The CJEU has ruled that active consent is required from online users in order for website operators to store tracking cookies on their computers
On 1 October 2019, the Court of Justice of the European Union (‘CJEU’) ruled that active consent is required from online users in order for website operators to store tracking cookies on their computers.
The CJEU decision was issued in the Planet49 case, which concerned an online lottery service operated by Planet49 GmbH. The service required users to consent to the storage of cookies on their computers before they could access the lottery.
The E-Privacy Directive requires that the consent required for storage of cookies must be given in accordance with the standards laid down by the General Data Protection Regulation (“GDPR”), namely it must be freely given, specific, informed and unambiguous.
The main issue was that Planet49 provided users with a pre-checked consent box. It was argued that the user had not provided consent by simply clicking ‘participate’.
For those who may be unaware, cookies are small text files which are saved onto your computer by websites to save your preferences but they can also store marketing data, which can lead to targeted ads, and even track your online activity so it can be relayed back to the original website.
The Planet49 ruling has confirmed that the following do not satisfy the consent requirements of the E-Privacy Directive:
- pre-checked consent boxes;
- notifications from a website that a cookie has already been included (without express permission); and
- a cookie consent which is included as part of another service or purpose.
The CJEU stated in its judgment that a pre-checked consent box provides no indication of whether a user has actually given his/her consent or not, or if he/she has even read the necessary information or noticed the consent box at all.
Website operators must now expressly obtain consent from users as to their data being stored as a result of a cookie, and provide information as to how long the cookie will operate for and whether any third parties can access their data as a result of this. This applies whether or not the data is personal data under the GDPR.
There are significant implications for millions of websites across Europe, many of which began using pre-checked consent boxes following GDPR but do not ask for specific prior consent. This decision may restrict their ability to track users for targeted ads.
The Planet49 ruling did not rule on the legality of all the issues regarding cookie consent, for example, on ‘cookie walls’, where the website requires a user’s consent to the storage of cookies prior to access to the site. The CJEU had the opportunity to deal with the issue of ‘cookie walls’ but declined to do so. Nevertheless, the ruling will likely require changes to cookie consent notices and requirements.
As such, the Planet49 judgment provides some clarity in respect of consent and will clearly have a considerable impact on how website operators obtain ‘freely given consent’ and whether users are agreeable to providing this expressly or not.
If you have any questions or would like to discuss any aspect of this article, please contact Victoria Robertson, Partner at victoria.robertson@weightmans.com or 0141 404 9312.