‘Active’ consent required for cookie storage, CJEU rules


The storage of cookies requires active consent the Court of Justice of the European Union ruled on Tuesday. The decision came following a challenge before the German courts by the German Federation of Consumer Organisation against the use of a pre-ticked checkbox which had consented to cookies on behalf of the user by default.

The German Federal Court of Justice requested a preliminary ruling on the matter.

The Federation of German Consumer Organisations (Bundesverband) instituted court proceedings against Planet49, claiming that the latter’s declarations of consent used for the lottery did not meet the necessary requirements of informed and freely given consent. The case reached Germany’s Federal Court of Justice, which then referred the case before the CJEU, seeking guidance on the interpretation of certain provisions of the e-Privacy Directive (Directive 2002/58), the Data Protection Directive (Directive 95/46, the “DPD”), and the General Data Protection Regulation (Regulation 2016/679, the “GDPR”).

Planet49, a company registered in Germany, hosted a lottery on its website . To participate in the lottery, a participant was required to enter his name and address. Beneath the input fields for the address were two sets of checkboxes.

The first checkbox was not pre-ticked, and it was meant for the participant to consent to being contacted by certain sponsors about their commercial offers. The second checkbox was pre-ticked, and it was meant for the participant to consent to have cookies placed on his device for the purposes of providing targeted ads to the participant.

A cookie is a small piece of data sent from a website and stored on the user’s computer by the user’s web browser while the user is browsing.

In a judgement delivered on Tuesday, the Court decided that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent.

The Court observed that decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.

The Court observed that the user has to give specific consent, ‘so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it be concluded that the user validly gave his or her consent to the storage of cookies.’

A user must also be informed about the duration of the operation of cookies and whether or not third parties have access to those cookies, the Court added.