Beware Cookie Law
Websites that use cookies to track users and their interactions will have to pay close attention to the recent case of Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV (the ‘Federation’) v Planet49 GmbH (‘Planet49’) Case C‑673/17, 1 October 2019, which clarifies the indication the user must provide as to their consent to the use of cookies.
Planet49 organised a promotional lottery accessed via a website. If users wished to take part in this competition, users were required to enter personal details such as their name and postcode on the website. The user was also presented with two boxes to check. The first box one was unchecked and required the user to check it to enter the competition, this would also allow certain sponsors and corporate partners to contact the user. The second box was pre-checked and if this approval were not removed it would allow multichannel retargeting company Remintrex to evaluate the user’s use and behaviour through the use of cookies.
With reference to EU Directives 95/46 and 2002/58, the court was asked to provide a preliminary ruling as to whether “the consent referred to in those provisions is validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent”. Additionally, the court was asked to consider EU Regulation 2016/679, (the ‘GDPR’), on a ratione temporis basis, as the German Court previously stated that it may be applicable to the main proceedings.
Recital 17 of Directive 2002/58, provides examples of a user’s consent being validly given, for example, ‘by ticking a box when visiting an internet website’. EU Directive 95/46 Article 2(h) then specifies the user’s consent as ‘any freely given specific and informed indication of his wishes, and as per Article 7, the consent must be given unambiguously.’ In this instance the court determined that “only active behaviour on the part of the data subject with a view to giving his or her consent may fulfil that requirement.” After the entering into force of the GDPR, the data subject’s consent has been defined further in Article 6(1)(a) as requiring a ‘freely given, specific, informed and unambiguous” indication of the subject’s consent, and Recital 32 precludes “silence, pre-ticked boxes or inactivity” from constituting consent.
As a result of the court’s ruling, a website using a pre-checked box to act as consent to the use of cookies on the user’s terminal before 25 May 2018 would be in breach of EU Directive 95/46; as of 25 May 2018, Directive 95/46 has been repealed and replaced by the GDPR meaning that any breach after this date would be a breach of the GDPR rather than the Directive.
Interestingly, what the court was not asked to give an opinion on was whether the user’s consent was ‘freely given’ as set out by Article 2(h) of EU Directive 95/46, and Articles 4(11) and 6(1)(a) of the GDPR. The very important question still remains as to whether consent is freely given if the user must allow the use of cookies to enter the competition, or in a wider context, to enter a website.
© 2019 Whitestone Chambers