Blog

The majority of websites will need to be redesigned due to the European ruling that bans pre-ticked cookie consent forms under GDPR.

The Court of Justice of the European Union (CJEU) recently ruled that storing cookies requires internet users’ active consent. According to the CJEU, it’s not enough just to present website users with a pre-checked box and demand them to click it to opt-out.

“That decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data,” says the CJEU in a statement.

"EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge."

Accordingly, this ruling produced extensive consequences for the digital media business, especially advertisers and media owners. Pre-ticked forms for cookies on websites have been ruled incapable of legally gathering consent to track consumers.

The Story Behind

The story originates from a legal case that German Federation of Consumer Organizations led against German lottery site Planet 49. Namely, the lottery company requested players to consent to pre-ticked cookies to access its game. There were two checkboxes, one that wasn’t pre-ticked and asked for consent on being contacted by sponsors. A second checkbox was pre-ticked and asked users to consent to have cookies set down on their device, for purposes of providing targeted advertisements.

Consumer organization argued that the lottery company didn’t legally gather consent, because the approval did not involve explicit consent from the user. German Federal Court of Justice referred to the EU’s highest court to rule on the case and interpret EU laws on internet privacy.

CJEU decided that “the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent”. This ruling actually confirmed that EU law aimed to protect consumers from interference with their private lives.

Lottery company didn’t inform users that cookies may have access to their personal data nor they allowed clear access to analyze cookie partners. Therefore, the court ruled that “pre-ticked checked box is insufficient” and that cookie consent must be explicit and specific.

The ruling of CJEU started discussions in scientific community as well as in big internet companies. Luca Tosoni, a research fellow at the Norwegian Research Center for Computers and Law at the University of Oslo said in a statement that the ruling is “likely to have a significant impact on the ongoing negotiations on the ePrivacy regulation which is set to regulate cookie usage.”

The Impact on the Website Owners

The EU court also ruled that service providers had to fully inform users, including how long the cookies would operate and whether third parties would have access to gathered data.

So, we will see how things will unroll in the future. Especially if one of the largest internet companies, such as Facebook and Twitter currently impose implicit cookie consent. This is going to be big. Just imagine an average internet user going through tens of different consent boxes and evaluating all your advertising partners. This is just a millisecond away from losing him for good. We just hope this will not be the case in any near future.