On 1 October 2019, the Court of Justice of the European Union (CJEU) delivered its ruling on the so-called ‘Planet49 case’.
The case centred around Planet49, a website offering an online promotional lottery. Users of the Planet49 website were asked to authorise the use of cookies prior to entering the lottery. Crucially, the checkbox authorising the use of cookies had been pre-ticked by default.
The CJEU, following the Attorney General’s opinion previously published on the matter, found that a box pre-checked by default which essentially requires users to "deselect to refuse [their] consent" is insufficient. The CJEU said that what is required is a “freely given, specific, informed and unambiguous’ indication of the data subject’s wishes in the form of a statement or of ‘clear affirmative action’ signifying agreement to the processing of the personal data relating [to the user]”. The CJEU went further and said that this consent requirement to use cookies applied “whether or not the information stored or accessed on a website user’s terminal equipment is personal data”.
The CJEU also noted that users should be informed of both the duration of the operation of the cookies as well as information relating to whether or not third parties are able to access the cookies in order to meet the “requirement of fair data processing”.
The judgment will undoubtedly have significant consequences for marketing and AdTech businesses in Europe, especially given that the practice of using pre-checked boxes for authorising the use of cookies is widespread across these industries.
The case follows a report by Ruhr-University Bochum and the University of Michigan published just weeks before which found that out of a sample of approximately 5,000 cookie notices, a shocking 86% offered users no options other than confirmation buttons that did not do anything (i.e. users had no choice).
Data protection regulators across Europe are particularly focused on the use of cookies and the AdTech sector at the moment. The ICO has recently updated its guidance on cookies and issued its interim report into the AdTech sector and real time bidding. Regulators expect to see change and this latest decision reinforces the need for organisations to urgently review their policies and practices in relation to the use of cookies and obtaining consent to ensure that they are acting lawfully. This is not just about GDPR but the ePrivacy Directive as well.
An English version of the full decision is available here.
