Since the implementation of the EU’s General Data Protection Regulation (“GDPR”), there has been an ongoing debate in the European Union (“EU”) as to whether the use of cookies required what is commonly known as “Active Consent.”
On Tuesday, October 1st, the EU Court of Justice released the transcript of a judgment explicitly stating that using a pre-ticked box to gain consent to track cookies is an insufficient mechanism to obtain active consent. EU Data Protection Authorities had not provided guidance whether “continued browsing, clicking, or scrolling the web page” was a sufficient action to claim consent. This judgment provides formal clarity on this issue for businesses subject to GDPR.
The case that led to this judgment involved Planet49, an online promotions company, which utilized a pre-checked box to obtain authorization to use cookies to track individuals who enrolled in online promotional games. Planet49 would then use the data derived from the pre-checked box to send marketing messages to these users. Ultimately, the European Court of Justice determined that this pre-ticked box was not a legally valid method of collecting consent. Going forward, if a business subject to GDPR utilizes the “checked box” method, consumers will have to affirmatively check the box if they consent to the collection of cookies.
The Planet49 case pre-dated the GDPR, which explicitly stated in its Recital 32 that silence, pre-ticked boxes or inactivity does not constitute consent. While the European Court of Justice’s interpretation of the law should not come as a surprise to those in the EU, it will certainly require businesses previously relying on implicit consent to make changes to their cookie policies, operations, and online statements. Additionally, the ruling requires entities collecting cookies to inform users how long the cookies will be in operation and whether third parties will have access to the cookies.
This case signals another win for consumer protection groups in the EU and adds clarity to a sensitive and previously unclear issue.
