The Court of Justice of the European Union (CJEU) published a judgment that echoes the recent developments discussed in our August update, "New Developments in EU for Cookies and Online Tracking." This is an important decision because it is binding on all EU Member States and provides clarity on consent requirements that are widely applicable to websites subject to EU privacy laws. Although this decision is under the Data Protection Directive (95/EC/45), the predecessor to the General Data Protection Regulation (GDPR), and the E-Privacy Directive (2002/58/EC), the issues addressed in this case will remain relevant—and subject to increased potential penalties—under the GDPR and, eventually (if enacted), the E-Privacy Regulation. 

Here are the key takeaways:

• Websites subject to EU privacy law must obtain active consent for cookies. It is not sufficient to obtain consent via a pre-checked box.
• Consent for cookies must be specific: in this judgment, the CJEU noted that “the fact that a user selects the button to participate in the promotional lottery organized by that company cannot therefore be sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.”
• The judgment also provides that website operators must inform individuals of the duration of the operation of the cookies and whether or not third parties may have access to cookies.  

If your website or online service currently has a cookie consent mechanism and a cookie notice, we recommend taking a fresh look in light of this opinion and to revise as appropriate to bring it in line with the CJEU’s requirements. If not, we recommend assessing the applicability of the GDPR and E-Privacy Directive to your website or online service and moving forward with implementing a cookie consent mechanism if required. This decision underscores the importance of cookie compliance.