CJEU rules out opt out consent for cookies

Planet49 GmbH v Bundesverban der Vebraucherzentralen

The question

Can you use pre-ticked boxes for cookie consent? 

The key takeaway

The recent judgment in Planet49 GmbH v Bundesverband der Verbraucherzentralen has important implications for online businesses. Previously, when website users were asked if they consented to the cookies on a site, if a pre-ticked box was offered and the user did not object, this passed for consent. 

However, the recent judgment in the Planet49 case runs counter to this. As per Article 13 of the GDPR, consent must be “freely given, specific, informed and unambiguous” and according to the CJEU, pre-ticked boxes cannot fall under this definition. 

The relevant provisions

The following key sections were referred to and developed in this case:

• Directive 95/46 – which states that ‘Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’
• Directive 2002/58
• Article 2(f) - “consent” by a user or subscriber corresponds to the data subject’s consent in Directive [95/46]
• Article 5(3) – “Member States shall ensure that the storing of information, or the gaining of access to information already stored… is only allowed on condition that the subscriber or user concerned has given his or her consent”
• GDPR (Regulation 2016/679)
• Article 6(1)(a) – “processing shall be lawful only if… the data subject has given consent”.

The background

In September 2013, German company “Planet49” ran an online lottery on one of its sites. Users of the site were “confronted” with two tick-boxes relating to the installation of cookies which had to be filled in to take part in the competition. One of these was “pre-ticked”, meaning that if the user did not object, then they could “consent” by simply clicking through. 

The Federation of Consumer Organisations in Germany brought proceedings against Planet49 in an attempt to get an injunction to have the declarations removed. The Federation argued that using such declarations could not constitute true consent. 

Following the initial action and an appeal, the Federal Court of Justice in Germany stayed proceedings and referred the below (abridged) questions to the CJEU:

• 1a)  Is valid consent (within the meaning of Article 5(3) and Article 2(f) of Directive [2002/58] read in conjunction with Article 2(h) of Directive [95/46]) permitted by way of a pre-checked box which the user must deselect to refuse their consent?
• 1b)  For the purposes of Article 5(3) and Article 2(f) of Directive [2002/58], does it make a difference whether the information stored or accessed constitutes personal data?
• 1c)  In the circumstances around 1(a), does valid consent within the meaning of Article 6(1)(a) of Regulation [2016/679] exist?
• 2)  What information does the service provider have to give within the scope of the provision of clear and comprehensive information?

The decision 

The Grand Chamber ruled as follows:

• “Consent referred to in those provisions is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent”.
• “The information that the service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies”. 

Why is this important?

The judgment in this case is unsurprising if one reads the GDPR or the ICO’s own guidance on cookies. However, it is an important reminder of the increasingly dim view authorities will take on organisations who do not enable customers to “fully consent” to how their data is being collected or used. 

Any practical tips? 

The most practical advice would be for online businesses operating in the EU to follow the judgment in the Planet49 case to get valid “freely-informed consent” from their users. 

When it comes to cookies, do not use pre-ticked checkboxes if trying to get consent. Also, be sure to provide your users with the requisite information on the duration, operation and third party access status of the cookies. 

Finally, don't forget to keep an eye on the progress of the e-Privacy Regulation. With a ban on “cookie walls” and a heightened focus on cookie consent, this will be a huge shake up for the digital ad space.