ECJ: Cookies require explicit consent of users

In the long-awaited judgment on Planet49 (see this article), the European Court of Justice today ruled on an interpretation of the BGH.

According to this, the necessary consent for the storage and retrieval of cookies on the device of the visitor to a website is not effectively given by a preset tick box, which the user must deselect in order to refuse his consent.

In this respect, it makes no difference whether or not the information stored or retrieved in the user’s device is personal data. EU law is intended to protect the user from any invasion of his or her privacy, in particular against the risk of ‘hidden identifiers’ or similar instruments penetrating his device.

The Court made it clear that consent must be given in the specific case. In the Case planet49, therefore, the activation of the button for participation in the competition does not constitute an effective consent of the user to the storage of cookies.

The Court also makes it clear that the service provider must provide the user with information on the duration of service and the possibility of access to third parties with regard to cookies. However, this only applies to non-technically necessary cookies. See, for example, my cookie policy.

As there is currently something like a wave of warnings around cookies, website operators should urgently check their cookie settings and the information about them and, if necessary, revise them. It is true that the BGH still has to make a final decision in purely legal terms and there are still numerous questions to be clarified in detail on the relevant questions, e.g. whether and when, in the event of a disregard for this case-law, things such as pain compensation are due, especially if however, one uses social media plugins, such as like-buttons or Twitter content, or tracking programs such as Google Analytics, whose cookies clearly serve not only to operate a website, one should already make preparations now.