Share this post
The German Supreme Civil and Criminal Court filed an application to the Court of Justice of the European Union to interpret whether such a practice could infringe EU Law regarding the protection of privacy in the electronic communications sector. The plaintiff of the case was the German Federation of consumer organisations and associations, which reported the company PLANET 49, dedicated to on-line gaming, which used a pre-ticked box with which users expressed their consent for the placement of cookies in their computers.
With regard to the petition, the Court of Justice of the European Union, in judgment dated 1st October 2019 (case C-673/17) makes it quite clear that the consent of the user of the site must be specifically granted so that cookies may be placed in the user’s computer. Furthermore, it understands that consent is not understood to have been duly given when the form of doing so consists of a box pre-ticked by default, where the user must remove the tick if he or she does not want to give consent. That is to say that it is neither acceptable nor valid to construe that consent is deemed to have been given due to the omission of the user to remove the tick from the box pre-ticked by default, when it should be the user who actively ticks a blank box. And this need to give consent is independent from the “information stored or consulted in the user’s computer, constituting personal data or not”. It is not a matter of qualifying the type of information compiled, rather it is not permissible for a third party to enter a user’s computer or terminal without the user being aware of it and in any case without having given his or her clear and indispensable consent.
The Court demands a pro-active and indubitable activity from the user, so that it may not be understood that consent has been given in cases of indolence, confusion or lack of sufficient clarity, given that if the asset protected is the privacy of the individual, this may not and should not be harmed by the service provider’s mechanisms or ruses aimed at confusing or taking advantage of the passivity – or anxiety – of the user, thus leaving the computer wide open to the placing of cookies (own or third party) which may include hidden identifiers or undesired devices for obtaining information.
Finally, so that the user may take a well-founded decision, it is necessary that prior and sufficient information is made available to them regarding the consequences of their decisions to accept the installation of cookies. In this way, the service provider must clearly inform the user of the website of certain basic aspects, such as whether the cookies shall be accessible by said service provider only or also by third parties; equally, users should be informed of the period for which the cookies shall be active.
For more information, please contact:
Barcelona, 4th October 2019