Pre-checked cookie boxes don't count as valid consent, says adviser to top EU court
You can't assume active participation from someone who didn't untick something
Requiring someone to uncheck a pre-ticked box doesn't count as valid cookie consent under EU law, the adviser to the bloc's top court has said.
Advocate general Maciej Szpunar's opinions aren't binding but are often followed by the Court of Justice of the European Union (CJEU). This much-anticipated confirmation of the situation came in a German case about an online lottery run by Planet49 and centres on two checkboxes that confronted would-be players.
The first – a requirement of participation – was unchecked and asked the user to agree to sponsors and partners contacting them with marketing. The second box, asking them to consent to cookies, was pre-selected but not necessary to participate.
The CJEU was asked to rule on whether Planet49 had gained valid consent for the storing of information and gaining access to info stored in the user's terminal equipment – i.e. cookies – with these boxes.
Szpunar concluded there was no valid consent, noting that it made no difference whether the information stored and accessed constituted personal data.
The fact the user must deselect the box to refuse consent doesn't reach the bar that consent is "freely given" and "informed" – companies cannot presume that, by failing to uncheck a box, a user has actively consented to cookies.
Szpunar said it was "virtually impossible to determine objectively" whether a user had provided consent on the basis of a freely given and informed decision by asking that they untick a box. "By contrast, requiring a user to tick a box makes such an assertion far more probable."
He also emphasised that the actions needed for the cookie consent and the participation consent needed to be presented on equal footing – Planet49 couldn't claim valid consent for the former just because someone had engaged in the latter.
In this case, the advocate general said, consenting to cookies "appears ancillary in nature" and "it is in no way clear that it forms part of a separate act".
"Participation in the lottery was not conditional upon giving consent to the installation of and gaining access to cookies," he said. "But, to the best of my knowledge, at no point was the user informed of this. This does not meet the criteria on fully informing users."
The idea that pre-ticked boxes don't meet the bar for consent is not controversial – even adtech industry body IAB Europe issued a statement asserting that the opinion was "unsurprising".
But given how prevalent such activities remain, privacy proponents will welcome this clear confirmation from the EU's top court, and the fact that it has been put into writing.
However, a more controversial element of Szpunar's take was his view on the legitimacy of the consent gained through the first checkbox. He wasn't asked to opine on this issue, but decided to anyway.
In this case, he said, the processing of personal data was necessary for participation in the lottery, effectively saying entry could be conditional on exchange of personal data for marketing – a view that raised concerns on Twitter.
I totally agree. I've read paragraph 99 of the opinion in terror and hope this will not constitute a precedent. But apart from this point: Its a rather pleasing development in our case.— Heiko Dünkel (@heiko_duenkel) March 21, 2019
It is likely this won't set a precedent, though, because the court hasn't been asked to rule on this element of the case. ®
Sponsored: Becoming a Pragmatic Security Leader