requires a high threshold for any other legal basis to apply. Consent, when freely given, specific, informed, and unambiguous, remains the gold standard for ensuring compliance, particularly in sensitive contexts where confidentiality is expected, as with financial partnerships.</p>
<p>This ruling underscores the importance of protecting personal data and suggests that when consent is not obtained, businesses must apply a very narrow and restrictive interpretation of other lawful bases. AesirX focuses on helping organizations navigate these complexities, emphasizing first-party consent solutions to ensure GDPR compliance.</p>
<h2>Broader Implications</h2>
<p>This judgment reinforces the strict interpretation of Article 6(1) of the GDPR, particularly in limiting the use of legitimate interest as a lawful basis for data processing. It stresses the need for carefully balancing the rights of data subjects against the interests of data controllers or third parties, especially where individuals have a reasonable expectation of privacy and confidentiality. Furthermore, the judgment underscores the necessity of well-defined and explicit legal obligations when processing personal data under national law.</p>
<p>The decision highlights the critical role of transparency in contractual agreements and the protection of personal data, especially in business structures involving multiple parties. It reaffirms the GDPR’s focus on prioritizing individual rights over economic interests, requiring businesses to be more vigilant in securing valid consent or adhering strictly to other lawful bases for processing.</p>
<p>In summary, the ruling elevates the protection of personal data above commercial objectives, aligning firmly with the GDPR's core principles. Businesses must take proactive steps to ensure that they are obtaining valid consent or rigorously applying alternative legal bases when consent is absent.</p>
<p>To learn more about how AesirX can help you stay compliant and avoid fines, contact us for a <span style="color: #1ab394;"><a href="https://privacyscanner.aesirx.io/privacy-review" target="_blank" rel="noopener" style="color: #1ab394;">Privacy Review</a></span> or try our free <span style="color: #1ab394;"><a href="https://privacyscanner.aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">Privacy Scanner</a></span> to evaluate your website’s current consent practices.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab394;"><a href="https://twitter.com/VikingTechGuy" target="_blank" rel="noopener" style="color: #1ab394;">VikingTechGuy</a>&nbsp;</span></p>
<p>Creator, AesirX.io</p>

GDPR Update: Landmark Case Limits Legitimate Interest for Personal Data Sharing

CJEU ruling tightens GDPR rules on legitimate interest, emphasizing stricter consent requirements for data sharing in sensitive cases like contact details.

GDPR Update: Landmark Case Limits Legitimate Interest in Data Sharing

<p><span style="color: #808080; font-size: 14pt;"><strong>The Belgian Data Protection Authority (DPA) recently <span style="color: #1ab394;"><a href="https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-113-2024-van-6-september-2024.pdf" style="color: #1ab394;">issued a ruling</a></span> emphasizing strict adherence to General Data Protection Regulation (GDPR) in cookie consent mechanisms, highlighting specific issues in current industry practices.</strong></span></p>
<p>This decision serves as a reminder to businesses and website operators to strictly adhere to the GDPR’s requirements on transparency and user consent. Here, we break down the essentials of the ruling and its implications for your website’s cookie management.</p>
<h2>The Core Issues</h2>
<p>The ruling addresses several key issues regarding cookie consent mechanisms:</p>
<ol>
<li aria-level="1"><strong>Absence of 'Reject All' Option</strong><br />The DPA highlighted a significant flaw in the cookie consent banners of several websites, where the 'Reject All' button was either missing or not as easily accessible as the 'Accept All' button. This disparity led to an imbalance in how users could manage their consent, favoring acceptance over rejection.</li>
</ol><ol start="2">
<li aria-level="1"><strong>Misleading Button Colors</strong><br />Another point of contention was the use of misleading button colors, which subtly nudged users towards accepting cookies (Dark Patterns). The DPA deemed this practice as deceptive, violating the principles of fairness and transparency under GDPR.</li>
</ol><ol start="3">
<li aria-level="1"><strong>Complex Process for Withdrawing Consent</strong><br />In many instances, withdrawing consent was found to be more complicated than giving it. The DPA stressed that the process for withdrawing consent should be as simple as granting it, in line with Article 7(3) of the GDPR.</li>
</ol><ol start="4">
<li aria-level="1"><strong>Unlawful Use of Legitimate Interest</strong><br />The ruling also addressed the misuse of 'legitimate interest' as a fallback ground for processing after users had refused consent. This was deemed non-compliant with GDPR as they bypassed user autonomy and consent.</li>
</ol>
<h2>&nbsp;Key Actions for Website Operators</h2>
<ol>
<li aria-level="1"><strong>Implement a 'Reject All' Button</strong><br />Ensure that your cookie consent banner includes an easily accessible '<strong>Reject All</strong>' button. It should be placed on the same level as the 'Accept All' button to provide a balanced choice to users.</li>
</ol><ol start="2">
<li aria-level="1"><strong>Avoid Dark Patterns</strong><br />Refrain from using deceptive design practices like misleading button colors that can influence user decisions. Transparency is key to maintaining user trust and compliance with GDPR.</li>
</ol><ol start="3">
<li aria-level="1"><strong>Simplify the Withdrawal of Consent</strong><br />Make it straightforward for users to withdraw their consent. This can be achieved by ensuring that the process requires no more effort than the initial consent.</li>
</ol><ol start="4">
<li aria-level="1"><strong>Review Your Legal Bases for Processing</strong><br />Examine your use of <strong>'legitimate interest</strong>' carefully. It should not be used as a secondary option to consent. If cookies require consent under the ePrivacy Directive (as transposed into national law), ensure this consent is clear, unambiguous, and obtained before any processing.</li>
</ol>
<h2>&nbsp;Why First-Party Consent Management is Essential for Compliance: Avoid Fines with AesirX Solutions</h2>
<p>In light of the recent Belgian DPA ruling, it’s clear that businesses need more than just a cookie consent banner – they need an effective, first-party consent management solution to ensure compliance and avoid the risk of fines. This ruling is a reminder that consent management cannot be an afterthought; it must be a central part of your website’s data practices, particularly in the post-GDPR world.</p>
<h2>The Compliance Challenge</h2>
<p>One of the key issues raised by the Belgian DPA was the failure of many websites to provide users with clear, accessible options for rejecting cookies, as well as the misuse of 'legitimate interest' to process data when consent was not given. These failures highlight a common problem: many businesses rely on outdated or non-compliant third-party solutions for managing consent, which often lack the transparency and flexibility required by GDPR and the ePrivacy Directive.</p>
<p>This is where AesirX’s first-party consent management platform becomes an essential tool for any business aiming to stay compliant.</p>
<h2>The AesirX Advantage: Compliant First-Party Consent Management</h2>
<p><span style="color: #1ab394;"><a href="https://aesirx.io" target="_blank" rel="noopener" style="color: #1ab394;">AesirX offers a first-party consent management solution</a></span> that not only addresses the core requirements of GDPR and the Belgian DPA’s ruling, but also ensures that your business maintains full control over the data it collects. Here’s how AesirX can help:</p>
<ol>
<li aria-level="1"><strong>Full Compliance with GDPR and ePrivacy:</strong> AesirX’s consent management platform ensures that users are given clear, transparent choices about how their data is used. The solution makes it easy for users to provide or withdraw consent, and all actions are recorded for audit purposes, allowing you to demonstrate compliance if ever required. This aligns directly with the Belgian DPA's emphasis on user control and transparency.</li>
</ol><ol start="2">
<li aria-level="1"><strong>First-Party Data Collection for Greater Security and Trust:</strong> With AesirX, your data collection happens within your own ecosystem, without relying on third-party cookies or external processors. This minimizes the risks associated with data sharing and ensures that users’ data is handled in a secure, privacy-centric way. First-party data collection is not only more secure, but it also allows you to build stronger relationships with your users by prioritizing their privacy.</li>
</ol><ol start="3">
<li aria-level="1"><strong>Avoiding Dark Patterns and Ensuring Fairness:</strong> The Belgian DPA highlighted the need to avoid manipulative design tactics that push users to accept cookies. With AesirX, you can be confident that your consent forms and interfaces are built to respect user choices. Our solution provides equally accessible "Accept All" and "Reject All" buttons, preventing the use of dark patterns and ensuring fair consent practices – one of the ruling’s key compliance points.</li>
</ol><ol start="4">
<li aria-level="1"><strong>Real-Time Consent Management:</strong> AesirX provides a real-time consent management solution that is fully customizable. Whether users change their preferences or withdraw consent, your system will immediately reflect these changes, keeping your business compliant at all times. This simplifies the process of tracking consent and always prepares you for regulatory scrutiny.</li>
</ol>
<h2>Why First-Party Consent Management is Key to Long-Term Success</h2>
<p>The shift towards first-party data and consent management isn’t just a reaction to regulatory pressure – it’s a strategic move that positions your business for the future. As third-party cookies are phased out and privacy expectations grow, companies that adopt a first-party, privacy-first approach will be the ones who thrive in this new landscape. By choosing AesirX, you ensure that your business is ready for these changes while protecting your users’ data and fostering trust.</p>
<h2>Final Thoughts: Avoiding Fines with AesirX</h2>
<p>The Belgian DPA ruling sends a clear message: compliance with cookie consent and data privacy regulations is non-negotiable. Businesses that fail to implement proper consent mechanisms risk substantial fines and damage to their reputation. With AesirX’s first-party consent management platform, you can protect your business from these risks and ensure full compliance with GDPR, the ePrivacy Directive, and any national rulings like the one from the Belgian DPA.</p>
<p>By investing in a comprehensive, first-party consent solution, your business not only avoids regulatory pitfalls but also builds a strong foundation of trust with your users – something that will pay dividends as privacy expectations continue to rise.</p>
<p>To learn more about how AesirX can help you stay compliant and avoid fines, contact us for a <span style="color: #1ab394;"><a href="https://privacyscanner.aesirx.io/privacy-review" style="color: #1ab394;">Privacy Review</a></span> or try our free <span style="color: #1ab394;"><a href="https://privacyscanner.aesirx.io/" style="color: #1ab394;">Privacy Scanner</a></span> to evaluate your website’s current consent practices.</p>
<p>Ronni K. Gothard Christiansen // <span style="color: #1ab394;"><a href="https://twitter.com/VikingTechGuy" style="color: #1ab394;">VikingTechGuy</a>&nbsp;</span></p>
<p>Creator, AesirX.io</p>

Understanding the Recent Ruling by the Belgian DPA on Cookie Consent

The Belgian DPA's recent ruling on cookie consent emphasizes stricter GDPR compliance. Learn how it affects your website’s cookie management and best practices

News and Articles

Gothard Landing Page

news

link

linkedin.png

Follow me on

LinkeDin

vikingtechguy.png

Viking Tech Guy

youtube.png

Youtube

aesirx_logo.png

Projects

Aesirx

R_logo.png

R digital

next_generation.png

Next Generation

VN_scholarship.png

VN scholarship

ida_marie.png

IDA Marie

r_family.png

Family VC

R Family

Ronni K. Gothard Christiansen

Enhance your online presence with expert insights and best practices in digital marketing and compliance. Stay informed and optimize your strategies for success!

Digital Marketing & Compliance Hub: Expert Insights & Best Practices

Ronni K. Gothard Christiansen

News and Articles