The European Court of Justice (ECJ) has issued a significant ruling on cookie information obligations of website operators. It ruled that website users must actively check the box themselves. Pre-set consent to cookies is inadmissible. The consent must always be given actively and voluntarily by the website user. A note field is insufficient. Website providers use cookies to collect information about website users, such as login data or behaviour, which can be forwarded to partner companies.
The present preliminary ruling is based on a legal dispute between the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband) and the lottery company Planet49, which was passed on by the German Federal Supreme Court. The provider Planet49 had used a checkbox with a preset checkbox for advertising purposes in online competitions. Since the checkboxes for the consent of website users to the use of cookies were already filled in in advance, the user only had to click on “Ok” to give consent with a mouse click. According to the ECJ, the required consent was not effectively given by a preset checkbox, which the user had to deselect to refuse his consent.
The ECJ demands the active consent of website users when storing and retrieving cookies, regardless of whether the information stored or retrieved in the user’s device is personal data or not.