On October 1, 2019, the European Union Court of Justice notably ruled on the type of consent required by a consumer in order to store cookies on their device. The case involved a promotional online lottery organized by Planet49, a German company. To enter into the lottery, consumers were prompted to consent to being sent various promotional materials as well as having cookies put on their device for targeted advertisements. The checkbox for giving consent to Planet49’s storing cookies was pre-checked, and consumers had to uncheck the box to indicate refusal. The main issue for the Court was whether, under the EU data privacy regulations including the General Data Protection Regulation (GDPR), the use of a pre-checked box was a valid form of consent for storing cookies.

The GDPR has defined consent as “a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action,” and the Court clarified that the consent required is a form of “active” consent. The ruling stated that obtaining consent by use of a pre-checked box does not constitute active consent, but requiring a user to affirmatively check a box to show consent does.

This ruling is of particular importance to any business who operates an EU-facing website. These businesses should evaluate their current procedures for obtaining consumer consent to store cookies. According to the recent decision, two common forms of consent will not be sufficient: (1) the use of a pre-checked box and (2) a cookie banner that states that consent to store cookies is assumed by the consumer browsing the website and not otherwise affirmatively indicating his or her consent.