1st October 2019

This morning, the European Court of Justice (ECJ) issued a judgment concluding that pre-ticked check-boxes indicating one’s consent to the downloading of cookies, or access to them, were unlawful.

In case C‑673/17, the Court observed how Planet49 had organised a promotional online lottery.  Prior to consenting to participate in the lottery, users were faced with two checkboxes, one ticked, another unticked, with the latter regarding the user’s consent to the use of cookies.  The referral in this case arose with regard to the legality (or lack thereof) of the fact that the checkbox was pre-ticked, and also as regards the information provided regarding the cookies to which one is consenting to.

The Court assessed the notion of consent under the GDPR and the ePrivacy Directive, which clearly provide that the giving of consent must constitute a positive action.  It must necessarily be an unambiguous act, and only “active behaviour on the part of the data subject with a view to giving his or her consent may fulfil that requirement”.

Planet49 argued that by clicking the button to proceed with participation in the lottery, users were effectively consenting to the pre-ticked checkbox.  However, the Court dismissed this argument, stating that the giving of consent to different items must indeed remain separate and “specific”, and cannot form part of the same act as Planet49 attempted to imply here, as echoed by recital 43 of the GDPR.

As regards the information which must be provided in relation to such checkboxes on cookies, the Court enunciated that such information must necessarily include the duration of operation of such cookies for users to be able to make informed decision.  If third parties have access to the cookies, the identity of such parties must necessarily be disclosed, whilst if no third parties have access, then this must also be clearly noted. 

Therefore, you should ensure that on your website, any check-boxes relating to cookies are unticked when presented to your users.  Together with this checkbox, ensure that you provide adequate information regarding the lifespan of such cookies, together with information regarding third-party access thereto and recipients of such data.  The Court in this case has made it sufficiently clear that such information must be adequately comprehensive, unambiguous and not subject to interpretation when considering how technologically inept the average internet user can be.