Planet49 and EU GDPR

Try Cookiebot CMP free for 14 days… or forever if you have a small website.

Are cookies allowed to be pre-checked?

The official press release from the CJEU evaporates any confusion: it is titled Storing cookies requires internet users’ active consent and makes it clear that “a pre-ticked checkbox is therefore insufficient”.

Any cookies not strictly necessary are prohibited from being pre-checked, regardless of whether the data processed is categorized as personal.

EDPB guidelines on valid consent

In May 2020, the European Data Protection Board (EDPB) adopted guidelines on valid consent in the EU. The EDPB guidelines support the CJEU’s ruling in the case of Planet49, but also covers other aspects of what constitutes valid consent under the GDPR.

The EDPB guidelines specify that:

• No pre-ticked checkboxes allowed on consent banner.
• Scrolling and continued browsing is not valid consent.
• Cookie walls (forced consent) is not valid consent.

Learn more about the EDPB guidelines on valid consent

CJEU and Planet49

The Court of Justice of the European Union (CJEU) is the highest legal body in the EU. It is made up of two courts, the Court of Justice and the General Court – the former comprised of one judge from each EU country plus eleven advocates general, the latter two judges with eleven advocates general.

The CJEU interprets EU law to make sure it is applied in the same way in all EU countries, settle legal disputes between national governments and EU institutions, and in this case, interprets EU law to set legal precedents.

The case of Planet49

To understand the context of the CJEU ruling on valid consent in the EU, let’s briefly explain the case of Planet49.

It sounds like a sci-fi novel from the 1950s but is in fact a German online gaming company that in 2013 organized an online promotional lottery that required users to give personal information in order to participate.

The input fields, where users were to enter in their data, were accompanied by two bodies of explanatory text and by checkboxes, one of which was pre-checked.

The German Federation on Consumer Organizations challenged Planet49’s practice of obtaining consent in the German courts, and eventually asked the CJEU to interpret EU law to clarify whether consent by pre-checked boxes is a valid form of consent in general across the Union.

The judgement that came on Tuesday October 1, 2019 from the CJEU cleared away any doubt to the case of Planet49, but what’s more: it also creates a strong precedent for how EU privacy legislations are to be interpreted alongside each other.

The CJEU’s complete judgement in English.

CJEU ruling on valid consent

The CJEU’s ruling can be understood as a thread that weaves together the ePrivacy Directive of 2002 (amended in 2009), the older 1995 Directive and the General Data Protection Regulation (GDPR) of 2018.

These EU privacy legislations aim to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.

The CJEU ruling concerns the interpretation of Article 2(f) and Article 5(3) of the ePrivacy Directive 2002/2009, read in conjunction with Article 2(h) of the 1995 Directive and Article 6(1)(a) of the General Data Protection Regulation.

Explicit consent is the only valid consent in EU, CJEU rules

The CJEU ruled that the abovementioned articles must be interpreted to mean that consent is not valid if given by way of pre-checked checkboxes which the users must deselect to refuse their consent.

All user data require same explicit consent

The CJEU also ruled that the articles from the EU privacy legislations are not to be interpreted differently according to whether or not the information stored or accessed is personal data.

Obligation to inform of duration and third-party access

Furthermore, the CJEU also ruled that websites and service providers must inform their users on the duration of the cookies on their website, and whether or not third parties have access to user data.

Summary on CJEU and valid consent

The only valid form of consent for processing user data in the EU is explicit consent. Pre-checked checkboxes on website cookie banners are a no-go, except for strictly necessary cookies.

Consent must be specific and given actively by the user by ticking a box, not by de-ticking a box that is already ticked. Consent is also only valid if the users have been informed about the duration of the cookies in operation, and whether any third parties will have access to their data.

Explicit consent vs. Implied consent

Now you might be wondering what to do about your website’s consent management and how to be sure that you are compliant with the CJEU ruling that is binding in all 28 EU member states?

Let’s sort out the terminology…

Explicit consent is also known in the CJEU’s ruling as active consent, because it regards consent as an action on part of the end-user that is active, affirmative and specific.

Explicit consent

Explicit consent has been known so far as the specific type of consent that a website must obtain, when processing sensitive personal information (such as political convictions, religious beliefs, health data).

However, with the CJEU ruling, all user data – regardless of whether it’s personal or sensitive or neither – is only to be processed after the end-users have given their explicit consent, also called active consent in the official ruling by the CJEU.

Implied consent

Implied consent, on the other hand, is the type of consent that has so far been valid in the EU, if your website only processes personal data (not sensitive personal data).

This type of consent is also known as soft opt in. If a user visits a website and is presented with a cookie consent banner but chooses not to click “okay” but instead to keep scrolling or visits another subpage on the domain, this activity on part of the users constitutes valid consent, even if the user is not aware of it.

This type of consent is no longer valid in the EU.

However, it is still a form of consent that is valid in other privacy legislations around the world, such as the Brazilian LGPD that was closely modelled after the EU GDPR.

Before the ruling, a valid consent banner could have pre-checked boxes for necessary, preference and statistical cookies – marketing cookies could not.

With the CJEU ruling, only necessary cookies are allowed to be pre-checked.

Consent management on your website

With the CJEU ruling, websites are not allowed to have cookie consent banners with pre-checked checkboxes. We here at Usercentrics, the parent-company of Cookiebot CMP, are on the front of the privacy fight, protecting the privacy of your end-users while bringing balanced and thorough consent management to your website.

Cookiebot CMP is a consent management solution that scans your domain and finds all cookies and trackers, blocks everything until our end-users have given their explicit consent and then securely stores all user consents for legal documentation.

Cookiebot CMP enables your website to be compliant with the CJEU ruling (with the ePrivacy Directive and the GDPR), as well as other data privacy laws around the world, from the CCPA to the LGPD.

Try the Cookiebot CMP solution for free today.

Consequences for you, the website owner/operator

The CJEU ruling has consequences for almost all websites in the EU, regardless of size and shape, if they use cookies that aren’t only strictly necessary for their most basic operation.

The CJEU ruling also has consequences for websites outside of the EU. If your website is located outside of Europe, but you have European users and therefore process data of European citizens, you are obligated to follow the CJEU ruling.

You must obtain the explicit consent of EU citizens before setting any cookies on their devices that aren’t strictly necessary.

Analytics and valid consent

It is also no surprise that compliance with the CJEU ruling means significant changes to how you might be running your website.

If you use Google Analytics, Matomo or similar analytics tools, as most websites around the world do, to optimize your website and its operations, this ruling can cripple your insight and statistics flow.

Why? Well, you can’t have pre-checked checkboxes on your cookie consent banner, apart from the strictly necessary ones. This means that you will have to rely on your users to opt in to those categories that serve you statistical and analytical information about their behavior on your domain.

To be compliant with the EU privacy precedent from the CJEU means much stronger and more real privacy for EU end-users, but – probably – a loss in analytical data about your users for your website.

For now, this is the new privacy landscape in the EU. It undoubtably increases the anticipation for the long-awaited ePrivacy Regulation, as we wait to see whether it consolidates this privacy development or moves the legal frontier once more.

FAQ

Resources

The official press release on the ruling from the Court of Justice of the European Union

The full judgement from the CJEU

Digest of the CJEU ruling by the global lawfirm Hogan Lovells

Europe’s top court says active consent is needed for tracking cookies, TechCrunch

What is the GDPR?

What practical impacts do recent CJEU rulings have on adtech?, privacylawblog by lawfirm Fieldfisher