What the ECJ ruling of 01.10.2019 means for practice
The ECJ had to deal with the following summarised questions in a preliminary ruling procedure:
- Is it an effective consent if the storage of information or access to information is allowed by a default checkbox which the user has to uncheck to refuse his consent?
- Does it make any difference whether the information stored or retrieved is personal data?
- What information does the service provider have to provide to the user in the context of clear and comprehensive information to be provided? Does this also include the duration of the function of the cookies and the question of whether third parties can access the cookies?
What happened?
In September 2013 Planet49 GmbH organised a competition on the website www.dein-macbook.de for advertising purposes. Interested Internet users had to enter their name and address with postal code in order to take part in the competition. Furthermore, Internet users had to agree to at least one of two possible promotional uses of their personal data. For this purpose, the organizer provided two checkboxes, one of which already contained a preset checkbox. As a result of this default setting (when participating in the competition), a cookie was stored on the Internet user's computer which Planet49 GmbH used for advertising purposes for products of its partners.
After an unsuccessful warning of the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V.), the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V.) reached a decision in the first instance at the Regional Court of Frankfurt am Main, according to which the box placed forward is invalid as a declaration of consent and may no longer be demanded by Planet49 GmbH.
The Higher Regional Court of Frankfurt am Main granted the appeal of Planet49 GmbH. The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V.) lodged an appeal with the Federal Supreme Court, which referred the questions now decided to the European Court of Justice for clarification of the relevant questions of interpretation.
How did the ECJ decide?
With regard to the questions referred, the ECJ came to the following conclusions:
Active consent of Internet users required
An effective consent does not exist, if the storage of information or the access to information is permitted by a checkbox preset by the service provider, which the user must uncheck to refuse his consent.
In accordance with the provisions in the GDPR on consent, the ECJ thus speaks of the requirement of "active consent" by Internet users.
All cookies are affected
It does not legally matter whether or not the information stored or retrieved in the terminal equipment of the user of a website constitutes personal data within the meaning of Directive 95/46 or Regulation 2016/679.
The website operator must provide comprehensive information about the function of cookies.
The website operator must inform the Internet user of the duration of the cookie's operation, the identity of the data controller, the purpose of the processing for which the data are intended and other information, such as the recipients or categories of recipients of the data.
What are the practical implications of the ECJ ruling?
Initially, the ruling of the ECJ has direct consequences only for the parties involved in the proceedings. The Federal Court of Justice will presumably decide the pending appeal proceedings in the spirit of the appellant, taking into account the judgment of the European Court of Justice. This means that the box placed in front is invalid as a declaration of consent and may not be demanded by Planet49 GmbH. In this case, for the first time there would be "supreme court" jurisdiction on the subject of the need for consent with cookies!
It is therefore to be expected and feared that all data protection supervisory authorities will follow the ruling of the European Court of Justice and the Federal Court of Justice and critically examine the current practice of including cookies by website operators.
If website operators want to choose the legally most secure way, they must refrain from using cookies altogether until further notice. For many website operators, this should mean a considerable economic problem because they are either technically dependent on the use of cookies (e.g. session cookies for the functioning of the shopping basket) or generate a considerable part of their added value directly through the use of (advertising) cookies. In the near future, the following questions will certainly have to be clarified by the authorities, the courts and the legislator:
- Must or should technically necessary cookies be excluded from the consent requirement?
- How detailed must the information about the functionality of the cookies be?
- Does the Internet user have to consent to the use of each cookie separately, or is a "general consent" sufficient (after correspondingly detailed information)?
Source: Judgment of the European Court of Justice of 01.10.2019, Ref. C-673/17
GoldbergUllrich Attorneys at Law 2019
Julius Oberste-Dommes LL.M. (Information Law)
Lawyer and
Specialist lawyer for information technology law
