GDPR · Regulation (EU) 2016/679
Article 8a
Compare the available Commission, Council and Parliament texts and amendments affecting this article.
Article total: 1 part · 1 Council draft · 0 Parliament amendments
Removed wording is struck through; added or replacement wording is highlighted.
Institutional text
European Commission proposal
All Commission’s changes to GDPRThe wording proposed by the Commission at the start of this legislative file.
No standalone Commission wording is mapped to these tracked parts. A newly proposed provision may have no earlier text of its own.
Institutional text
Council Presidency texts
Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.
No Council wording is mapped to this tracked part.
Article in May Presidency compromise Council text
Comparison basis: Existing law (4 May 2016) compared with May Presidency compromise (21 May 2026)
Article 8a
Consent through automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
- 1.
For the purpose of data subject consent to the storing of personal data, or gaining of access to personal data already stored in the terminal equipment of a natural person in accordance with Directive 2002/58/EC, controllers shall ensure that their online interfaces allow data subjects to:
- (a)
Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;
- (b)
refuse a request for consent or exercise the right to object pursuant to Article 21(2) through automated and machine-readable means;
- (ba)
withdraw consent through automated and machine-readable means.
- (a)
- 2.
Controllers shall respect automated and machine-readable means expressing the choices made by data subjects in accordance with paragraph 1.
- 3.
Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.
- 4.
The Commission shall request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices, subject to consultation, in accordance with Article 10 of Regulation (EU) 1025/2012. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.
- 5.
Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
- 6.
Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall provide the technical means to allow data subjects to give their consent, to withdraw consent, and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 4 of this Article.
- 7.
Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].
- 7a.
Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces. (…)
Article 8a
May Presidency compromise
Article 8a Consent through automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
For the purpose of data subject consent to the storing of personal data, or gaining of access to personal data already stored in the terminal equipment of a natural person in accordance with Directive 2002/58/EC, controllers shall ensure that their online interfaces allow data subjects to:
Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;
refuse a request for consent or exercise the right to object pursuant to Article 21(2) through automated and machine-readable means;
withdraw consent through automated and machine-readable means.
Controllers shall respect automated and machine-readable means expressing the choices made by data subjects in accordance with paragraph 1.
Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.
The Commission shall request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices, subject to consultation, in accordance with Article 10 of Regulation (EU) 1025/2012. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.
Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall provide the technical means to allow data subjects to give their consent, to withdraw consent, and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 4 of this Article.
Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].
Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces. (…)
Article 8a 1 Council draft
Article 8a
21 May 2026 · May Presidency compromise
Article 8a Consent through automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
For the purpose of data subject consent to the storing of personal data, or gaining of access to personal data already stored in the terminal equipment of a natural person in accordance with Directive 2002/58/EC, controllers shall ensure that their online interfaces allow data subjects to:
Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;
refuse a request for consent or exercise the right to object pursuant to Article 21(2) through automated and machine-readable means;
withdraw consent through automated and machine-readable means.
Controllers shall respect automated and machine-readable means expressing the choices made by data subjects in accordance with paragraph 1.
Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.
The Commission shall request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices, subject to consultation, in accordance with Article 10 of Regulation (EU) 1025/2012. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.
Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall provide the technical means to allow data subjects to give their consent, to withdraw consent, and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 4 of this Article.
Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].
Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces. (…)
Competing proposals
European Parliament amendments
These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.
No Parliament amendment is mapped to these tracked parts.
Selected texts
Compare wording
Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.
Select a specific tracked part above to compare wording.
No same-scope comparison is available for this tracked part. Its source wording remains available in the article text sections.