On 01 October 2019, the European Court of Justice published a groundbreaking decision regarding the consent to cookies. It was disputed between the German Federal Association of Consumer Centres and Associations and Planet49 GmbH whether setting the “default” hack is permissible or not. Planet49 GmbH operated a website for sweepstakes. A cookie display was placed on this website, on which a checkbox for consenting to cookies had already been selected; to refuse consent, the user had to actively uncheck the box.
The German Federal Supreme Court initially doubted the conformity of this attitude with the data protection law applicable under Union law and thus reached the European Court of Justice. This court decided that the checkbox had to be ticked actively. Otherwise, there would be passive behaviour which could not satisfy the data protection provisions of the Union and which therefore did not constitute express consent. This is because there must be an expression of will from which consent can be clearly and unambiguously derived. It is not enough simply to keep quiet, to tick boxes or to fail to act. This applied regardless of whether personal data were affected or not.
A second question concerned the scope of the information to be provided, specifically whether information should be provided on how long the cookies are stored and whether third parties have access to the cookies. The European Court of Justice ruled that, in the present situation, the website operator must, in good faith, provide information on the duration of the cookies and on whether third parties may gain access to the cookies. If the cookies are used for a long or unlimited period of time, a great deal of information could be collected about the user’s usage habits and frequency of visits to the websites of Planet49 GmbH’s advertising partners.
Source:
Urteil des Gerichtshofs (Grosse Kammer) vom 01. Oktober 2019 in der Rechtssache C-673/17