2019-10-10:
On October 1, 2019, the judgment of the European Court of Justice in case C-673/17 (Planet49) arrived, which addresses the requirements that needs to be fulfilled for consent of cookie storing to be considered valid, according to the EU data protection regime (GDPR).
The background to the decision was the German court Bundesgerichtshof’s request for a preliminary ruling in a case where the German online gaming company Planet49 GmbH had organized a lottery through its website. In order to participate in the lottery, the user had to consider a pre-ticked checkbox which would allow the website to store cookies on the user’s device. The user had to un-tick the checkbox to refuse the storing of cookies. The question to the CJEU was whether the existence of such a pre-checked cookie box may be considered constituting valid consent in accordance with applicable EU law. Furthermore, the German court requested a clarification as to whether the service provider must provide information to the user about how long the cookies will operate and whether or not a third party will be able to access those cookies.
The response from the CJEU was that consent needs to be obtained through active behavior in order for the storing of cookies being permissible. A pre-ticked box, which has to be un-ticked in order for the user to refuse consent, does not constitute such active consent according to the Court. As to the question of whether the service provider has to provide the user with information regarding the operation time for the cookies and whether or not a third party can access those cookies, the Court held that such obligation applies. The judgment of the CJEU may be viewed as another step towards strengthened rights for the internet users and some website operators will most likely need to review their routines regarding cookies in the near future.
If you have any questions please contact Cecilia Arestad cecilia.arestad@brann.se och Aliona Saalo aliona.saalo@brann.se