A company cannot provide a pre-ticked checkbox on its website allowing cookies to be stored on a user's computer, the Court of Justice of the European Union ruled in a judgment delivered on Tuesday 1st October (Case C-673/17).
The German Federation of Consumer Organisations challenges the use by the German company Planet49 of a pre-ticked checkbox by which Internet users wishing to participate in online promotional games express their agreement to the storage of cookies.
Cookies are files that a website provider stores on a user's computer which facilitate navigation, but also provide information about the user's behaviour, in particular for advertising purposes for third parties.
The German Federal Court of Justice has referred the matter to the Court of Justice of the EU, which interprets the Directive (2002/58) on the protection of electronic communications privacy. It decides that the consent that the user of a website must give for the storage of and access to cookies on their equipment is not validly constituted by way of a pre-ticked checkbox which this user must uncheck in order to refuse to give their consent.
Whether or not the information stored or accessed on the user's equipment constitutes personal data does not alter this result. In fact, according to the Court, EU law aims to protect the user from any interference with their private life, in particular from the risk that hidden identifiers or other similar devices enter their equipment without their knowledge.
In addition, consent must be specific. Activating the button to participate in a promotional game is not sufficient for it to be concluded that a user has validly given their consent to the storage of cookies. Furthermore, the information that the service provider must give to the user includes the duration of the operation of cookies and whether or not third parties have access to these cookies.
For the EDRi organisation, this judgment underlines the importance of unblocking the proposal for an 'ePrivacy' regulation on online privacy in the Council (see EUROPE 12333/3).
See the judgment: http://bit.ly/2mzwWER (Original version in French by Mathieu Bion)