by Ruth Prendeville October-15-2019 in Advertising and Marketing Law, Commercial & Business, Data Protection

The Court of Justice of the European Union (“CJEU”) delivered its eagerly anticipated judgment in the Planet49 case on 1 October 2019,1 finding that collecting users’ permission to place cookies on their devices through the use of pre-ticked boxes does not constitute valid consent under relevant ePrivacy and data protection legislation.

 

Facts

The case related to a promotional lottery organised by Planet49, a German online gaming company.  The lottery webpage had two boxes with an explanatory paragraph under each one.  The explanatory paragraph under the first box, which did not have a preselected tick, sought the user’s agreement to receiving marketing communications from Planet49 and its partners.  The explanatory paragraph under the second box, which had a preselected tick, essentially stated that the user agreed to the setting of cookies on their device for behavioural advertising purposes.  Participation in the lottery was possible only if at least the first box was ticked. 

The reference to the CJEU arose from proceedings issued in the German courts by the Federation of Consumer Organisations against Planet49 seeking to restrain the practices outlined above on the basis that they did not comply with relevant German ePrivacy, consumer and competition laws.

 

Do pre-ticked boxes constitute valid consent to cookies?

In holding that reliance on pre-ticked boxes does not constitute valid consent to the use of cookies, the CJEU’s key findings were as follows:

  • The ePrivacy Directive, which governs the use of cookies, requires users to give their consent before cookies can be dropped on their devices.  The CJEU interpreted this wording as requiring action on the part of the user, and permission given in the form of a preselected tick in a box does not imply active behaviour.  The CJEU was also of the view that the mechanism does not reach the threshold of a “statement or clear affirmative action” as required by the General Data Protection Regulation (“GDPR”).

  • In reaching its decision, the CJEU had regard to Recital 17 of the ePrivacy Directive, which gives the example of ticking a box when visiting an internet website as an appropriate method enabling a freely given, specific and informed indication of the user’s wishes.  It also took account of Recital 32 of the GDPR, which expressly precludes “silence, pre-ticked boxes or inactivity” from being taken to constitute consent.

  • In light of the legal requirement that a consent request must specifically cover all purposes for which the consent is sought, the CJEU rejected Planet49’s contention that users who ticked at least one of the boxes in order to participate in the lottery could be taken to have also consented to the use of cookies.

  • The CJEU was of the view that it would be impossible to ascertain that a user had given their unambiguous and informed consent from the fact that they had refrained from deselecting a pre-ticked box.  Therefore, the CJEU considered that the cookies consent mechanism did not facilitate users in giving their unambiguous and informed consent.

 

Consent requirements and personal data

The German court also asked the CJEU whether cookie consent requirements would differ depending on whether or not the information stored or accessed by the cookies constituted personal data.  The CJEU found that they would not, noting that the ePrivacy Directive aims to protect users from interference with their private sphere, regardless of whether or not that interference involves personal data.

 

Clear and comprehensive information

The final question for the CJEU was whether the requirement under the ePrivacy Directive to provide users with “clear and comprehensive information” about cookies included informing users (i) of the duration of the operation of cookies and (ii) whether or not third parties may have access to the cookies.  The CJEU found that it did on the basis that the relevant data protection legislation requires users to be informed of the period for which their personal data will be stored, and also the recipients or categories of recipients of the data.

 

Conclusion

The Planet49 decision is an example of the CJEU applying a strict interpretation of obligations under ePrivacy and data protection legislation.  As the CJEU was limited in this case to considering the collection of cookie consent through the use of pre-ticked boxes, it remains to be seen whether it would take a similar view in a case involving other commonly used cookie consent mechanisms such as consent by scrolling or by continuing to use a service.  In the meantime, website operators should consider their cookie practices in light of the decision to ensure compliance with current requirements.

For further information, please contact Ruth Prendeville rprendeville@hayes-solicitors.ie at Hayes solicitors. 

 

1 Case-law of the Court of Justice - Case C-673/17

Read related articles: 

Back to Full News
Share this article:

About the Author

Ruth Prendeville
Ruth Prendeville

Ruth is an associate solicitor in the Commercial & Business team at Hayes solicitors. She advises on an array of commercial and regulatory matters, including in the areas of privacy and data protection, intellectual property, terms and conditions of purchase and sale, advertising and promotions and commercial contracts.  Her clients include those from key business industries including media and entertainment, advertising, motor, food, accountancy, manufacturing and business networking.