EU Court of Justice Rules that Storing Cookies Requires Internet Users’ Active Consent

On October 1, 2019, the Court of Justice of the European Union (CJEU) ruled that storing cookies on an Internet user’s computer requires active consent. Consent cannot be implied or assumed and therefore a pre-ticked checkbox is insufficient.

The CJEU ruling stems from a 2013 case in which the German Federation of Consumer Organizations (GFCO) took legal action against online lottery company Planet49. Planet49’s website required customers to consent to the storage of cookies in order to participate in a promotional lottery. As part of entering the lottery, users were presented with two checkboxes. The first was an unticked check box to receive third party advertising, where users were required to tick this box to opt-in. The second was a pre-ticked box allowing Planet49 to set cookies to track the user's behavior online. The GFCO argued this practice was illegal because the authorization to set cookies did not involve explicit consent from the user.

The CJEU agreed with the GFCO in its finding that Planet49 is required to obtain active consent from its users. Consent in the form of a pre-selected checkbox does not imply active behaviour.  According to the CJEU, it would “appear impossible” to objectively ascertain whether a user has given informed consent by not deselecting a pre-ticked check-box. The user may simply have not noticed the checkbox or read its accompanying information before continuing with his or her activity on the website. Further, the CJEU held that active consent is expressly set out in EU Regulation 2016/679 and that recital 32 expressly precludes “silence, pre-ticked boxes or inactivity” from constituting consent. 

For more information, please see CJEU press release here.

Summary By: Jae S. Morris