EU court: Using cookies requires user consent

Today October 1st, the Court of Justice in the European Union confirmed: Storing cookies requires internet users’ active consent.

The Verdict against Planet49

The CJEU (Court of Justice of the European Union) in its judgment in the highly anticipated case against German lottery business Planet49 GmbH confirms:

“the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent.”

Case C-673/17 against Planet49 GmbH

Link: Case against Planet49

This is regardless of whether or not the data collected can be considered the user’s personal data.

This means, that when websites ask for users’ consent to cookies, the tick-boxes for specific cookie purposes (e.g. functional, statistic, marketing cookies) may not be pre-ticked in favor of data collection.

The CJEU is clear on that topic: pre-ticked boxes in cookie pop-ups are not considered consent.

ePrivacy to protect internet users’ online privacy

The ruling today aims to protect citizens’ online privacy, in particular from the risk that their data and personal data is collected and processed without their knowledge and consent.

Users must actively choose
that cookies may collect their data:
not deselect pre-ticked boxes

The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.

The Court of Justice of the European Union has clearly confirmed the fundamental elements of valid cookie consent. Consent must be:

  • informed (including, duration of the operation of cookies and whether or not third parties may have access to those cookies);
  • an affirmative action (no opt-out); specific (not coupled with other manifestations of user will, e.g., to participate in a promotional lottery);
  • and its application regardless of whether or not the user’s information which is accessed and/or stored can be considered personal data.

To collect an active – and valid – cookie consent, you must ensure that your cookie consent pop-up is set to:

  • Investigate which cookies your website uses
  • Collect and store your website users’ cookie consent
  • Ensure boxes for specific cookies are un-ticked
  • Make sure users can reject cookies (being tracked)

The new verdict will apply to all European websites.

Cookie Information can help you comply with European privacy regulations. Book a meeting today to start your compliance journey.


Share on facebook
Share on twitter
Share on linkedin
Share on email

- Webinars - Webinars - Webinars - Webinars

- Webinars - Webinars - Webinars - Webinars

Where to start with cookies?

Join our webinars about compliance in the Nordics