“Pre-Ticked” Boxes to Obtain Cookie Use Consent Fail Under EU Law

Privacy & Cybersecurity Update

Date: October 09, 2019

Many companies’ websites use cookies (small text files) to track users’ online content viewing activities. Cookies can be used to do things like save a user’s login credentials to make repeated sign-ins easier, allow a user to leave a web session and return later and find the same product in their shopping cart, or collect information for marketing purposes. Under EU law, websites must obtain users’ consent prior to using cookies.

On October 1, 2019, the Court of Justice of the European Union (CJEU) issued a highly anticipated decision in a case involving Planet49 GmbH. The case analyzed consent requirements for the use of cookies under the EU’s Privacy Directives and the GDPR, and the CJEU ultimately held that Planet49’s use of a “pre-ticked” box did not meet those requirements.

Planet49 offered an online lottery service that required interested users to register. The registration form first asked users to tick a box allowing Planet49 to share their data with commercial partners, which was required to participate in the lottery. Next, the form presented users with a pre-ticked box that permitted them to opt out of the use of cookies only if they unticked the box. If they chose to opt out, they could still participate in the lottery. Finally, users were asked to click on the button “participate” to submit their registration form.

The CJEU noted that, to be valid under applicable law, a consumer’s consent must be “unambiguous,” “informed,” “specific” and “freely given.” The court decided that consent obtained using a pre-ticked box did not meet those requirements, although it ultimately declined to analyze whether such consent was freely given because that inquiry was not included in the questions submitted by the lower court.

According to the CJEU, the use of a pre-ticked box makes it impossible to objectively ascertain whether a user had unambiguously given consent to the use of cookies or whether that consent was informed. The court reasoned that a user may not have read or noticed the information accompanying the pre-ticked box. And despite Planet49’s argument that users provided specific consent by clicking “participate,” the CJEU determined that because the action did not relate explicitly to the use of cookies, specific consent was not obtained. The court went on to say that specific consent could not be inferred from an indication of the user’s desire to participate, which suggests that it would consider implied consent (like consent assumed from a continued use of a service) to be unacceptable.

In response to additional inquiries from the lower court, the CJEU also held that the consent requirement applied even if the cookies were not used to collect personal data, and that users must be informed of the duration of the cookies and whether third parties can access them.

In light of the Planet49 decision, companies using cookies to track users’ activities should review their methods of obtaining consent. Clearly, the use of pre-ticked boxes will not be sufficient to comply with EU law, and site owners should disclose key details of any cookies placed by their sites, including information regarding duration and third-party access. That said, companies should be aware that the various data protection authorities do not necessarily agree on the minimum requirements for all aspects of cookie use (such as whether consent is required for analytic cookies or how prominent the options should appear to users), which means that how and when users must provide unambiguous, informed, specific and freely given consent to cookie use are issues that remain to be reconciled. We will continue to monitor developments in this area and keep you informed.

FOR MORE INFORMATION

For more information, please contact:

Thomas F. Zych
216.566.5605
Tom.Zych@ThompsonHine.com

Steven G. Stransky
216.566.5646
202.263.4126
Steve.Stransky@ThompsonHine.com

Craig A. Foster
614.469.3280
Craig.Foster@ThompsonHine.com

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

© 2019 THOMPSON HINE LLP. ALL RIGHTS RESERVED.