The Court of Justice of the European Union in its Judgment in Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände ̶ Verbraucherzentrale Bundesverband eV v Planet49 GmbH, confirmed “that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent.”

This, the Court says, is regardless of whether or not the user’s information that is accessed and/or stored can be considered personal data.

“EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge. The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies. Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.”

The Court of Justice of the European Union has clearly reaffirmed the fundamental elements of valid cookie consent which is informed (including, duration of the operation of cookies and whether or not third parties may have access to those cookies); an affirmative action (no opt-out); specific (not coupled with other manifestations of user will, e.g., to participate in a promotional lottery); and its application regardless of whether or not the user’s information that is accessed and/or stored can be considered personal data.

The full text of the decision is available here.