The Court of Justice of the European Union (CJEU) issued its judgement on 1 October in the highly anticipated Planet49 case (Case C‑673/17). The CJEU ruled that website users must provide “active consent” to the storage of and access to cookies on a user’s electronic device. This judgment is important as it provides clarity on what constitutes valid consent in the post-GDPR world. Website operators should review cookie notices and check boxes to assess whether they comply with the requirement for opt-in and informed consent.
In 2013, Planet49 GmbH (Planet49) organised a promotional lottery in which internet users wishing to participate in the lottery game online were required to provide certain personal information. As part of the registration for the online lottery game, website users were presented with two checkboxes before they could select the participation button. The first checkbox, which was not prechecked, requested the user’s consent to receiving marketing information from third party sponsors and partners. The second checkbox consenting to the storage of and access to cookies was prechecked. Users were required to at least select the first checkbox to participate in the lottery.
The Federation of German Consumer Organisations claimed that the consents obtained were not compliant with the ePrivacy Directive. The German Federal Court of Justice (Bundesgerichtshof) referred the matter to the CJEU to provide a ruling on whether prechecked checkboxes constitute valid cookie consent, among other issues.
The CJEU ruled “that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent”.
The CJEU confirmed that consent must be specific, separate, and distinct. Users cannot validly consent to participate in the promotional lottery and give consent to the storage of cookies at the same time.
While it was anticipated that affirmative consent to the collection of information through cookies will be required further to the previous advisory opinion from CJEU Advocate General Maciej Szpunar in the matter, the UK Information Commissioner’s Office appeared to have little appetite for enforcing breaches of cookie notice requirements, in contrast to the German authorities, even though UK law requires express opt-in consent. This approach may now change going forward.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
Izzet M. Sinan
Gregory T. Parks
W. Reece Hirsch
 The Data Protection, Privacy and Electronic Communications (Amendments, etc) (EU Exit) Regulations 2019.