Beyond the click: Informed consent in the age of cookies

Abstract

Rapid evolution of technology and the internet has enabled vast data to be exchanged amongst people. These changes have introduced extraordinary data collecting methods that also recognise traces of personal information when users browse the internet. An example of such a tracking method is a cookie. Cookies, while they serve to enhance user experience, tend to collect and store personal information of data subjects without their knowledge and consent. For this reason, they raise a question of a threat to privacy and consent of data subjects. This research report principally examines the legal sufficiency of a mere click of a button in establishing valid consent for processing of personal information, which includes the collection, storage and transmission of personal information through cookies. The Protection of Personal Information Act 4 of 2013 (the POPI Act) was enacted to give effect to the constitutional right to privacy. Thus, the POPI Act operationalises the constitutional right to privacy by providing a framework for the processing of personal information, even though its application has shortcomings related to consent and cookies. In order to interpret the POPI Act, this paper will integrate the common law and the General Data Protection Regulation 2016/679, based on the adjudicative subsidiarity doctrine, as constitutional backdrop instruments to determine the threshold for consent in the POPI Act when using cookies.