Preset consent is unlawful
09. October 2019The European Court of Justice (ECJ) has issued a far-reaching ruling on the use of cookies. In their latest ruling, the judges made it clear that no effective consent to the storage of cookies had been given by the internet user if the provider of a website employed a checkbox with a preset checkmark. Permission to set cookies would instead require the active consent of the internet user, stressed the ECJ in its ruling on October 1, 2019 (Ref.: C-673/17, Planet49).
ECJ: consent to cookies may not be preset
What does that mean in concrete terms? It means that active consent is required for the storage and retrieval of cookies on the end device of a website visitor. If the consent entails a preset marked checkbox and the default setting would have to be actively deselected by the user in order to refuse his or her consent, consent is deemed to have not been given.
This applies regardless of whether the information stored on or retrieved from the user’s device comprises personal data or not. European Union law should protect the user against any violation of privacy, in particular against the risk of “hidden identifiers” or similar instruments penetrating the user’s device.
Consent must be actively provided for the specific case
Consent must therefore be actively provided for the specific case involved. Activation of the button to participate in a competition in the case before the court would not constitute the user’s effective consent to the storage of cookies. In this context, the service provider is obliged to provide the user with information about the duration of the cookies’ functioning and the potential for third parties to access the cookies.
What has not been decided by the ECJ?
The question referred to the ECJ was not whether cookies may only be used after consent had been given. As with any data-handling situation, the setting and use of cookies can also be permitted on the basis of other legal grounds than consent. It is therefore not always necessary to ask for consent to cookies. Technically necessary cookies can continue to be integrated by means of the legitimate interest unless the interests or fundamental rights and freedoms of the person concerned predominate. For example, session and shopping basket cookies will be classified as required cookies.