The Court of Justice of the European Union has ruled in Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände ?Verbraucherzentrale Bundesverband eV v Planet49 GmbH that storing cookies requires internet users’ active consent and therefore pre-ticked tick-boxes are insufficient.
A German consumer organisation had challenged the use by Planet49 of a pre-ticked checkbox. The checkbox was used in connection with online promotional games, by which internet users wishing to participate were required to consent to the storage of cookies. The cookies in question collected information to advertise Planet49’s partners’ products. The German court doubted whether a pre-filled tick box fulfilled legal requirements and referred the following questions to the CJEU:
- Is the consent referred to in Article 5 (3) and Article 2 (f) of Directive [2002/58] read in conjunction with Article 2 (h) of Directive [95/46] validly given when the storage of information or access to information stored in the user’s terminal equipment is authorised by a box ticked by default that the user must untick to refuse to give consent?
- Do Article 5 (3) and Article 2 (f) of Directive [2002/58], read in conjunction with Article 2 (h) of Directive [95/46] receive a different application depending on whether the information stored or accessed is personal data?
- In the circumstances referred to in above, is the consent referred to in Article 6 (1) (a) of Regulation [2016/679] validly given?
- What information must the service provider give the user for the clear and comprehensive information required by Article 5 (3) of Directive [2002/58]? Must that information include the duration of operation of cookies and third party access to cookies?
The CJEU ruled that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent. The fact that a user activates the promotional game participation button organised by that company does not mean that the user has validly given his or her consent to the placement of cookies. That interpretation is even more necessary in the light of the General Data Protection Regulation 2016/679/EU, which sets out a stricter definition of consent.
Whether or not the information stored or accessed on the user’s equipment is personal data is irrelevant. EU law aims to protect the user from any interference with his or her private life, including the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.
The Court noted that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.
Finally, the court ruled that the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.
