The Way The Cookie Crumbles: CJEU Clarifies European Data Protection Rules For The Use Of Cookies

On October 1, 2019, the Court of Justice of the European Union (CJEU) issued a decision outlining the requirements for a user to consent to a service provider's use of cookies.1, The Court held that active consent is required, and thus requiring a user to deselect a pre-checked tracking cookie notice in order to disallow the use of cookies does not sufficiently constitute consent to the collection and use of data under EU law.

The Case

In 2013, a German firm, Planet49, organized a promotional online lottery. In order to participate, users had to provide their contact information. Underneath the contact information input form, users were shown two checkboxes stipulating the users' consent to (i) Planet49 sharing the users' data with their advertising partners and (ii) Planet49 setting cookies to trace and evaluate the users' behavior on websites of their advertising partners. In order to participate in the lottery, users had to at least tick the first checkbox and permit Planet49 to share their contact information with its advertising partners. The second checkbox allowing Planet49 to set tracking cookies was pre-checked, but could be unchecked without an impact on the users' participation in the lottery. However, in order for the user to deny consent to the service provider's use of cookies, the user had to manually uncheck the second box.

A German consumer protection organization brought an action challenging this practice before the Frankfurt Regional Court. The Regional Court granted an injunction against Planet49, holding that the use of the first checkbox violated German laws on unacceptable telephone advertising (which require the target's specific consent to a given event, rather than the target's broad consent to the innumerable cases that the box covered), while the second checkbox regarding the use of cookies did not provide the user with sufficient information to provide informed consent. The Higher Regional Court of Frankfurt overturned this decision on appeal. It held that the plea for an injunction was unfounded because it was clear to users that they could deselect the box and because the information provided on the website was sufficient. On further appeal, the German Federal Court of Justice voiced doubts concerning the interpretation of EU data protection rules regarding consent to the collection and use of data and referred the case to the CJEU for a preliminary ruling.

The CJEU was asked to decide, in particular, whether a user could give valid consent to the use of cookies merely by not unchecking a pre-checked tick-box. Since the last hearing before the referring court was on July 14, 2017 - a few months before the General Data Protection Regulation (GDPR)2 came into force - it was unclear whether the new rules should be taken into account when answering the German court's questions.

The Decision

As the proceedings concerned an order to refrain from future behavior, the Court decided to take into consideration both the pre-GDPR Directive 95/463 (along with "ePrivacy Directive" 2002/584 and "Cookie Directive" 2009/1365) and the GDPR.

1. Active consent (opt-in vs. opt-out)

   When considering whether valid consent could be given using a pre-checked box, the Court...