In a preliminary ruling from the European Court of Justice, the court has ruled that the acceptance of cookies on websites requires active consent.
The case before the court concerned an online contest in which, when registering for the contest, it was required to accept cookies. The acceptance was given in advance, as the checkbox on the website whereby cookies were accepted was already ticked (the so-called opt-out solution). The question before the court was whether this scheme on the website could be regarded as a valid consent to the website’s use of cookies by the users who registered for the contest. In its decision, the CJEU considered that active consent is required before consent can be considered valid. It is clear from the General Data Protection Regulation that consent must be a voluntary, specific, informed and unambiguous expression of intent, according to which it assumes active user behaviour.
By using a pre-ticked checkbox on a website, it cannot be ruled out that the user in question has not read the information that accompanied the checkbox and it cannot be ruled out that the user has not consented. Therefore, valid consent requires an active action on the part of the user. The CJEU also considered that the requirement of active consent includes all information and not just personal data, as article 5(3) of Directive 2002/58 (e-Privacy Directive) refers in general to 'information'.
Furthermore, the case also dealt with the question of the extent of the undertakings’ obligation of disclosure concerning the requirement for adequate information about the use of cookies. Here it was emphasised that the user easily must be able to determine the consequences of any consent and also that the information must be clearly understandable and sufficiently detailed to enable the user to comprehend the functioning of the cookies employed. The ruling can be of great importance to many companies, as several websites are using pre-ticked checkboxes for the user's acceptance of cookies – the so-called "opt-out" solution for accepting cookies.
We, therefore, recommend checking up on the company's website(s) to see if it complies with the CJEU's stricter requirements for accepting cookies. "Opt-out" solutions can no longer be used with pre-ticked checkboxes. Instead, an "opt-in" solution should be used where the user can tick a box to accept cookies. In addition, attention should be given to whether sufficient information has been provided to users of the same website about cookies and their function.
