Consent to data collection: privacy policies and data collection notices

Abstract

Objective: The General Data Protection Law, approved in Brazil, establishes restrictions on the privacy of online information that can be used to identify individuals, in w hich consent to data collection emerges as a determination to protect privacy. In this scenario, this article aims to analyze the practices of providing user consent in relation to data collection. Method: The methodology consisted of exploratory qualitative research; documentary research through legal document analysis of law s and regulations in order to identify and describe how w ebsites implement practices for obtaining user consent in relation to data collection. The approach adopted w as multi-case research used to study the 10 most accessed e-commerce sites in March 2022, according to the E-commerce Brasil ranking. To analyze the practices adopted by w ebsites, look for the guidelines proposed in the General Data Protection Law approved in Brazil. The collection w as carried out in April 2022. Result: It w as observed that 6 (six) of the w ebsites analyzed obtain consent for data collection through cookie notices, predominantly brief messages, mentioning only the improvement of user experience and a link to the priv acy policy and w ithout offering customization options, making it difficult to fully understand the data collection. Conclusions: Informed consent on w ebsites, influenced by data protection regulations such as GDPR in Europe and LGPD in Brazil, has been addressed mainly through cookie notices, often limited to a simple OK or OK button. I agree, resulting in deficiencies in explaining the types of cookies and configuration options. These gaps can generate a false sense of control on the part of users and pose risks to privacy protection.