EU: Final verdict of CJEU in the cookie checkbox riddle

On 1 October 2019, the Court of Justice of the European Union (CJEU) has delivered its judgment in the Planet49 case, providing further clarity regarding the rules applicable to cookies.

Facts and questions

The case was brought to court by the Federation of German Consumer Organisations against Planet49, a company hosting a lottery on its website and including consent checkboxes for use of cookies and transfer of personal data. The website comprised two distinct checkboxes: one to obtain consent for being contacted by certain third-party sponsors, which was not pre-ticked, and the second, to obtain consent for use of web analytics cookies for the purposes of providing targeted ads to the participant, which was pre-ticked.

The case was referred to the CJEU by German Federal Court of Justice, which raised three distinct questions regarding the interpretation of the e-Privacy Directive (Directive 2002/58/EC), the Data Protection Directive (Directive 95/46/EC, the “DPD”), and the Regulation 2016/679 (the “GDPR”):

  • whether a pre-ticked checkbox constitutes valid consent under Art 5(3) of the e-Privacy Directive and the DPD;
  • if there is a difference for the purposes of the obligation to obtain consent under Art 5(3) of the e-Privacy Directive whether or not the information stored or accessed via cookies constitute personal data; and
  • what information must be provided so that the consent is given in an informed manner.

The judgment

Active consent
The first question concerning the validity of a pre-ticked checkbox as consent under Art 5(3) of the e-Privacy Directive was the main topic of the judgment. In this regard, the CJEU has assessed the requirements for consent and, following in essence the argument of the AG Szpunar arising from his opinion issued on 21 March 2019, confirmed that consent under Art 5(3) of the e-Privacy Directive must be unambiguously active and at least a clear affirmative action. A preselected checkbox was deemed insufficient in this regard, as it does not imply active behaviour on the user’s part.

The CJEU has otherwise not discussed in detail what kind of consent mechanisms may otherwise constitute “active consent” and a “clear affirmative action”, and has especially not addressed practices such as consent by continuing to surf or consent by browser settings. However, based on the argumentation, it is not likely that such practices would be suitable for obtaining active consent, except perhaps in very specific cases.

The CJEU has also specifically excluded the question of freely given consent. While the participation in the lottery was made conditional on consenting to processing of data for advertising purposes, this question was not raised by the referring court and it was not considered by the CJEU. However, the fact that this point was explicitly mentioned may mean that the CJEU had some reservations about this practice.

Scope of applicability of Art 5(3) of the e-Privacy Directive- personal vs non-personal information
This question was addressed very briefly and has been not the main focus of the judgment, nevertheless the response of the CJEU is of great importance. Based on the wording of Art 5(3) of the e-Privacy Directive, which does not mention personal data, and arguing that the e-Privacy Directive considers any information stored in terminal equipment as a part of the private sphere requiring protection, the CJEU stated that Art 5(3) of this directive is to be interpreted the same regardless of whether the stored and accessed information is personal data. In other words, where the law requires consent for cookies (in practice, non-necessary cookies), it does not matter whether those cookies involve the processing of personal data.

Necessary information
Finally, considering that a consent under Art 5(3) needs to be well informed, the CJEU deemed that the information on the duration of the operation of cookies and whether or not third parties may have access to those cookies must be provided.

Going forward

The Planet49 judgment provides the next milestone regarding the cookies rules, as it is now clear that use of cookies requires active consent in the sense of GDPR (i.e. freely given, specific and unambiguous indication of the data subject´s agreement). At the same time, it leaves open the questions on various specific approaches used in practice to obtain (active) consent. It remains to be seen whether further cases addressing the specific mechanics will follow.
The determination that the consent obligation applies even if cookies do not operate with personal data will likely cause a major shift in the approach to cookies consent in practice. It may also make legislative changes in member states necessary, as various implementation acts throughout Europe – including the German implementation which was relevant in the Planet49 case – refer explicitly to processing of personal data when regulating consent obligation.

For further information, please get in touch with your usual DLA Piper contact.

Petr Sabatka, Jan Metelka, Stefan Panic, Peter Craddock