A pre-ticked box is not a satisfactory way for internet users to give consent for cookie storage, the European Court of Justice ruled on Tuesday in the European Union’s latest decision on online data privacy.
The EU’s top court said that internet users must give express consent for the storage of cookies, or traces of a user’s browsing activity.
The case involves a German company called Planet 49, which ran online promotional games.
When users logged on to their site, they would encounter a pre-selected tick box giving permission for the storage of cookies – files that a website provider stores on a user’s computer to make browsing the web easier or to access data on a user’s behaviour.
Users would, therefore, have to untick the box to stop cookie storage.
Planet 49’s cookies aimed to gather information intended for marketing of the company’s partner products, according to the ECJ.
The Luxembourg judges argued that the use of pre-selection was not a valid way of establishing consent because it was not “specific”.
The fact that users were playing an online promotional lottery was not enough to conclude they gave their permission to host cookies, the court found.
A German consumer umbrella association had launched a complaint in Germany’s Federal Court of Justice against the firm’s policy, which then asked the ECJ for guidance on interpreting EU privacy law.
It is now up to the national court to decide how to implement the ruling in the Planet 49 case.
Last year, the EU put into force the General Data Protection Regulation, governing how institutions collect and use data from online users.
