On 1 October 2019, the European Court of Justice (ECJ), sitting in Grand Chamber, recognises in the Planet49 case (C-673/17) the ineffectiveness of the pre-ticked checkbox as a declaration of consent for the installation of cookies and declares that the consent of internet users must be active and specific.
This judgment is the result of a preliminary ruling referred to the ECJ by the German Supreme Court regarding the interpretation of EU law on the protection of privacy in the electronic communications sector (Directive 2002/58/EC on privacy and electronic communications, as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 and Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data).
The German legal proceedings began following a lawsuit brought by the Federation of Consumer Organisations and Associations against Planet49, the owner of an online gaming website concerning the consent of participants in a promotional lottery organised by that company to the transfer of their personal data to the company’s sponsors and partners. Through cookies, Planet49 collected information for advertising purposes.
In the commented Judgment, the ECJ declares that “the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent”. As the General Data Protection Regulation (RGPD) indicates, the user must actively express his consent by means of a "clear affirmative action", and expressly excludes the possibility of consent in the event of "silence, pre-ticked boxes or inaction".
In addition, the ECJ states that it is irrelevant whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.
The ECJ emphasises that consent must be specific, so that the fact that a user activates the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.
Nowadays, there are many web pages that incorporate the warning of the installation of cookies with the box pre-checked, as well as the sites that warn the user that "if you keep surfing, you accept the use of cookies". In the light of the ruling of the ECJ that we have analysed, there are no doubts that all these practices are contrary to the law of the Union.