Article 88b

Article 88b

Article 88b

Article 88b

Article 88b

Article 88b

Article 88b

Justification

Centralising consent at the browser level risks reinforcing the position of dominant undertakings, in some cases designated as gatekeepers under the Digital Markets Act

Article 88b

Article 88b

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

AutomatedVoluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of naturaldata personssubjects

Automated and machine-readable indicationssignals of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(1) Controllers shall ensure that their online interfaces allow data subjects to use automated and machine-readable means to express the following purposes:

(1) Controllers shall ensure that their online interfaces allow data subjects to signal, through automated and machine-readable means:

(-a) In Article 88b, paragraph 1, the folliwing point is inserted

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

(a) Give specific consent per controller and per purpose through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;the data subject’s consent for a specific controller and a specified purpose based on actively given consent by them under the conditions for consent laid down in this Regulation;

Justification

Consent needs to be informed and can therefore only be given by the data subject themself for the first time.

(a) Give consent throughfor automatedall andor machine-readablesome means,of the purposes requested by controllers provided that the conditions for consent laid down in this Regulation are fulfilled;

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Give, reject and withdraw consent through automated and machine-readable means, provided that such means allow specific and informed choices;

(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(b) declinethe refusal to give a request forrequested consent and the exercise the right to object pursuant to Article 21(1), Article 21(2) through automated, and machine-readableArticle means.21(5);

Justification

Important to cover all options under Article 21, including the already existing 21(5) on automated exercise of the right to object.

(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(b) decline a request for consent and, exercise the rightrights to withdraw consent pursuant to Article 7(3) and to object pursuant to Article 21(2) through automated and machine-readable means.

(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

(ba) In Article 88b, paragraph 1, the following point ba is inserted

(ba) In Article 88b, paragraph 1, the following point ba is inserted

(ba) In Article 88b, paragraph 1, the following point ba is inserted

(ba) In Article 88b, paragraph 1, the following point ba is inserted

(bc) In Article 88b, paragraph 1, the following point is inserted

(be) In Article 88b, paragraph 1, the following point is added

(1a) In Article 88b, the following paragraph 1a is inserted:

Justification

cross-device consent

(1b) In Article 88b, the following paragraph 1b is inserted:

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

(2) Controllers shall respect the choices made by data subjects or authorized third-party provider of software or agents conveying choices on their behalf in accordance with paragraph 1. Where the data subject or authorized third-party agent acting on their behalf signals a refusal, withdrawal or objection pursuant to paragraph 1, the controler shall not request consent for the same purpose for a least a year.

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.The signals in accordance with paragraph 1 shall be legally valid and be binding on, and enforceable against, the controller and any other party. Controllers shall not make requests for consent for the same purpose through different means. Controllers shall not override the choice made through automated and machine-readable means unless the data subject explicitly requests it.

Justification

Wording from the EP mandate on the ePrivacy Reform in 2017

(2) Controllers shall disclose the purposes for which they request consent or where a data subject can object through automated and machine-readable means and respect the choices made by data subjects in accordance with paragraph 1 and 6.

(2a) In Article 88b, the following paragraph is inserted:

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Justification

No exemptions for media services.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Justification

No black/white exemption, but exemption from the need to have consent in the first place in Art. 88a (now moved to ePrivacy) for audience measurement.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service and comply with Article 6 of Regulation (EU) 2024/1083. Controllers that are media service providers providing news and current affairs content pursuant to Article 6 (3) of Regulation (EU) 2024/1083 shall have the right to have their online interfaces included in recommended choices, such as whitelists, maintained by web browsers and providers of operating systems.

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. This exemption extends to all processing carried out by or on behalf of a media service provider in connection with the provision of the media service.

(3a) In Article 88b, the following paragraph is inserted:

(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. The European standardisation organisations shall, where appropriate, take into account existing international standards developed by international standardisation organisations, as well as emerging technical specifications developed by relevant industry consortia. When drawing up the standardisation mandate, the Commission shall consult the European Data Protection Board and an advisory forum comprising representatives of controllers, data subjects, media service providers, consumer protection organisations, academia and civil society to ensure that standards reflect diverse perspectives and do not create new gatekeepers

TheBy [OP: insert the date: 6 months after entry into force of this amending Regulation], the Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to, within one year after receiving the request, draft standards for the interpretation of machine-readable indications of data subjects’ choices. The standards shall allow for the providers of the technical means and controllers to comply with this Article. When preparing the standardisation request, the Commission shall consult the European Data Protection Board and the European Data Protection Supervisor.

The Commission shallmay, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. It shall make such a request within 3 months from the coming into force of this regulation for websites and web browsers. The standardization organization shall ensure that consumers and data subjects are represented in the standardization process.

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Technical specifications for machine-readable indications of choices shall be open, royalty-free, interoperable, publicly documented and independently verifiable. They shall be developed with the substantial involvement of the European Data Protection Board, national supervisory authorities, consumer organisations, SMEs and open-source software providers. Compliance with a standard shall not give rise to a presumption that the underlying processing is lawful.

Justification

Machine-readable choices can reduce the number of cookie banners that appear. However, they must not generate blanket, pre-set or platform-derived consent, nor establish a proprietary default setting.

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft harmonised standards for the technical specifications, interoperable protocols, and interpretation of the automated and machine-readable indications of data subjects’ choices.

Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Justification

Moved to new paragraph 4b to also cover common specifications as per 4a.

(4a) In Article 88b, the following paragraph is inserted:

Justification

modeled after Article 41 AI Act

(4b) In Article 88b, the following paragraph is inserted:

Justification

moved here from paragraph 4 last sub-paragraph, so it also covers common specifications as per paragraph 4a (new)

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Paragraphs 1 and 2 shall apply 12 months following the publication of the standards or the common specifications pursuant to paragraph 4 or 4a.

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Providers of web browsers and operating systems shall: a) provide the technical means to allow data subjects to give their consent, refuse or withdraw a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article; b) ensure that their technical infrastructure allows authorized third-party software or agent providers to act on behalf of the data subject, while data subjects, upon their first use, shall be prompted to select the use of such software in online interfaces; c) not restrict, deny or degrade access or functionality to a service for any privacy-enhancing software, such as a Virtual Private Network, automated configurations, browser extensions or other technology designed to protect the confidentiality of their communication or of their terminal equipment, provided that such technologies comply with technical specifications established by the harmonised standards pursuant to paragraph 4; d) allow data subjects to import recommended choices, such as whitelists, to the technical means allowing choices, while data subjects, upon their first use, shall be prompted to allow an exception for independent media service providers pursuant to paragraph 3. e) not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces, including in relation to software applications operating on that terminal equipment.

(6) Providers of web browsers, whichapplications areand notoperating SMEs,systems shall provide the technical means to allow data subjects to give their consent for specific controllers and specified purposes, to refuse a request for consent, to withdraw consent, and to exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. Nothing in this paragraph shall preclude a provider of a web browser, an application, or an operating system from configuring the technical means referred to in this paragraph to convey, by default, a refusal of consent and an exercise of the right to object referred to in point (b) of paragraph 1, in line with the requirements of Article 24(4).

Justification

Necessary to expand the obligation to any software that allows using information society services.

(6) ProvidersRules set out in this Regulation should support the emergence of webmarket-driven browsers,solutions whichwith areappropriate notinterfaces SMEs, shallthat provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article,and shall provide the technical means to allow media service providers to effectively use the exception pursuant to paragraph 3, as applied pursuant to paragraphs 2 to 5 of this Articlearticle. The technical means should allow for granular choices, including category-based or purpose-based preferences, and shall enable data subjects to override global settings at the service level.

(6) Providers of web browsers, which are not SMEs, shall providemake available, without imposing them by default, the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. This paragraph is without prejudice to the possibility for controllers to obtain explicit consent by other means and shall be applied in accordance with the principle of technological neutrality.

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Providers of software to access online interfaces shall provide third-party consent management software to manage the choices referred to in paragraph 1 on behalf of data subjects within 3 months of any standard under paragraph 4 being adopted. Third-party consent management software shall not have any commercial interest in the choices of the data subject and provide a neutral interface. Automated choices by a consent management software shall be deemed valid under this Regulation.

(6) Providers of web browsers and providers of functionally equivalent software, whichsuch areas notoperating SMEssystems for mobile devices or connected TV devices, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Justification

This is a linguistic clarification to include in the regulation operating systems for mobile devices such as smartphones and tablets, and for smart TVs, which all have functionalities that are similar to those of web browsers.

(6a) In Article 88b, the following paragraph is inserted:

Justification

Unbundling for browser, app or operating system providers that qualify as gatekeepers under the Digital Markets Act.

(6b) In Article 88b, the following paragraph is inserted:

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].please insert the date = 12 months following publication of the standards or the common specifications pursuant to paragraph 4 and 4a].

(7) Paragraph 6 shall apply from [OP: please insert the date = 4824 months following the date of entry into force of this Regulation].

(7a) In Article 88b, the following paragraph is added:

(7a) In Article 88b, the following paragrpah is added