It is well known that websites use cookies or files that the provider introduces into the visiting user’s computer, which serve to facilitate navigation on the Internet or on-line transactions, but they are also a tool for obtaining information on user behaviour, which is subsequently used for publicity purposes for collaborating companies or companies which are clients of the service provider.
Likewise, another common practice is for websites to indicate to the user that his or her consent must be given for the use of cookies and there is a box already marked with an X, as a sign of acceptance, or with other veiled or prompted forms of consent.
The German Supreme Civil and Criminal Court filed an application to the Court of Justice of the European Union to interpret whether such a practice could infringe EU Law regarding the protection of privacy in the electronic communications sector. The plaintiff of the case was the German Federation of consumer organisations and associations, which reported the company PLANET 49, dedicated to on-line gaming, which used a pre-ticked box with which users expressed their consent for the placement of cookies in their computers.
With regard to the petition, the Court of Justice of the European Union, in judgment dated 1st October 2019 (case C-673/17) makes it quite clear that the consent of the user of the site must be specifically granted so that cookies may be placed in the user’s computer. Furthermore, it understands that consent is not understood to have been duly given when the form of doing so consists of a box pre-ticked by default, where the user must remove the tick if he or she does not want to give consent. That is to say that it is neither acceptable nor valid to construe that consent is deemed to have been given due to the omission of the user to remove the tick from the box pre-ticked by default, when it should be the user who actively ticks a blank box. And this need to give consent is independent from the “information stored or consulted in the user’s computer, constituting personal data or not”. It is not a matter of qualifying the type of information compiled, rather it is not permissible for a third party to enter a user’s computer or terminal without the user being aware of it and in any case without having given his or her clear and indispensable consent.
The Court demands a pro-active and indubitable activity from the user, so that it may not be understood that consent has been given in cases of indolence, confusion or lack of sufficient clarity, given that if the asset protected is the privacy of the individual, this may not and should not be harmed by the service provider’s mechanisms or ruses aimed at confusing or taking advantage of the passivity – or anxiety – of the user, thus leaving the computer wide open to the placing of cookies (own or third party) which may include hidden identifiers or undesired devices for obtaining information.
The judgment confirms, that consent must be express and specific, therefore, computer design resources must be deemed prohibited whereby the on-line service provider associates pressing a start button to begin participating in a certain game (as in the case being judged), taking part in an event or receiving a service etc., with the giving of consent for the use of cookies. This operating mode seeks the implicit or indirect giving of consent, which is rejected by the Court. There are reasons for arguing that this prohibition may be extended to sites where the acceptance of placing cookies is linked to the mere continuation of navigation of the site, whilst the user is unaware of the real reach of the warning, or that simply moving the mouse pointer across a website may be understood as an act of continuing or not. In our opinion, this practice is not acceptable given that consent goes hand in hand with the reception of the service without the possibility of disassociation; in order to deal with this obstacle, once consent has been requested, the screen should be blocked until express consent has been given. In fact, the Court declares that the giving of consent by the user for the placement of cookies cannot be veiled, prompted or implied, instead the system chosen for obtaining such consent must demonstrate that the user has carried out this action him or herself voluntarily.
Finally, so that the user may take a well-founded decision, it is necessary that prior and sufficient information is made available to them regarding the consequences of their decisions to accept the installation of cookies. In this way, the service provider must clearly inform the user of the website of certain basic aspects, such as whether the cookies shall be accessible by said service provider only or also by third parties; equally, users should be informed of the period for which the cookies shall be active.
A further question not taken into account in the judgment is the legality of the sites (public) which require the acceptance of the use of cookies in order to allow navigation of the site and benefit from the services provided. It could be said that, in these cases, although the site observes the rules to request that the user actively gives consent, the decision should be understood to be basically prompted and thus floored, given that the alternative to not ticking the acceptance box means not being able to take advantage of the public service.
Eduardo Vilá
Vilá Abogados
For more information, please contact:
4th October 2019
