Standard for consent: still a dream or a soon-to-be reality?


  • Nataliia Bielova


  • Armand Heslot
  • Cristiana Santos
  • Romain Robert
  • Aurélie Pols
  • Benoît Oberlé

Organisation: Inria

Room: Online 2

Timing: 10:30 - 11:45 on 28 January 2021

While users surf the Web, trackers collect their data for purposes that often require consent, according to Article 5(3) of the ePrivacy Directive. The amount of website audits, complaints and regulatory enforcement actions on consent - both from DPAs and the Court of Justice - have substantially increased. However, all these actions depend on complex manual analysis of websites that includes detection of a tracking technology; identification of a purpose of each tracking technology; analysis whether consent is required; evaluation of consent validity.

Recent guidelines by the EDPB and DPAs clarify and strengthen the rules for consent requirements and propose best practices, but the implementation of consent on websites still diverges. The panel is going to discuss the following questions:

• What are the next steps for a streamlined, auditable and scalable consent?
• How can legal and technical experts help to devise a compliant-by-design consent?
• Would standardization of consent help?
• What concrete building blocks need to be defined by policy-makers and the legislator?


Nataliia Bielova

Inria (FR)

Nataliia Bielova is a Research Scientist at Privatics team in Inria (France), where she started an interdisciplinary research in Computer Science and EU Data Protection Law. Her main research interests are measurement, detection and protection from Web tracking. She continuously collaborates with researchers in Law to understand how GDPR and ePrivacy Regulation can be enforced in Web applications, and with researchers in Design to analyze and detect dark patterns in consent collection mechanisms on the Web.


Armand Heslot


Armand Heslot has been working on privacy since 2010, both for private companies, as DPO and privacy expert, and for the French data protection agency, the CNIL. He's currently the head of the IT expert department at the CNIL, the department receiving and analyzing the data breach notifications at the CNIL. He also represents the CNIL at the Technology subgroup of the EDPB.

Cristiana Santos

Utrecht University (NL)

Cristiana Santos is a lecturer and researcher in Law and Technology at Utrecht University. Her main interests are data protection and privacy. She works on the analysis of legal and technical requirements that informs tracking technologies to enable legal compliance. She is currently working on the topics of consent, dark patterns and data subject rights.

Romain Robert


Romain Robert is a qualified lawyer specialised in technology law. He worked from 2002 to 2011 in various Brussels law firms, where he specialised in IP and ICT law. Between 2007 and 2011, he was also a researcher at the CRIDS, Research Centre in Law and Society at the University of Namur. In 2011, he joined the Belgian DPA as a legal advisor. He worked for within the Policy and Consultation Unit of the EDPS as of 2015 and then within the Secretariat of the EDPB as of May 2018. In April 2020, Romain joined noyb (None of Your Business, an NGO conducting strategic litigation to enforce digital rights).

Aurélie Pols

Mind Your Privacy (ES)

Privacy Engineer, owner of consultancy Competing on Privacy, Member of the EDPS Ethics Advisory Group and Board Member of the European Centre on Privacy and Cybersecurity (ECPC) at Maastricht University. Aurélie Pols designs data privacy best practices: documenting data flows, minimising risk related to data uses, solving for data quality. She spent 18 years optimising digital data-based decision-making processes. She co-founded and sold her start-up to Digitas LBi (Publicis). Used to following the money to optimise data trails, she follows data to minimise risks, touching upon security practices and ethical data uses.

Benoît Oberlé

Sirdata (FR)

Benoît, an entrepreneur at heart and in adtech for more than 20 years, supports the idea that precise and respectful targeting allows lower advertising pressure, increased visibility for content and improved publisher margins. He works a lot so that the use of personal data for personalized advertising relies solely on user's choice (consent and/or opposition).