Data Protection Law: Active Consent Required for Advertising Cookies

In its ruling of October 1, 2019, the European Court of Justice (ECJ) ruled in Case C-673/17 ("Planet49") that a website operator cannot obtain effective consent to the storage of cookies by means of an activated tick in a checkbox.

Background

The subject of the proceedings, in which the Federal Court of Justice had requested the ECJ to interpret Union law on the protection of privacy in electronic communications, was an online competition for advertising purposes of the German Planet49 GmbH. Internet users who wanted to participate should declare their consent to the storage of cookies by being presented with a corresponding checkbox with an activated tick. The cookies set were used to collect information for advertising purposes for products of Planet49 GmbH's partners.

The German Federal Association of Consumer Associations (“Bundesverband der Verbraucherverbände”) considered this to be a violation of several data protection provisions.

Decision

The ECJ has ruled that the so-called opt-out procedure in connection with the storage of cookies set for advertising purposes is not sufficient and thus follows the conclusions of the Advocate General of March 21, 2019. The possibility of merely "deselecting" consent is therefore not sufficient to comply with the strict requirements of Union law. In this context, it makes no difference whether the information stored or retrieved in the website visitor's device is personal data or not. According to the European Court of Justice, Union law is intended to protect website visitors from any invasion of their privacy, in particular against the risk that "hidden identifiers" or similar instruments penetrate their device in order to gain access to information or trace user activity.

In addition, consent must be given for the specific case and the website operator must provide detailed information on the duration of the function and the access options of third parties with regard to cookies. The activation of the button for participation in the contested competition therefore does not constitute the participant's effective consent to the storage of cookies.

Comments

The decision stipulates very far-reaching obligations for website operators. Specifically, the decision of the ECJ exclusively concerns cookies for advertising purposes, but not those that are necessary for the proper operation of the site as such. Technically necessary cookies, without which a website could not be displayed at all, are not affected. A requirement for consent is therefore still not apparent.

In view of the fact that tracking and advertising cookies are becoming increasingly important in the field of online marketing, however, the decision has very far-reaching consequences for the practice of website operators: Anyone who incorporates cookies into their website for advertising purposes must obtain the active consent of website visitors by means of an opt-in procedure. As a rule, this will take place by means of a cookie banner, in which the various cookies must be specified in detail. In contrast, an activated checkbox does not imply the required active behavior. Cookie banners which "assume" the consent of the website visitor for further surfing are thus history, as are solutions in which cookies are used and the user is only given an opportunity to object - even if measures such as IP anonymization are used.

Furthermore, within the required data protection information, precise indications must be provided on the duration of the cookies' function and on whether third parties can gain access to the cookies. This applies regardless of whether the information stored or retrieved in the user's terminal device of a website is personal data within the meaning of the General Data Protection Regulation (GDPR) or not. Overall, this means that information about the cookies used must be much more detailed than was previously the case.

For many website operators, the decision of the ECJ not only entails a considerable changeover effort, but also makes marketing activities based on tracking measures considerably more difficult. This is certainly also to be understood as a politically intended decision. However, now that the authorities have started to impose painful fines when enforcing the GDPR, there is no alternative but to adapt to the new legal situation.