On 1 October 2019, the Court of Justice of the European Union (CJEU) ruled on a number of questions which, inter alia, relate to the validity of consent to cookies "by way of a pre-checked checkbox" (Case C 673/17). Although the questions referred to the CJEU primarily related to provisions of the Privacy and Electronic Communications Directive (2002/58/EG), the CJEU stated that the questions must be answered also in regard to the EU General Data Protection Regulation (GDPR).
Active Consent
The CJEU agreed with Advocate General (AG) Maciej Szpunar's finding that "the requirement of an 'indication' of the data subject's wishes" (Art. 4, No. 11 of the GDPR) pointed to an "active, rather than passive, behavior." Therefore, consent to cookies is not validly constituted if the use of cookies is "permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent." Consent given by way of a pre-checked checkbox does not imply "active behavior on the part of a website user."
In his opinion dated 21 March 2019, the AG also addressed the requirement of a "separate" consent which the CJEU did not consider. The AG opined that for consent to be "freely given" and "informed" (as required, inter alia, under Art. 4, No. 11 of the GDPR), "it must not only be active, but also separate." The requirement of separate consent implies that an activity that a user pursues on the Internet (e.g., reading a webpage) and the giving of consent do not "form part of the same act." In particular, from the perspective of the user, the giving of consent should "not appear to be of an ancillary nature" to the user's' Internet activities. The giving of consent should "optically in particular, be presented on an equal footing" with other actions such as (as in the case before the referring court) hitting a "participation button." Whether the CJEU agrees with the AG's view on the issue on separateness remains to be confirmed.
Informed Consent
Agreeing again with the AG, the CJEU ruled that the website user having "clear and comprehensive information" is a necessary precondition of consent. The required information has to be "sufficiently detailed so as to enable the user to comprehend the functioning of the cookies employed." It should also enable the user to "determine easily the consequences of any consent he or she might give" and, in particular, include "the duration of the operation of cookies and whether or not third parties may have access to those cookies."
Visit us at mayerbrown.com
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2019. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.