In Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbande Verbraucherzentrale Bundesverband Ev –v- Planet 49 GmbH, the European Court of Justice has decided that cookie consent is only validly constituted if the website user has given his or her consent actively and “consent given in the form of a preselected tick in a checkbox does not imply active behaviour on the part of the website user”. The decision therefore ends the debate about the type and quality of consent which website owners must obtain before they can place cookies on the web browsers of website users.Cookies which are:(i) used for the sole purpose of carrying out the transmission of a communication; or(ii) strictly necessary in order for the website service provider to provide its service to the website userfall outside the remit of the judgment and do not require the consent of the website user to be placed on the user’s browser. Examples of strictly necessary cookies include user input cookies, authentication cookies and multimedia content player cookies such as flash player cookies.The judgment concerns all other types of cookies, i.e non-necessary cookies, which include advertising or tracking cookies that allow website operators to analyse a user’s behaviour and gather information on the user in order to optimise its advertising. Cookies which fall under this non-essential category include any type of advertising cookie, social media cookies and analytical cookies.
Top 3 important takeways from the Judgment – What do Website Operators Need to do for Compliance?
1. Active cookie consent is required if you want to use non-essential cookies.2. The consent requirements apply irrespective of whether the website provider is collecting personal or non-personal data.3. Cookies policies must set out how long the non-essential cookie will be on a browser and whether third parties will have access to the data collected.[smartslider3 slider="57"]
