Consent Requirements Regarding Cookies (Planet49 Case) (Advocate General)

On 21 March 2019, Advocate General Szpunar ("AG") issued some clarifications about consent requirements with regard to cookies in the Planet49 case pending before the Court of Justice of the European Union (Case C-673/17, Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V.).

The facts: before hitting the participation button of a promotional online lottery organised by Planet49, the user had to enter his name and address and, beneath these fields, there were two sets of checkboxes accompanied by explanatory texts. One required the user to consent to cookies being installed on their computer (by unticking the box) while the other required the user to agree to being contacted by a certain number of firms for promotional offers (by ticking the box).

Consent is defined in Article 4(11) of the General Data Protection Regulation 2016/679 ("GDPR"), as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her". The AG, while applying Directive 2002/58/EC as amended ("e-Privacy Directive") either in conjunction with Directive 95/46/EC or with the GDPR (respectively for situations before and after the 25 May 2018), has advised regarding 'cookies checkbox', that there is no valid consent in a situation such as the case at hand "where the storage of information, or access to information already stored in the user's terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent and where consent is given not separately but at the same time as confirmation in the participation in an online lottery". Indeed, according to the AG, pre-ticked boxes do not provide a guarantee that users have read the information and have therefore given...