Privacy & Information Security Law Blog

On March 21, 2019, Advocate General Maciej Szpunar (“Advocate General”) of the Court of Justice of the European Union (“CJEU”) issued an Opinion in the Case C-673/17 of Planet49 GmbH v Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V. (i.e., the Federation of German Consumer Organizations, the “Bundesverband”), which is currently pending before the CJEU. In the Opinion, the Advocate General provided his views on how to obtain valid consent to the use of cookies in the case.

Background

Planet49 organized a lottery, and provided a would-be Internet participant with two pre-ticked check boxes, one of which granted consent to the use of cookies. According to the Bundesverband, this consent did not satisfy the requirements set forth under the German Civil Code, the German Law Against Unfair Competition and the German Telemedia Act, which transposes the EU Directive on Privacy and Electronic Communications (“the ePrivacy Directive”). The Bundesverband initiated proceedings against Planet49 in 2014.

In 2017, the German Federal Court of Justice asked the CJEU the following questions: (1) whether a pre-ticked check box that the user must deselect to refuse the use of cookies was a valid consent within the meaning of the ePrivacy Directive, the EU Data Protection Directive and the EU General Data Protection Regulation (the “GDPR”); and (2) what information does the service provider have to give with respect to the use of cookies, and must that information include the duration of the cookies and whether third parties are given access to the cookies.

The Opinion

On the first question (regarding the validity of the consent to the use of cookies), the Advocate General stated that to be valid, consent must be manifested by a clear affirmative act. Pre-ticked check boxes are insufficient to establish that consent has been freely given. In addition, the Advocate General stressed that to be valid, consent must be separate. In this context, this means that participating in the lottery and consenting to the use of cookies cannot form part of the same act (i.e., the actions must be presented separately). Accordingly, bundled consent would not be valid.

The second question asked what information service providers must give regarding cookies. According to the Advocate General, clear and comprehensive information implies that the user is able to easily determine the consequences of any consent he might give. Information that is clearly comprehensible is not subject to ambiguity or interpretation. Further, information must be sufficiently detailed so as to enable the user to comprehend how the cookies function. Accordingly, the Advocate General declared that such information should include the duration of the cookies, whether third parties are given access to cookies, and, if so, the identity of such third parties. These pieces of information are, according to the Advocate General, indispensable in ensuring that informed, and hence valid, consent is granted.

Next Steps

The CJEU’s Grand Chamber will issue a final judgment in the case. While the Advocate General’s Opinion is not binding on the CJEU, it is highly influential.