The CJEU has ruled that storing cookies requires internet users’ specific active consent and that pre-ticked tick-boxes are insufficient.
The Court of Justice of the European Union has ruled in Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände ?Verbraucherzentrale Bundesverband eV v Planet49 GmbH that storing cookies requires internet users’ active consent and therefore pre-ticked tick-boxes are insufficient.
A German consumer organisation had challenged the use by Planet49 of a pre-ticked checkbox. The checkbox was used in connection with online promotional games, by which internet users wishing to participate were required to consent to the storage of cookies. The cookies in question collected information to advertise Planet49’s partners’ products. The German court doubted whether a pre-filled tick box fulfilled legal requirements and referred the following questions to the CJEU:
Whether or not the information stored or accessed on the user’s equipment is personal data is irrelevant. EU law aims to protect the user from any interference with his or her private life, including the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.
The Court noted that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.
Finally, the court ruled that the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.