引言
自《通用數據保護條例》（GDPR）生效以來，網站上無處不在的Cookie同意彈窗已成為互聯網用戶普遍的“Cookie疲勞”之源，同時也給企業帶來了複雜的合規挑戰和高昂的運營成本。為了應對這一問題，歐盟委員會在其“數字綜合法案提案”（Digital Omnibus Package）中，提出了引入“通用偏好設置”（universal settings-based preference mechanisms）的構想，旨在簡化用戶隱私偏好管理，並優化數據保護合規框架。本文將深入剖析這一新機制的核心內容、其對現有Cookie規則的潛在修訂，以及對中資企業可能帶來的影響和戰略啟示。
一、 歐盟“通用偏好設置”機制的核心內容
1. 提案背景與目標
歐盟委員會認識到，當前Cookie同意機制的實施效果不佳，用戶往往在不完全理解的情況下點擊“同意”，導致其數據保護權利未能得到有效行使。同時，企業在設計、部署和維護符合GDPR和ePrivacy指令的Cookie同意管理系統方面投入巨大。因此，歐盟委員會的目標是通過引入“通用偏好設置”，減輕用戶的“同意疲勞”，提高用戶隱私偏好表達的效率和一致性，並為企業提供更清晰、更簡化的合規路徑。
2. 機制運作方式
根據提案，未來的“通用偏好設置”將允許用戶通過瀏覽器、操作系統或應用程序商店等集中式技術平臺，統一表達其數據處理偏好（包括同意或拒絕）。一旦用戶在這些平臺上設置了其隱私偏好，所有網站和應用程序都將被要求尊重這些信號。相關標准制定機構將負責開發機器可讀信號的技術基准，而瀏覽器、操作系統和應用商店的制造商可能會被要求支持這些設置。在經過六個月的過渡期後，所有發布者（媒體服務提供商除外，因其廣告收入對獨立新聞至關重要）都將有義務遵守這些通用信號。
3. 對現有Cookie規則的修訂
提案還計劃對ePrivacy指令下的Cookie規則進行修訂。在某些特定情況下，例如用於聚合受眾測量和安全目的時，將不再需要用戶同意即可使用Cookie及類似技術。此外，當追蹤技術涉及個人數據處理時，GDPR的合法性基礎（而非僅僅是同意）將發揮主導作用，這意味著企業可以依據合法利益等其他合法基礎進行數據處理，從而減少對同意的依賴。
二、 對中資企業的潛在影響
歐盟“通用偏好設置”機制的推出，將對在歐盟運營或向歐盟用戶提供服務的中資企業產生深遠影響。
1. 合規策略的調整
中資企業需要重新評估其現有的Cookie同意管理系統和數據處理實踐。傳統的Cookie彈窗模式可能將逐步被淘汰，企業需轉向支持“通用偏好設置”的技術解決方案。這意味著企業需要投入資源更新其網站和應用程序，以識別並響應來自用戶瀏覽器或操作系統的統一隱私偏好信號。未能及時調整的企業將面臨合規風險和潛在的監管處罰。
2. 用戶體驗的提升與挑戰
對於用戶而言，統一的偏好設置將極大提升其隱私管理體驗，減少重複操作帶來的困擾。對於中資企業而言，這意味著用戶可能更容易拒絕不必要的追蹤，從而可能影響基於追蹤的用戶行為分析和精准營銷策略。企業需要探索新的、更注重用戶隱私的商業模式和數據分析方法，例如更多地依賴匿名化數據或上下文廣告。
3. 技術與標准對接
中資企業需要密切關注相關標准制定機構發布的技術基准，並確保其技術系統能夠與這些標准無縫對接。這可能涉及到與瀏覽器、操作系統開發商以及第三方技術服務提供商的合作，以確保其產品和服務能夠正確識別和響應用戶的通用隱私偏好。
4. 市場競爭格局的變化
新規的實施可能導致市場競爭格局的變化。那些能夠迅速適應新規、提供更透明和用戶友好隱私管理體驗的企業，將可能獲得競爭優勢。而未能有效應對的企業，則可能面臨用戶流失和品牌聲譽受損的風險。
三、 合規建議
面對歐盟“通用偏好設置”的未來趨勢，中資企業應提前規劃，積極應對。
1. 持續關注立法進展
密切跟蹤歐盟委員會“數字綜合法案提案”的立法進程，特別是關於“通用偏好設置”和ePrivacy指令修訂的最終文本。了解具體實施時間表和技術要求，以便及時調整合規策略。
2. 評估現有數據處理實踐
對當前的數據收集、使用和共享實踐進行全面審計，特別是涉及Cookie和追蹤技術的部分。識別哪些數據處理活動依賴於用戶同意，並評估在“通用偏好設置”下，這些活動是否仍能獲得合法性基礎。
3. 投資技術升級與改造
提前規劃並投入資源，對網站、應用程序和後端系統進行技術升級，使其能夠識別、接收並遵守用戶的“通用偏好設置”信號。這可能包括集成新的同意管理平臺（CMP）或開發內部解決方案。
4. 優化用戶隱私體驗
重新設計用戶界面，以更清晰、透明的方式向用戶解釋數據處理活動，並提供簡便的隱私偏好管理選項。即使在“通用偏好設置”下，良好的用戶隱私體驗仍是建立用戶信任和提升品牌形象的關鍵。
5. 探索替代數據策略
減少對第三方Cookie和精准營銷的過度依賴，探索使用第一方數據、匿名化數據、聚合數據或上下文廣告等替代策略，以在尊重用戶隱私的前提下實現商業目標。
6. 加強內部培訓與治理
對內部團隊（包括法務、技術、市場等部門）進行GDPR新規和“通用偏好設置”的培訓，確保所有員工理解並遵守新的合規要求。建立健全的數據治理框架，明確數據處理責任和流程。
結論
歐盟委員會提出的“通用偏好設置”機制，是應對“Cookie疲勞”和優化數字隱私管理的重要一步。它預示著一個更加用戶中心、更高效的隱私偏好管理時代的到來。對於中資企業而言，這既是挑戰也是機遇。通過提前布局、積極調整合規策略、投資技術升級並優化用戶體驗，中資企業不僅能夠有效應對新的監管要求，還能在日益重視隱私保護的數字市場中，贏得用戶的信任和競爭優勢。告別煩人的Cookie彈窗，迎接更智能、更尊重的數字未來，需要所有市場參與者的共同努力和適應。
GDPR Revision Outlook (III): Bidding Farewell to Cookie Banner Fatigue? EU Proposes “Universal Preference Settings”
Introduction
Since the General Data Protection Regulation (GDPR) came into effect, the ubiquitous cookie consent banners on websites have become a common source of “cookie fatigue” for internet users, while also bringing complex compliance challenges and high operating costs for businesses. To address this issue, the European Commission, in its “Digital Omnibus Package” proposal, has put forward the idea of introducing “universal settings-based preference mechanisms” aimed at simplifying user privacy preference management and optimizing the data protection compliance framework. This article will delve into the core content of this new mechanism, its potential revisions to existing cookie rules, and the possible impacts and strategic implications for Chinese-funded enterprises.
I. Core Content of the EU’s “Universal Preference Settings” Mechanism
1. Background and Objectives of the Proposal
The European Commission recognizes that the current cookie consent mechanism is ineffective, with users often clicking “agree” without full understanding, leading to their data protection rights not being effectively exercised. At the same time, businesses invest heavily in designing, deploying, and maintaining cookie consent management systems that comply with GDPR and the ePrivacy Directive. Therefore, the European Commission’s goal is to alleviate user “consent fatigue,” improve the efficiency and consistency of user privacy preference expression, and provide a clearer, simpler compliance path for businesses through the introduction of “universal preference settings”.
2. How the Mechanism Works
According to the proposal, future “universal preference settings” will allow users to uniformly express their data processing preferences (including consent or objection) through centralized technical platforms such as browsers, operating systems, or app stores. Once users set their privacy preferences on these platforms, all websites and applications will be required to respect these signals. Relevant standards bodies will be responsible for developing technical benchmarks for machine-readable signals, and manufacturers of browsers, operating systems, and app stores may be required to support these settings. After a six-month grace period, all publishers (with the exception of media service providers, whose advertising revenue is indispensable for independent journalism) will be obliged to comply with these universal signals.
3. Revisions to Existing Cookie Rules
The proposal also plans to revise the cookie rules under the ePrivacy Directive. In certain specific circumstances, such as when used for aggregated audience measurement and security purposes, user consent will no longer be required for the use of cookies and similar technologies. Furthermore, when tracking technology involves the processing of personal data, the lawful basis under GDPR (rather than just consent) will take precedence, meaning businesses can process data based on other lawful bases, such as legitimate interests, thereby reducing reliance on consent.
II. Potential Impact on Chinese-funded Enterprises
The introduction of the EU’s “universal preference settings” mechanism will have a profound impact on Chinese-funded enterprises operating in the EU or providing services to EU users.
1. Adjustment of Compliance Strategies
Chinese-funded enterprises need to re-evaluate their existing cookie consent management systems and data processing practices. The traditional cookie banner model may gradually be phased out, and enterprises will need to shift towards technical solutions that support “universal preference settings.” This means that enterprises will need to invest resources to update their websites and applications to identify and respond to unified privacy preference signals from users’ browsers or operating systems. Enterprises that fail to adjust in a timely manner will face compliance risks and potential regulatory penalties.
2. Improvement and Challenges in User Experience
For users, unified preference settings will greatly enhance their privacy management experience, reducing the hassle of repetitive operations. For Chinese-funded enterprises, this means that users may be more likely to refuse unnecessary tracking, which could affect user behavior analysis and precise marketing strategies based on tracking. Enterprises need to explore new business models and data analysis methods that are more privacy-centric, such as relying more on anonymized data or contextual advertising.
3. Technical and Standard Alignment
Chinese-funded enterprises need to closely monitor the technical benchmarks released by relevant standards bodies and ensure that their technical systems can seamlessly align with these standards. This may involve cooperation with browser and operating system developers, as well as third-party technical service providers, to ensure that their products and services can correctly identify and respond to users’ universal privacy preferences.
4. Changes in Market Competition Landscape
The implementation of new regulations may lead to changes in the market competition landscape. Enterprises that can quickly adapt to the new regulations and provide more transparent and user-friendly privacy management experiences may gain a competitive advantage. Enterprises that fail to respond effectively may face the risk of user loss and damage to brand reputation.
III. Compliance Recommendations
Facing the future trend of EU “universal preference settings,” Chinese-funded enterprises should plan ahead and actively respond.
1. Continuously Monitor Legislative Progress
Closely track the legislative process of the European Commission’s “Digital Omnibus Package” proposal, especially the final text regarding “universal preference settings” and revisions to the ePrivacy Directive. Understand the specific implementation timeline and technical requirements to adjust compliance strategies in a timely manner.
2. Evaluate Existing Data Processing Practices
Conduct a comprehensive audit of current data collection, use, and sharing practices, especially those involving cookies and tracking technologies. Identify which data processing activities rely on user consent and assess whether these activities can still have a lawful basis under “universal preference settings.”
3. Invest in Technology Upgrades and Transformation
Plan ahead and invest resources in upgrading websites, applications, and backend systems to enable them to identify, receive, and comply with users’ “universal preference settings” signals. This may include integrating new Consent Management Platforms (CMPs) or developing internal solutions.
4. Optimize User Privacy Experience
Redesign user interfaces to explain data processing activities to users in a clearer and more transparent manner, and provide simple privacy preference management options. Even under “universal preference settings,” a good user privacy experience remains key to building user trust and enhancing brand image.
5. Explore Alternative Data Strategies
Reduce over-reliance on third-party cookies and precise marketing, and explore alternative strategies such as using first-party data, anonymized data, aggregated data, or contextual advertising to achieve business goals while respecting user privacy.
6. Strengthen Internal Training and Governance
Provide training on new GDPR regulations and “universal preference settings” to internal teams (including legal, technical, and marketing departments) to ensure that all employees understand and comply with the new compliance requirements. Establish a sound data governance framework that clarifies data processing responsibilities and processes.
Conclusion
The “universal preference settings” mechanism proposed by the European Commission is an important step in addressing “cookie fatigue” and optimizing digital privacy management. It heralds a more user-centric and efficient era of privacy preference management. For Chinese-funded enterprises, this is both a challenge and an opportunity. By planning ahead, actively adjusting compliance strategies, investing in technology upgrades, and optimizing user experience, Chinese-funded enterprises can not only effectively respond to new regulatory requirements but also gain user trust and a competitive advantage in a digital market that increasingly values privacy protection. Bidding farewell to annoying cookie banners and embracing a smarter, more respectful digital future requires the joint efforts and adaptation of all market participants.
聲明
本文僅為交流探討之目的，不代表廣悅律師事務所或其律師出具的任何形式之法律意見或建議。如需轉載或引用本文的任何內容，請與本所溝通授權事宜，並於轉載或引用時注明出處。如您有意就相關業務進一步交流或探討，或需要專業的法律支持，歡迎與本所聯系。
聯系人：葉文女士
期待與您的進一步交流！
廣悅律師事務所介紹
廣悅律師事務所成立於2008年，是一家立足大灣區，堅持一體化管理的涉外綜合性律師事務所。發展至今，廣悅建立了由上百位律師及其他法律服務人員組成的專業團隊，打造了多元化的業務體系，可以為客戶提供高品質、全方位、一站式的法律服務。秉承“立足灣區、協同港澳、面向世界”的發展戰略，廣悅已擁有廣州、中國香港、深圳，以及泰國曼穀、美國洛杉磯、澳大利亞悉尼、日本東京、意大利米蘭八個辦公室，客戶遍及境內外多個國家和地區。
供稿丨廣悅米蘭辦公室
編輯丨吳寶渲
審核丨蘇 冰
審定丨品牌宣傳與市場拓展委
