Europe’s top court says active consent is needed for tracking cookies

Europe's top court has ruled that pre-checked consent boxes for dropping cookies are not legally valid.

Consent must be obtained prior to storing or accessing non-essential cookies, such as tracking cookies for targeted advertising. Consent cannot be implied or assumed.

It's a decision that - at stroke - plunges websites into legal hot water in Europe if their cookie notices don't ask for consent first. As many don't, preferring not to risk their ability to track users for ad targeting.

Now they could be risking a big fine under EU privacy laws if they don't obtain valid consent for tracking.

Full text of the CJEU cookie ruling improves understanding of #GDPR consent. Preselected fields make it impossible to detect if user consented. #ePrivacy https://t.co/rzuVEzGtRi

- Lukasz Olejnik (@lukOlejnik) October 1, 2019

Sites that have relied upon opting EU users into ad-tracking cookies in the hopes they'll just click okay to make the cookie banner go away are in for a rude awakening.

Or, to put it another way, the ruling should put a stop to some, er, 'creative' interpretations of the rules around cookies that manage to completely miss the point of the law"

ehem

at here refreshing Curia press release page & noticed their own non-compliant #cookie notice - spot the irony on their cookie information page - looks like the Court are about to render their own site illegal wrt to pre-ticked boxes" a little embarrassing" #privacy #planet49 pic.twitter.com/ewdEqQqrvb

- Alexander Hanff (@alexanderhanff) October 1, 2019

The decision is also likely to influence the ongoing reform of ePrivacy rules - which govern online tracking.

While the outcome of that very heavily lobbied piece of legislation remains to be seen today's ruling is clearly a win for privacy.

Planet49 case

The backstory to today's ruling is that a German court asked the CJEU for a decision in a case relating to a lottery website, Planet49, which had required users to consent to the storage of cookies in order to play a promotional game.

In an earlier opinion an influential advisor to the court also took the view that affirmative action not simple inaction must be necessary to constitute consent.

Today the CJEU agreed, handing down a final judgement which makes it plain that consent can't be assumed - it requires an active opt-in from users.

In a punchily brief press release the court writes:

In today's judgment, the Court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent.

That decision is unaffected by whether or not the information stored or accessed on the user's equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users' terminal equipment without their knowledge.

The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.

Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.

So, to sum up, pre-checked consent boxes (or cookie banners that tell you a cookie has already been dropped and pointlessly invite you to click 'ok') aren't valid under EU law.

Furthermore cookie consent can't be bundled with another purpose (in the Planet49 case the promotional lottery) - at least if that fuzzy signal is being used to stand for consent.

There's also an interesting new requirement which looks set to shrink the ability of service operators to obfuscate how persistently they're tracking Internet users.

For consent to cookies to be legally valid the court now says the user must be provided with some specific information on the tracking, namely: How long the cookie will operate, and who their data will be shared with. So, er, awkward"

The most interesting thing is how the Court justifies that info on cookie duration/those who can access should be provided. ePrivacy refers to data protection law on the information provided, but as ePrivacy is not always about personal data, the info reqs in DP don't always fit

- Michael Veale (@mikarv) October 1, 2019

What's more interesting: sites must inform about the duration of cookie validity. This is interesting insight, and was not generally followed. Should be identical to 'Expires' or 'Max-Age' setting when cookies are set. Does it also apply to SameSite configuration? #GDPR #ePrivacy pic.twitter.com/f55AtbqArb

- Lukasz Olejnik (@lukOlejnik) October 1, 2019

"Extending information requirement to include cookie configuration details is an interesting twist that will provide more information to users," Dr. Lukasz Olejnik, an independent cybersecurity advisor and research associate at the Center for Technology and Global Affairs at Oxford University, told us.

"Sites will need to be wary to be sure that the user-facing text matches the actually used values of max-age or expires attributes. It is also interesting to wonder if sites will want to provide similar information about other cookie attributes."

Safe to say, there will be some long faces in the ad industry today.

"The Court has made clear that consent should always be manifested in an active manner, and may not be presumed. Therefore, online operators should ensure that they do not collect consent by asking users to unclick a pre-formulated declaration of consent," said Luca Tosoni, a research fellow in computers and law at the University of Oslo, also commenting on the court ruling.

ePrivacy reform

As we've reported before very many sites and services in Europe have, at best, been playing lip-service to EU cookie consent requirements - despite the advent of tighter rules coming into force last year under the General Data Protection Regulation (GDPR), which says that consent must be specific, informed and freely given to be a valid legal basis. And despite - more recently - further guidance from DPAs clarifying the rules around cookie consent.

So the CJEU ruling should lift a fair few heads out of the sand.

"Before the entry into force of the GDPR, the conditions for consent were interpreted differently across Europe. Today's judgment is important as it brings some clarity on what should be considered valid consent under EU data protection law," Tosoni also told us, saying he expects the ruling to result in changes to many cookie notifications.

"National courts and data protection authorities across the EU will need to follow the Court's interpretation when assessing whether controllers have validly obtained consent. In turn, this should lead to more harmonization in enforcement across Europe, in particular with regard to cookie notices. Thus, I would expect many operators to change their non-compliant consents to conform with the ruling."

EU law on cookie consent dates back much earlier than the GDPR - to the prior Data Protection Directive and the still in force ePrivacy Directive - Article 5(3) of which specifies that for cookies to be used users must give opt-in consent after being provided with clear and comprehensive information (with only a limited exception for 'strictly necessary' cookies).

Although European legislators have been trying for years to agree on an update to the ePrivacy Directive.

A draft proposal for an ePrivacy Regulation was introduced by the Commission at the start of 2017. But negotiations have been anything but smooth - with a blitz of lobbying from the adtech and telecoms industries pushing against a firm requirement for opt-in consent to tracking.

The CJEU's clarity that consent is required to store and access cookies pushes in the opposite direction. And that firm legal line protecting individual privacy from background tracking technologies should be harder for legislators to ignore.

"Today's ruling is likely to have a significant impact on the ongoing negotiations on the ePrivacy Regulation which is set to regulate cookie usage, an issue on which European legislators are struggling to find an agreement," Tosoni said, adding: "In the past, the Court's rulings have had an important impact on the development of the GDPR."

In the meanwhile, the judgement should at least force some of the more cynical and/or stupid cookie banners to be quietly replaced with something that at least asks for consent.

Cookie walls

That said, the ruling does not resolve all the problems around cookie consent.

Specifically the court has not waded into the contentious forced consent/cookie wall issue. This is where a site requires consent to advertising cookies as the 'price' for accessing the sought for service, with the only other option being to leave.

Earlier this year the Dutch DPA deemed cookie walls to be illegal. But the agency's interpretation is open to legal challenge. Only the CJEU can have the final word.

In the Planet49 case the court sidestepped the issue - saying the referring court did not ask it to rule on the question of "whether it is compatible with the requirement that consent be 'freely given', within the meaning of Article 2(h) of Directive 95/46 and of Article 4(11) and Article 7(4) of Regulation 2016/679, for a user's consent to the processing of his personal data for advertising purposes to be a prerequisite to that user's participation in a promotional lottery, as appears to be the case in the main proceedings".

"In those circumstances, it is not appropriate for the Court to consider that question," it wrote.

Likely it's doing so because another case is already set to consider that question. Tosoni says he expects the Orange Romania case - which is pending before the court - to further clarify the requirements of valid consent in the context of it being 'freely given'.

"Some uncertainty on the requirements of valid consent remains. Indeed, in today's judgment, the Court has primarily clarified what constitutes unambiguousand specific consent, but the Court has, for example, not clarified what degree of autonomy a data subject should enjoy when choosing whether or not to give consent for the latter to be considered "freely given"," he said.

"Today's judgment does not provide an answer on the legality of cookie walls, which require consent to access the underlying service. The Court found that it was unable to address this point, as the referring German court had not asked the ECJ to assess the legality of making participation in a lottery - the service at issue in the case - subject to giving advertising cookie consent. Further clarity on this issue may come from the Orange Romania case, which is currently pending before the ECJ."

We've reached out to the IAB Europe for a response to the ruling and to ask what advice it will be issuing to its members. At the time of writing it had not yet responded to these questions.

Today's decision of the EU Court of Justice in the case #Planet49 is a message to the #adtech industry: your business model based on unlawful profiling, forced tracking and unconsented targeted ads is not valid under EU law #ePrivacy https://t.co/BDgRpB0hK2

- Access Now (@accessnow) October 1, 2019