Source: https://www.mhc.ie/latest/blog/advisor-to-eus-highest-court-confirms-active-consent-needed-for-cookies
Timestamp: 2020-06-03 13:19:39
Document Index: 74017150

Matched Legal Cases: ['CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ']

Advisor to EU’s Highest Court Confirms Active Consent Needed for Cookies Mason Hayes Curran
Under the EU ePrivacy Directive, an individual’s prior and informed consent is generally required to drop cookies on or read cookies from his or her device. The degree to which cookie walls, banners and popups comply with these requirements has been the subject of some debate. In March 2019, an independent advisor to the EU’s highest court, Advocate General Szpunar, issued an opinion regarding these notice and consent requirements in the case of Planet 49 GmbH (case C-673/17).
We examine this opinion and consider how the court might approach the case, and what this could mean for existing practices.
Planet49, based in Germany, had organised a promotional lottery. Registration required entry of a person’s postcode, which then prompted entry of that person’s name and address. Underneath that prompt appeared two checkboxes. The first checkbox, which was mandatory for participation in the lottery, and sought consent to marketing from lottery sponsors and partners, was not pre-ticked. The second checkbox, which was voluntary for participation and sought consent to cookies for profiling purposes, was pre-ticked. Information was provided about the sponsors and partners, the functioning of the cookies and interests-based profiling, how to delete cookies, and how to contact Planet49 to revoke consents given.
What scope of information, provided at the point of consent, is necessary to satisfy the “clear and comprehensive information” standard?
In AG Szpunar’s view, pre-ticked boxes do not obtain valid consent from users. In particular:
AG Szpunar formed the opinion that it is irrelevant to the referred questions whether cookies constitute personal data. This is because the relevant provision of the ePrivacy Directive, Article 5(3), regulates the storage and access of “information”, not just personal data. The scope of the GDPR does not therefore limit the scope of the ePrivacy Directive. This is noteworthy since organisations that rely on cookies should keep in mind that they are responsible for complying with the ePrivacy Directive in addition to the GDPR.
According to the AG, the “clear and comprehensive information” that organisations should provide must include information on the duration of operation of the cookies (ie their expiry periods) and details on third party access. A user should be easily able to determine the consequences of his or her consent. The average internet user is relatively uninformed regarding the operation of cookies, and organisations must provide sufficient information on that basis.
The CJEU will now consider the referral and the AG’s opinion. While the CJEU tends to follow AG opinions in issuing its judgment, it is not always the case. In some instances, the CJEU adopts some of the principles of the AG’s opinion but ultimately applies them in a different manner. Equally, the CJEU may decide that addressing certain points, which the AG chose to opine on, may not be necessary to answer the German court’s questions. It may therefore choose not to express a view on such ancillary points.
Additionally, it remains to be seen whether the AG’s opinion and, ultimately, the CJEU’s judgment could raise questions around the validly of some commonly-used approaches to cookie consent. In particular, the AG considered whether consents could be ‘bundled’ and potentially be expressed by the same act. It will be interesting to see whether the CJEU chooses to adopt or expand upon this view, particularly in light of consents that are expressed by a user’s decision to continue using or accessing a website. However, as the present case is one of stark non-compliance due to an unclear opt-out approach, the CJEU may avoid the issue of bundling. It is as yet unclear whether the CJEU judgment will have a far-reaching impact.
Discuss your related queries now with Jevan Neilan.