1. Does it constitute a valid consent[1] if the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent? Does it make a difference whether the information stored or accessed constitutes personal data?

The Court ruled that:

• the storing of information, or the gaining of access to information already stored, in the terminal equipment of a user is only allowed on condition that the user concerned has given his or her consent, having been provided with clear and comprehensive information[2], about the purposes of the processing; and
• consent given in the form of a pre-selected tick in a checkbox does not imply active behaviour on the part of a website user. It is not sufficient if the user must object (by un-ticking the checkbox) to the use of cookies.

As a result, the consent is not validly expressed if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent.

The Court noted that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies. 

Consent should be separate rather than bundled as the provision of personal data was necessary for participation in the lottery. 

The principle of consent applies irrespective of the nature of the data stored, whether personal or not. Consent requirements therefore also apply to the processing and storage of information that is not personal data.

2. How is the provision by the service provider of “clear and comprehensive information” to the user to be defined[3]? Does this include:

• the duration of the operation of the cookies; and
• whether third parties are given access to the cookies?’

In both cases, the answer is: “Yes.” The “clear and comprehensive information” that service providers are obliged to give to users must include the duration of the operation of cookies and whether or not third parties may have access to those cookies.

To sum up:

Accepting cookies means giving "active consent” which seems not to be in line with the mechanism of consents that are obtained by a user’s decision to continue accessing or using a website.

It is therefore necessary to audit how your company obtains cookie consent to ensure a valid use of cookies.

In this context, the future ePrivacy Regulation that is intended to complement the GDPR in strengthening the privacy and security in electronic communications should impose more duties than might have been expected.

[1]  C-673/17 ECLI:EU:C:2019:801 Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH.

[2] within the meaning of Article 5(3) and Article 2(f) of Directive [2002/58], read in conjunction with Article 2(h) of Directive [95/46

[3] in accordance with Article 5(3) of Directive [2002/58]