European Court Confirms That Consent for Cookies Means Consent

On 1 October, Europe's highest court handed down its judgment on a series of questions referred to it by the German Federation of Consumer Organisations, in respect of the use of pre-ticked checkboxes for the storage of cookies by a German lottery website called Planet 49.

Following the Advocate General's earlier non-binding opinion published in March, the court concluded that:

• Valid consent cannot be obtained through the use of pre-ticked checkboxes (opt-out); consent requires a clear indication of a user's wishes (opt-in)

‍

• Consent must be specific, meaning that consent to the storage of cookies cannot be linked with consent for something else, and users must be provided with clear and comprehensible information about the operation and duration of cookies and whether third parties have access to those cookies

‍

• Consent is required regardless of whether a cookie contains personal data or not - the law aims to protect users from interference with their private lives, which extends to preventing the use of hidden identifiers that are stored on devices without their knowledge

Although the case was brought before the GDPR came into force on 25 May 2018, the court confirmed that its interpretation applied equally to the standard of consent under the GDPR and its predecessor, the Data Protection Directive. However, the court refused to consider whether consent to the processing of personal data for advertising purposes could be 'freely given', as required by both of those laws, as such question was not referred to the Court. In the context of the ICO's report into adtech and real-time bidding and the ongoing development of a new e-Privacy Regulation, this would have been helpful.

All-in-all, the judgment is unsurprising and reflects the updated guidance on the use cookies and similar technologies published by the ICO in July. Operators of websites - and apps - will need to review their existing cookie consent mechanisms to ensure that:

• Non-essential cookies are not stored on users' devices before consent has been obtained
• Clear information is provided about cookies, what they are for and how long they will be stored
• Consent requires a positive action, not deselecting a pre-ticked checkbox

Stephenson Law has worked with numerous organisations to audit their use of cookies and consent mechanisms. If you would like to discuss further, please contact us. We’re the experts in getting data on your good side. Find out more about our data protection offering here.