Article 88a

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where processing of such data is onlycarried allowed when that person has given his or her consent,out in accordance with this Regulation and is based on one of the legal bases set out in Article 6 of this Regulation.

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).Where the processing referred to in paragraph 1 is based on legitimate interests pursuant to Article 6(1), point (f), of this Regulation (EU), the GDPR requires a balancing test to ensure that the company’s interests do not override the user’s rights and reasonable expectations, this principle should we always respect and strive to achieve the right balance.

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:The following operational data processing activities shall not require consent under paragraph 1, and may rely on other applicable legal bases under Regulation (EU) 2016/679, subject to the conditions and safeguards set out in that Regulation:

(a) carrying out the transmission of an electronic communication over an electronic communications network; such access shall be strictly limited to what is technically necessary for the sole purpose of transmitting the communication to ensure the highest level of consumer protection. Such access shall not be used for purposes unrelated to the transmission of the communication, including profiling, advertising, audience measurement, service optimisation, or the creation of behavioural or usage analytics.

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

(c) instantly creating aggregated and anonymous measurement information about the usage of an online service to measure the audience of such a service, where such measurement it is carried out by the controller of that online service solely for its own use,; is restricted to aggregated statistical counting does not enable the identification, tracking or profiling of consumers beyond what is strictly necessary for aggregated statistics and does not involve the creation of persistent identifiers, provided that the data is not combined with data from other services from the same provider or from a third party or made accessible to third parties, subject to provisions laid down in Regulation (EU) 2022/1925 or otherwise processed for purposes such as profiling, advertising, the optimisation of services beyond audience measurement, or the training of artificial intelligence systems, and provided that data subjects are given effective means to object without affecting the usability of the service.

(c) creatingmeasuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

(c) creatingmeasuring the audience of an online service as defined in Article 2(16) of Regulation 2024/1083 to create aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service or by entitled third parties jointly authorised by adverstisers or publishers, solely for itsthe ownmeasurement useof the overall market performance and subject to the safeguards laid down in Article 89(1);

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;measuring or improving the performance, security or functionality of an online service, including through testing and the creation of aggregated usage information, where such processing is carried out solely for the controller’s own use, the prevention of fraud or other risky behaviour or technical incidents

(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.maintenance or restoration of the security of a service provided by the controller and requested explicitly by the data subject provided that it is limited to what is strictly necessary for ensuring a specific security purpose or addressing concrete security vulnerabilities or incidents affecting the requested service or device. Measures under this point shall not alter the functionality of the hardware or software, or the privacy settings chosen by the consumer, unrelated to that purpose. Access shall not be used to generate persistent identifiers, behavioural profiles, or long-term activity logs, nor shall it introduce device fingerprinting, device graphing, or similar techniques enabling tracking across services or applications.

(d) maintaining or restoring the integrity or security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(d) maintaining, restoring or restoringensuring the security of a service providedor by the controller and requested by the data subject orof the terminal equipment used for the provision of such service.

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the consent shall only be valid if it is freely given, specific, informed and unambiguous, and takes the form of a statement or a clear affirmative action, in accordance with Article 4, point (11), and Article 7 of this Regulation, in accordance with Guidelines 05/2020 of the European Data Protection Board on consent. It must be as easy for the data subject to refuse or withdraw consent as it was to give consent, and any such refusal or withdrawal must be without detriment. The interface used to request, give, refuse or withdraw consent shall be designed, organised and used in accordance with Article 25 of Regulation (EU) 2022/2065 and must not deceive or manipulate the data subject or materially distort or impair his or her ability to make free and informed decisions.

(a) the data subjectconsumer shall be able to exercise their choice to refuse requests for consent or withdraw consent in ana easyconsumer-friendly, accessible,n and intelligibleeasy manner with a single-click button or equivalent means; it shall be as easy to refuse or withdraw consent as to give it;

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; When a user has refused or withdrawn consent, electronic communications service providers and third parties may not seek the user’s consent again until one year has elapsed from the date of the user’s decision for the same processing purpose.

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Cross-service tracking techniques or data reuse for incompatible purposes shall also be excluded in line with provision under Regulation (EU) 2022/1925.

New requests for consent within these periods, precludes consent from being validly granted. This paragraph also applies to the subsequent processing of personal data based on consent.