The ECJ held a consent requires an opt-in of the user.1 A consent is only valid insofar the user consents in an active and unambiguous manner.
It follows, cookies consent is invalid if a controller is using a pre-ticked checkbox.
In addition, the ECJ requires the controller to inform its users in a comprehensive way and in detail in advance. Before the data will be processed the controller shall inform the user i.a. when the data will be deleted and to which third party the data will be transferred.
It follows, that estimated more than 80 % of consents which are currently used on websites are invalid.
Facts and procedure
The decision goes back to a claim of a German Consumer Agency against a website (Planet 49), which provided a lottery to users in September 2013. Planet 49 used two clickboxes: ‘clickbox No 1’ to accept being contacted by a number of firms for promotional offers and ‘clickbox No 2’ to consent to the installation of cookies on the user device.
‘Clickbox No 1’
‘Clickbox No 1’ was not pre-ticked. With ‘clickbox No 1’ the user agreed that certain cooperation partners may provide the user with offers via post, telephone, email or SMS. The user may select these partners or let Planet 49 select these partners. In addition, the user was informed he may withdraw the consent. A link provided further information with a list of 57 companies including its addresses, commercial sector and the relevant communication line (e.g. email, phone…). An opportunity to unsubscribe required a “sufficient number” of partners otherwise Planet 49 would choose the partners at its own discretion.
‘Clickbox No 2’
The purposes of the cookies were described in a link as enabling a user-friendly and effective advertising. The user has the opportunity to withdraw his “consent”.
In the present case at least ‘clickbox no 1’ had to be ticked by the user to participate in the lottery.
The rationale of the ECJ
The ECJ leaves no doubt that for consent an opt-in as active and unambiguous behaviour by the user is required. Therefore, a pre-selected box is an opt-out and not be regarded a valid consent. It follows, ‘clickbox No 2’ of Planet 49 is invalid. This equally applies for Directive 2002/58 in reference to Directive 95/46 and at the same time in reference to GDPR.
The ECJ requires the controller to provide complete and comprehensive information to the user. Focussed on the question of the German court the ECJ clarified that the storage period of the data and the third party to which the data is transferred shall be part of the information.
Since the storage period is not explicitly mentioned in the non-exhaustive list of Art. 10 of Directive 95/46 the duration of the cookie must be seen as a part the fairness principle. This equally applies of GDPR.
As third aspect the ECJ held whether cookies process personal data is not relevant from the perspective of Directive 2002/58.
The most exiting aspect of the decision is that the decision contents – from a strictly legal perspective – no surprise at all.4 The decision is in most parts a literal interpretation of the wording of Directive 2002/58, Directive 95/46 and GDPR and the respective recitals.
This clarity puts the question to the parties which were provoking the proceeding to the ECJ whether the proceeding to ECJ was really necessary in legal terms.
First, the online business: the disregard of the Right to Privacy and the misinformation of its users is a common pattern of the whole industry. It is not solely a question of different interpretations of the law. The time consuming proceeding from September 2013 on prolongs the period of the abuse of user data by Planet 49 and multiple websites using pre-ticked boxes.
Second, the German government refused to implement the unambiguous amendment of Directive 2002/58 in 2009 into national law. The government ignored the change of the EU-Directive which is simply a breach of the rule of law by the German government.
Third, the German courts have to ask themselves why these courts were not capable to provide a literal interpretation of European Law.
Of course, the ECJ provides an unambiguous statement but not to any aspect of the case. The German court did not ask for an interpretation whether ‘clickbox No 1’ represents a valid consent. It will be exiting to see whether the High Court of Germany (Bundesgerichtshof) is able to subsume ‘clickbox No 1’ as conditional consent according to Art. 7 (4) GDPR on its own behalf – without reaching out to the ECJ. This ‘take it or leave’-approach of Planet 49 is equally common on multiple websites. However, this approach is no consent which is freely given by the user.5
2 According to Art. 5 (3) Directive 2002/58
3 According to Art. 2 (f) in conjuction with Art. 5 (3) Directive 2002/58