The Court of Justice of the European Union Issues a Ruling on Cookie Consent Requirements

Written by: Rich Sheinis, Esq. 

On October 1, 2019, the CJEU issued a ruling establishing that consent to use cookies cannot be validly obtained through a pre-checked box.  In this particular case, an online gaming company, Planet49 GmbH, had a lottery which required internet users to provide personal data.  The web page contained a pre-ticked box requiring the end user to consent to the installation of cookies on their device.  The question was whether this pre-ticked box, which the user must unselect to refuse consent, constituted valid consent to store cookies on the user’s device.

The Court found that consent requires active, rather than passive, behavior.  Failing to un-tick a pre-ticked box is not considered an active behavior giving consent.  Although the decision was rendered largely on the basis of the consent requirements of the ePrivacy Directive, the Court noted that Recital 32 of the GDPR specifically states that ticking a box, as opposed to de-selecting a box, when visiting a website is an example of how valid consent can be obtained.