Consent to the installation of cookies on an internet user’s computer is not valid if the consent is given via a pre-ticked box. Consent requires active behavior on the part of the user, the CJEU has ruled.
The case concerned the German company Planet49. In 2013, the company held an online competition for consumers in Germany. To participate in the competition, the internet user was presented with two tick boxes. In one of the boxes, the user had to agree to be contacted by a number of companies with advertising offers. In the second box, the user had to give their consent to have cookies installed on their computer. The first box was not pre-ticked. It was only possible to participate in the competition if this box was ticked as a minimum. However, it was not a requirement for participation in the competition that the second box was ticked. This box, however, was already ticked in advance. If the user did not remove the tick, the user also gave consent for the company to install cookies on the user’s computer. The installation of cookies gave the company the opportunity to store information or access information about the user.
Bundesverband der Verbraucherzentralen (association of German consumer organizations, which corresponds to the Danish Consumer Complaints Board) subsequently brought an action against Planet49 before the Landgericht Frankfurt am Main (the regional court of first instance in Frankfurt am Main, Germany). Bundesverband claimed that the consent declarations in question, which the company had used, did not meet the requirements for obtaining valid consent.
Landgericht Frankfurt am Main partially upheld Bundesverband’s claim. After Planet49 had appealed this decision to the Oberlandesgericht Frankfurt am Main (the regional court of appeal in Frankfurt am Main, Germany), which ruled in favor of Planet49, Bundesverband brought the case before the Bundesgerichtshof (Federal Court of Justice, Germany). This court decided to postpone the case and submit two questions to the CJEU for a preliminary ruling.
The first question concerned the validity of consent to the installation of cookies when the consent is obtained via a pre-ticked box. Including whether the answer to this question is different if the information stored about the user is personal data. The second question concerned whether the company must inform the user how long the installed cookies are stored and whether third parties have access to these cookies.
With regard to the first question, the CJEU began by noting that the use of cookies is only permitted on condition that the user has given their consent to this, after the user has received clear and comprehensive information about the processing of these cookies. This includes information about the purpose of processing them.
The CJEU then defined what is meant by “consent”. According to EU rules, consent is defined as “any freely given, specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”.
The requirement for an indication of wishes indicates that there must be active and not passive behavior on the part of the user. Consent given using a pre-ticked box therefore does not imply active behavior on the part of the user. A pre-ticked box makes it objectively impossible to determine whether the user has actually given their consent to the processing by not removing the tick. In addition, a pre-ticked box makes it impossible to assess whether the consent meets the requirement that it must be given in an informed manner. It cannot be ruled out that the person in question has not read the information accompanying the pre-ticked box, or that the user has not understood the box before continuing their activity on the website in question. In addition, a pre-ticked box cannot meet the requirement that the consent must be specific, as it presupposes that the consent must relate precisely to the processing of information in question.
On this basis, the CJEU therefore concluded that consent to the installation of cookies is not valid if the consent is given via a pre-ticked box. The CJEU then clarified that this applies regardless of whether the use of cookies concerns personal data or not.
With regard to the second question, the CJEU initially noted that, as mentioned, it is a requirement that the user has given their consent to the use of cookies after the user has received clear and comprehensive information about, among other things, the purpose of processing these cookies. The information must also be easily understandable and sufficiently detailed to allow the user to understand how the cookies that are installed work. Thus, on the basis of the information, the user must be able to easily understand the consequences of giving the consent in question. Therefore, the user must also have information about the duration of the cookies in question. That is, when they expire. Furthermore, the user must be informed whether third parties have the possibility to access these cookies or not.
The judgment from the CJEU clearly shows that a pre-ticked box cannot constitute valid consent, as valid consent requires active behavior from the internet user. Companies should therefore look at whether their use of cookie consent meets the conditions for consent. This includes companies also checking whether the information provided in connection with obtaining consent meets the requirements for duration and disclosure to third parties.
In Denmark, many businesses use a so-called “cookie banner”, which requires the user to give consent to the installation of cookies with a single press of the “OK” button, after which the user can continue their activity on the website in question. This practice is accepted in the Danish Business Authority’s guidance, which was last updated on December 10, 2019, which is after the CJEU’s judgment. The CJEU’s judgment does not address whether this way of obtaining consent is sufficient. However, it must be assumed that the Danish Business Authority, in connection with the latest update of the guidance, has specifically considered the significance of the CJEU’s judgment in this context and has thus assessed that the use of an “OK” button is sufficient to constitute an active action, and that the use of cookie banners is therefore still in accordance with EU law.