Gingerbread men, chewy chocolate chip, or snowball Christmas cookies – who doesn’t like ’em!? Well, apparently the European Court of Justice (ECJ) is not fond of them – not because they have names and ingredients like ceng_cache or gcr but because they can be «pre-baked».
In October the ECJ took a judicial stance regarding the use and acceptance of cookies on websites.1 The case concerns an online lottery, for which users had to accept terms and conditions and the installation of cookies by ticking two checkboxes, of which one of them (cookies) was already pre-ticked. By actively ticking the first checkbox the user accepted marketing terms. By de-selecting the second (pre-ticked) checkbox the user withdrew his/her consent to the installation of cookies on his/her computer. Participation in the online lottery was only possible if at least the first checkbox was ticked. This presumably led to both checkboxes ultimately being ticked (if the second one was not actively de-selected).
Consent means any freely given, specific, informed and unambiguous indication of a person’s wishes by which she signifies agreement to the processing of her personal data (Art. 4 (11) GDPR). It can be given by statement or by a clear affirmative action2, which could include ticking a box when visiting a website. However, silence, pre-ticked boxes or inactivity should not therefore constitute consent.3
The ECJ followed the opinion of the Advocate General of 21.3.20194 and ruled as follows in this case:
- Pre-ticked checkboxes, which the user must de-select to refuse his/her consent, do not demonstrate a valid consent on a website for accepting cookies;
- It is irrelevant whether the consent relates to personal or non-personal data;
- The website provider must inform the user about the duration of the operation of cookies, and whether or not third parties may have access to those cookies. Without this information the user cannot easily determine the consequences of any consent given.
According to the General Advocate’s opinion5, accepting terms and giving consent to the installation of cookies cannot form part of the same act because the user only effectuates one click for two expressions of intention. These two expressions cannot both be subject of the same OK-button, especially not, because de-selecting the checkbox for accepting cookies appears like a preparatory act6 to clicking the OK-button. The user is not in a position to give freely his/her separate consent for cookies.
What does it mean for your website?
- Generally, do not pre-select checkboxes for your users.
- Ideally you will not bundle consents7, i.e. combine cookie acceptance with other consents. If you do nonetheless, then inform the users how their consents are linked (conditioned) and what options they have.
- Inform your users about the cookie name(s) and duration of cookie storage.
- Inform your users about third party access to the cookies you install.
Daniel Ronzani
- 1 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzenctrale Bundesverband eV v Planet49 GmbH (C-673/17) (own emphasis), tinyurl.com/vp3gu49.
- 2 Regulation (EU) 2016/679, tinyurl.com/yxp53ynx.
- 3 Ibid., Recital 32 GDPR.
- 4 Opinion of Advocate General Szpunar delivered on 21.3.2019, Case C‑673/17, tinyurl.com/uqme5h4.
- 5 Ibid., para. 89–90.
- 6 Consenting to cookies appears to be an ancillary act only.
- 7 See also art. 7 para. 4 GDPR regarding conditional consent.
