1. Skip to content
  2. Skip to main menu
  3. Skip to more DW sites
Crime

Users must give 'active consent' for cookies

October 1, 2019

Websites would need to obtain active and specific consent from users before storing cookies on their device, the ECJ has ruled. The case started with a lottery website checking the consent box on users' behalf.

https://p.dw.com/p/3QaTV
A protester at a 2015 rally in Berlin holds up a sign reading "Big Data? Big Brother!"
Image: Imago/IPON

Accepting cookies means giving "active consent" where users explicitly agree to host the information-gathering software, the European Court of Justice (ECJ) said in a ruling announced on Tuesday.

The EU's top court sided with a German consumer group, which launched the case against an online gambling website in 2013. The Planet49 company pre-checked the box confirming the user was consenting to cookies on their website at the login page for an online lottery. Consenting to cookies was not obligatory to take part in the competition, but the consent option was pre-checked unless a user de-selected it. The VZBV group argued that this was illegal.

On Tuesday, the ECJ said websites needed explicit and specific consent under the EU privacy laws.

"A pre-ticked check box is therefore insufficient," the court said in the press release.

Additionally, the cookie providers are also required to tell users how long the information-gathering will last and which, if any, third parties can access them.

Read more: A safer internet and the stupid things we do online

Implicit consent on Facebook and Twitter

Cookies serve to collect information that websites then use to target ads to individual consumers. Usually, the information is sold to commercial partners of the website.

EU privacy law — new era in data protection

The VCBV's legal expert, Heiko Dünkel, said the ruling would help digital privacy.

The so-called tracking cookies enable a "thorough evaluation of surfing and online behavior of users," he said.

Many digital giants, including Facebook and Twitter, use implicit cookie consent, where they deem that users have consented to storing cookies simply by using their websites' services.

Read more: Is it time to #DeleteFacebook?

Tuesday's ruling is likely to have a large impact on the global debate about online privacy. The EU started enforcing additional privacy protections in May 2018 with its General Data Protection (GDPR) regulation, which says companies must ask for users' consent via "an intelligible and easily accessible form," and allow them to easily withdraw it.

dj/msh (Reuters, AP, AFP)

Every evening, DW sends out a selection of the day's news and features. Sign up here.