Pre-ticked check-boxes for cookie consent are not allowed

If there was any doubt left that pre-ticked cookie-consent checkboxes are insufficient, the EU high court has explicitly ruled it out.

The Court of Justice of the European Union (CJEU – the highest court instance in the EU) has released its opinion on a six years old case.

This decision follows the recently updated ICO (the UK data protection regulator) cookie guidelines and puts another emphasis on the need to update cookie practices.

These include an updated cookie banner, a new, separate cookie notice, compliant cookie-placing mechanisms, and specific opt-out options.

The case related to Planet49, a website that offered a pre-ticked checkbox, in connection with online promotional games.

The cookies in question were aimed at collecting data for third-party advertising purposes.

Cookie consent is required pursuant to an EU directive, known as the ‘Cookie Directive,’ which, as of 2009, requires consent for placing a cookie (or any other tracking measure) in a user’s device.

The consent is meant for the actual placement of the cookie in the user’s device.

It is not meant to replace the consent required under the GDPR for processing personal data.

According to the court’s opinion, storing cookies, whether they include personal information or not, requires active and specific consent. Pre-ticked checkboxes do not qualify.

Furthermore, the online service provider must provide users with a specific indication of the cookies’ duration and whether third parties have access to the cookies.

A short press release about the opinion is available at https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf.

Feel free to reach out, if you have questions about this ruling.