The Court of Justice of the European Union (the ‘CJEU’) by means of its recent judgement Verbraucherzentrale Bundesverband eV v. Planet49 GmbH (C 673/17), (the ‘Planet49 Case’) endeavours to change the way digital advertisers and media owners approach and target internet users and instigates website operators to revamp their current practices in relation to cookie consent. The Planet49 Case is the result of the E-Privacy Regulation (Regulation on Privacy and Electronic Communications) which is being proposed to replace the current e-Privacy Directive (2002/58/EC) and which aims to address interalia how specialist technologies such as cookies impact the privacy of Data subjects.
Cookies can be described as files of information obtained from a website which files are subsequently stored on a user’s computer. The purpose of cookies and tracking technologies in general is for organisations, entities and website operators, to track, monitor and gain visibility of their users, their behaviour and inclination. Cookies are said to affect an individual’s privacy since they are typically used to gather information about an individual without that individual’s authorization, thus presenting a threat to one’s online privacy.
The Planet49Case, involved participation in a lottery organised by an online gaming company, Planet49 GmbH. In order to enter the lottery, the users were requested to enter their details and accept two check boxes. The first checkbox required the user to agree to be contacted by entities for promotional offers, whereas the second checkbox contained a pre-selected tick and required the internet user to consent to the installation of cookies on their devices.
The question which arose was whether valid consent was said to be obtained for storing information and for storing cookies if this would have been sought by way of a pre-checked checkbox which the internet user must unselect to refuse his consent. Another question which was referred to the CJEU was whether users should be informed about whether third parties are given access to the cookies and about the duration of the operation of the cookies.
In this case, the CJEU has delved into the scope of consent requirements with respect to cookies and established that consent may not be obtained using pre-checked boxes. If the user’s consent is pre-ticked then that should not be considered as ‘active consent’ and does not satisfy the requirement of consent which under Article 2(h) of the Directive is defined as ‘any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’, nor does it satisfy the requirement of consent under the GDPR which is more stringent and specifically requires active consent. The CJEU reiterated the importance of the behaviour of the data subjects being active and showing active consent by actively marking a checkbox.
Thus, the CJEU in this landmark judgement set an important milestone with respect to cookies compliance, namely that website operators acquire consent from the users before the cookies are stored into the user’s internet browser, which is typically acquired by ticking a box which expressly asks the users whether they accept the cookies.
Get in touch with us on [email protected] to find out more, or visit our website on www.novo.legal to keep up to date with the latest industry news, both local & international.
