Today October 1st, the Court of Justice in the European Union confirmed: Storing cookies requires internet users’ active consent.
The verdict against Planet49
The CJEU (Court of Justice of the European Union) in its judgment in the highly anticipated case against German lottery business Planet49 GmbH confirms:
Case C-673/17 against Planet49 GmbH
“the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent.”
This is regardless of whether or not the data collected can be considered the user’s personal data.
This means, that when websites ask for users’ consent to cookies, the tick-boxes for specific cookie purposes (e.g. functional, statistic, marketing cookies) may not be pre-ticked in favor of data collection.
The CJEU is clear on that topic: pre-ticked boxes in cookie pop-ups are not considered consent.
ePrivacy to protect internet users’ online privacy
The ruling today aims to protect citizens’ online privacy, in particular from the risk that their data and personal data is collected and processed without their knowledge and consent.
“Users must actively choose
that cookies may collect their data:
not deselect pre-ticked boxes”
The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.
The Court of Justice of the European Union has clearly confirmed the fundamental elements of valid cookie consent. Consent must be:
- informed (including, duration of the operation of cookies and whether or not third parties may have access to those cookies);
- an affirmative action (no opt-out); specific (not coupled with other manifestations of user will, e.g., to participate in a promotional lottery);
- and its application regardless of whether or not the user’s information which is accessed and/or stored can be considered personal data.
How to ensure your cookie consent pop-up collects valid consent
To collect an active – and valid – cookie consent, you must ensure that your cookie consent pop-up is set to:
- Investigate which cookies your website uses
- Collect and store your website users’ cookie consent
- Ensure boxes for specific cookies are un-ticked
- Make sure users can reject cookies (being tracked)
The new verdict will apply to all European websites.
Make sure you are cookie GPDR compliant on your website:
Get A free assessment of your website's cookie compliance level
If you would like to test your website's cookie compliance, fill the form in the right sidebar. You can also use the link here:
Link: Test your website
Or you can book a meeting with our compliance experts:
Link: Book a meeting