GDPR· Article 8a

For the purpose of data subject consent to the storing of personal data, or gaining of access to personal data already stored in the terminal equipment of a natural person in accordance with Directive 2002/58/EC, controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) refuse a request for consent or exercise the right to object pursuant to Article 21(2) through automated and machine-readable means; (ba) withdraw consent through automated and machine-readable means.

Controllers shall respect automated and machine-readable means expressing the choices made by data subjects in accordance with paragraph 1.

Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

The Commission shall request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices, subject to consultation, in accordance with Article 10 of Regulation (EU) 1025/2012. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall provide the technical means to allow data subjects to give their consent, to withdraw consent, and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 4 of this Article.

Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

Providers of web browsers and providers of operating systems of terminal equipment in relation to software applications operating on that terminal equipment shall not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces. (…)