Consent requirements regarding cookies (Planet49 case) (Advocate General)

On 21 March 2019, Advocate General Szpunar (“AG”) issued some clarifications about consent requirements with regard to cookies in the Planet49 case pending before the Court of Justice of the European Union (Case C-673/17, Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.).

The facts: before hitting the participation button of a promotional online lottery organised by Planet49, the user had to enter his name and address and, beneath these fields, there were two sets of checkboxes accompanied by explanatory texts. One required the user to consent to cookies being installed on their computer (by unticking the box) while the other required the user to agree to being contacted by a certain number of firms for promotional offers (by ticking the box).

Consent is defined in Article 4(11) of the General Data Protection Regulation 2016/679 (“GDPR”), as “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. The AG, while applying Directive 2002/58/EC as amended (“e-Privacy Directive”) either in conjunction with Directive 95/46/EC or with the GDPR (respectively for situations before and after the 25 May 2018), has advised regarding ‘cookies checkbox’, that there is no valid consent in a situation such as the case at hand “where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent and where consent is given not separately but at the same time as confirmation in the participation in an online lottery”. Indeed, according to the AG, pre-ticked boxes do not provide a guarantee that users have read the information and have therefore given their consent freely. Moreover, there is no separate consent since decisions to participate in the lottery and consent to the installation of cookies were made simultaneously. Additionally, the user was not fully informed that participation in the lottery was not conditional upon giving consent to such installation and gaining access to cookies.

According to the AG, this interpretation is also valid whether or not the information stored or accessed constitutes personal data.

The AG, while applying transparency requirements and informed consent concept considered that since the average internet user would not be expected to have a high level of knowledge on how cookies work, the clear and comprehensive information that a service provider has to give to a user “implies that a user is in a position to be able to easily determine the consequences of any consent he might give”. This means that the information must be clear, comprehensible and unambiguous for such an average internet user. To this end, the AG is of the opinion that when access to the cookies is granted to third parties, the clear and comprehensive information that a service provider must give to a user must include the information on that access as well as the duration of the operation of these cookies.

The Court will deliberate and make a judgement at a later date. Even though the judges are not bound by the AG's observations, the legal solution he suggests, offers them a certain direction to take into consideration.

This may also interest you :

• Consent requirements regarding cookies (Planet49 case) (CJEU)