COURT OF JUSTICE OF THE EUROPEAN UNION RULES ON COOKIE CONSENT

On 1 October 2019 the Court of Justice of the European Union (‘CJEU’) published its judgment in the Planet49 case. The background of the case is that Planet49 ran a promotional lottery on its website. While entering the lottery, users were presented with two tick-boxes. The first was an unchecked tick-box to receive third party advertising. In order to enter the competition, users needed to tick such box. The second was a pre-ticked box allowing Planet49 to set cookies to track the user’s behaviour online.

The judgment was analysing the standard of transparency and the consent to cookies and similar technologies. The main findings of the CJEU decision are on one hand that pre-ticked check-boxes authorising the use of cookies (and similar technologies) do not constitute a valid consent. Valid consent requires “an active behaviour with a clear view” to giving consent. In addition, to get a valid consent, website operators must identify (i) whether third parties have access to cookie data and (ii) the expiration date of cookies (while disclosing third parties is quite common, disclosing the expiration date of cookies is rare in practice). It was also stated that different purposes should not be bundled under the same consent. Finally, it does not matter whether the cookies process personal data or not. Unambiguous consent is needed either way.

It can be stated that the CJEU’s findings are largely unsurprising, website operators should review their cookie notice to ensure GDPR standard consent is obtained and they should also reconsider their practice to make sure it complies also with the regulatory requirements.