Hands off the Cookie Jar!

On 1st October 2019, the Court of Justice of the European Union (“CJEU”) delivered its judgement on the Planet49 case providing a degree of clarity on the use of cookies and the meaning of consent post-General Data Protection Regulation (“GDPR”).

The facts

Planet49 established an online lottery competition that required users to provide personal information to enter. In order to play the lottery, users had to tick two checkboxes. It was not possible to play the lottery without clicking the first checkbox and the second checkbox was pre-checked. The first was an unchecked tick-box to receive third party advertising. The second was a pre-ticked box allowing Planet49 to set cookies to track the user's behaviour online. The German Federation of Consumer Organisation sought an injunction against Planet49 on the grounds that the two checkboxes did not satisfy German law requirements. The case was subsequently referred to the CJEU.

Consent for non-essential cookies

Unsurprisingly, the CJEU confirmed (amongst other things) that storing cookies on the internet of users requires explicit and active consent. Therefore, pre-ticked boxes were deemed to indicate that valid consent was not provided on the part of the user.

The CJEU reached this decision by first looking at the e-Privacy Directive which expressly requires consent for the storage of, or access to, information stored in the user's terminal equipment. However, the e-Privacy Directive does not indicate the form that consent must take. The GDPR, on the other hand, defines consent relating to processing of personal data. It states that valid consent will be deemed if it is given freely, actively and unambiguously. Therefore, it is of no surprise that the CJEU adopted a similar approach concerning consent for cookies.

Comments

The Planet49 decision affirms what most regulators (including the ICO) have previously confirmed, i.e. active consent is required for non-essential cookies to be placed on browsers. Nevertheless, the decision by the CJEU, though expected, should serve as a timely reminder for website operators to update their cookies notices. It also sets the background for the ePrivacy Regulation, which is expected to be discussed by the European Commission in the next few weeks.

Pre-checked cookie consent boxes are not legal says top EU court.

The content above was originally posted on CMS DigitalBytes - CMS lawyers sharing comment and commentary on all things tech.