Advocate General finds a pre-ticked checkbox does not constitute valid consent for cookies

The Advocate General of the Court of Justice of the EU (CJEU) has delivered an Opinion in the Planet49 case (Case C-673/17), finding that a pre-ticked checkbox giving consent for cookies does not constitute valid consent under the e-Privacy Directive 2002/58 read in conjunction with the Data Protection Directive 95/46 or the GDPR.

Facts

In order to participate in a lottery organised by Planet49, an internet user was confronted with two checkboxes which had to be clicked or unclicked before he could hit the ‘participation button’. The first checkbox, which was not pre-ticked, required the user to accept being contacted by a range of firms for promotional offers. The second checkbox, which was pre-ticked, required the user to consent to cookies being installed on his computer.

The Advocate General was asked to decide whether consent to cookies obtained via a pre-ticked box constitutes valid consent under the e-Privacy Directive 2002/58 read in conjunction with the Data Protection Directive 95/46 or GDPR, and whether a service provider is obliged under Article 5(3) of the e-Privacy Directive 2002/58 to provide information in its cookie policy as to the duration of the operation of the cookies and whether third parties are given access to the cookies.

Opinion

The Advocate General gave the following opinion:

  1. There is no valid consent within the meaning of the e-Privacy Directive 2002/58 , in conjunction with the Data Protection Directive 95/46, in a situation such as that in the present proceedings where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent.
  2. The same applies in regard to the interpretation of the e-Privacy Directive 2002/58 read in conjunction with the GDPR.
  3. The consent requirements for cookies apply regardless of whether or not the information stored and accessed constitutes personal data.
  4. The “clear and comprehensive” information a service provider has to give a user, under Article 5(3) of the e-Privacy Directive in regard to the use of cookies, includes the duration of the operation of the cookies, and whether third parties are given access to the cookies. If third parties have access, their identity must also be disclosed.

The Attorney General also emphasised that consent for cookies must be obtained separately. The activity a user pursues on the internet (reading a webpage, participating in a lottery, watching a video etc.) and the giving of consent to the use of cookies cannot form part of the same act. This finding appears to reject the idea of implied consent to cookies by the act of continued browsing by the user. In addition, the Advocate General stated “it must be made crystal-clear to a user whether the activity he pursues on the internet is contingent upon the giving of consent [for cookies]. A user must be in a position to assess to what extent he is prepared to give his data in order to pursue his activity on the internet.”

Next Steps

Whilst the Advocate General’s Opinion is not legally binding, it will be of persuasive value to the CJEU in making its decision. The CJEU is expected to issue a final judgment in the coming months.

For more information on this topic please contact Davinia Brennan, Associate, or any member of A&L Goodbody's Commercial & Technology team.

Date published: 28 March 2019