On October 1, the European Court of Justice (the “ECJ”) confirmed recent guidance from the UK and CNIL regulators in finding that the use of pre-checked boxes does not constitute consent for processing of personal information under GDPR.  Specifically, the ECJ found that a pre-ticked box that appeared following a data subject’s election to participate in a lottery/sweepstakes contest was not sufficient to form a lawful basis for processing based on consent.¹  The ECJ stated that “[i]t follows that the consent referred to in Article 2(f) and in Article 5(3) of Directive 2002/58, read in conjunction with Article 4(11) and Article 6(1)(a) of Regulation 2016/679, is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his or her consent.”² This reaffirms recent guidance from the United Kingdom’s Information Commissioner’s Office, which indicates that consent is required prior to the deployment of behavioural advertising cookies on a website.  Specifically, the guidance states “[i]f your service includes cookies used for the purposes of online advertising, you cannot rely on the strictly necessary exemption. Online advertising cookies are not exempt from PECR’s consent requirements and never have been. This includes all third-party cookies used in online advertising, including for purposes such as frequency capping, ad affiliation, click fraud detection, market research, product improvement, debugging and any other purpose.”³

This means that the data subject must perform a “clear affirmative act” to evidence their consent.⁴  For example, checking an unchecked box would constitute a clear affirmative act.⁵   As has now been confirmed, it is not permissible to use pre-checked boxes or simply inform users that the deployment of the cookies is a condition of utilizing the website. 

1. Bundesverban der Verbraucherzerntralen und Verbraucherverbande – Verbracherzentrale Bundesverband eV v. Planter 49 GmbH, (Case C-673/17) (1 October 2019) (available at http://curia.europa.eu/juris/document/document.jsf;jsessionid=27A3F9425DE2AF85DB238B83CED63900?text=&docid=218462&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=1520220).

2. Id. at paragraph 63.

3. See https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf (published 3 July 2019).

4. GDPR, Recital 32.

5. GDPR, Recital 32.

[View source.]