On Tuesday, October 1st, the EU Court of Justice released the transcript of a judgment explicitly stating that using a pre-ticked box to gain consent to track cookies is an insufficient mechanism to obtain active consent. EU Data Protection Authorities had not provided guidance whether “continued browsing, clicking, or scrolling the web page” was a sufficient action to claim consent. This judgment provides formal clarity on this issue for businesses subject to GDPR.
The Planet49 case pre-dated the GDPR, which explicitly stated in its Recital 32 that silence, pre-ticked boxes or inactivity does not constitute consent. While the European Court of Justice’s interpretation of the law should not come as a surprise to those in the EU, it will certainly require businesses previously relying on implicit consent to make changes to their cookie policies, operations, and online statements. Additionally, the ruling requires entities collecting cookies to inform users how long the cookies will be in operation and whether third parties will have access to the cookies.
This case signals another win for consumer protection groups in the EU and adds clarity to a sensitive and previously unclear issue.