A retail website wants to drop non-essential analytics cookies for EU visitors. Which Art. 6 lawful basis is the controller relying on when it obtains valid consent before setting those cookies?
Select an answer to reveal the explanation.
Short Explanation
Non-essential tracking is like putting a tracker on someone's shopping cart—you ask first. Consent under Art. 6(1)(a) is the lawful basis when that "yes" is free, specific, informed, and clear. Industry habit or "everyone tracks" is not a basis.
Full Explanation
Article 6(1)(a) allows processing when the data subject has given consent for one or more specific purposes. Non-essential cookies and similar trackers typically require valid consent meeting the GDPR's conditions of freeness, specificity, information, and unambiguous indication. Legitimate interests may support some processing but is generally unsuitable as a sole substitute for consent to non-essential tracking, and vital interests or public task do not fit ordinary commercial analytics.