The Court of Justice of the European Union (CJEU) has in a recent judgment pre-empted the proposed e-privacy regulation in ensuring that website operators obtain consent by means of clear and affirmative action from the user of a website prior to the setting of any cookies.
Storing cookies requires internet users’ active consent, the CJEU has affirmed and a website operator cannot use a pre-ticked checkbox in order to fulfil their obligations in terms of EU law.
Cookies are files which a website operator stores on the website user’s computer. The operator can then access such files again when the user visits the website another time, in order to facilitate navigation on the internet or transactions, or to access information about user behaviour.
The current e-privacy directive already obliges operators to obtain a user’s consent to be able to store cookies. However, the current law has been often interpreted as a requirement for a simple banner informing of the use of cookies or simply prompting the user to “accept cookies”.
The proposed e-privacy regulation, which has yet to be adopted and which will replace the current directive, is set to change the way in which trackers may ask for consent for setting cookies and tracking users. Among other aspects, it requires a website operator to obtain consent from the user by means of a clear, affirmative action prior to the setting of any cookies. This means that current practices whereby operators simply inform users about the use of cookies or prompt users to “accept cookies” will no longer be acceptable.
The decision of the CJEU has now very much affirmed this obligation on the part of website operators, even before the e-privacy regulation has seen the light of day.
The facts of this case were briefly as follows. The German Federation of Consumer Organisations challenged before the German courts the use by a German company offering online promotional games, of a pre-ticked checkbox in order to obtain consent from users for the storage of cookies.
The current e-privacy directive already obliges operators to obtain a user’s consent to be able to store cookies
The cookies in question aim to collect information for the purposes of advertising the company’s partners’ products. The German court seized of the case filed a preliminary reference before the CJEU requesting the latter court for guidance as to how the EU e-privacy directive – when read in conjunction with certain provisions of the GDPR – ought to be interpreted.
The court affirmed that the consent which a website user must give to the storage of and access to cookies on their equipment, is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse their consent. This has nothing to do with whether the information stored or accessed on the user’s equipment can be considered as personal data.
EU law aims to protect the user from any interference with their private life, and particularly, from the risk that hidden identifiers and other similar devices enter the users’ terminal equipment without their knowledge.
The court maintained that not only must the consent of the user for the storage of cookies by a website operator be specific but the operator must also provide the user information as to the duration of the operation of cookies and whether or not third parties may have access to those cookies.
Since the e-privacy regulation has not yet been adopted, the final word is yet to be said about its direct implications for website owners and their use of cookies. In the meantime, we stand to be guided by this ruling of the CJEU and website operators ought to ensure compliance when storing cookies on users’ terminal equipment.
Mariosa Vella Cardona, M’Jur, LL.D., is a freelance legal consultant specialising in European law as well as competition law, consumer law, data protection law and intellectual property law. She is also a visiting examiner at the University of Malta.
mariosa@vellacardona.com