Planet 49 (ECJ): most consents for cookies invalid

The ECJ held a consent requires an opt-in of the user.¹ A consent is only valid insofar the user consents in an active and unambiguous manner.

It follows, cookies consent is invalid if a controller is using a pre-ticked checkbox.

In addition, the ECJ requires the controller to inform its users in a comprehensive way and in detail in advance. Before the data will be processed the controller shall inform the user i.a. when the data will be deleted and to which third party the data will be transferred.

It follows, that estimated more than 80 % of consents which are currently used on websites are invalid.

1. Facts and procedure

The decision goes back to a claim of a German Consumer Agency against a website (Planet 49), which provided a lottery to users in September 2013. Planet 49 used two clickboxes: ‘clickbox No 1’ to accept being contacted by a number of firms for promotional offers and ‘clickbox No 2’ to consent to the installation of cookies on the user device.

1. 1. ‘Clickbox No 1’

‘Clickbox No 1’ was not pre-ticked. With ‘clickbox No 1’ the user agreed that certain cooperation partners may provide the user with offers via post, telephone, email or SMS. The user may select these partners or let Planet 49 select these partners. In addition, the user was informed he may withdraw the consent. A link provided further information with a list of 57 companies including its addresses, commercial sector and the relevant communication line (e.g. email, phone…). An opportunity to unsubscribe required a “sufficient number” of partners otherwise Planet 49 would choose the partners at its own discretion.

1. 2. ‘Clickbox No 2’

‘Clickbox No 2’ was pre-selected. The user was informed that he agrees to a web analytics tool and the use of cookies. The cookies are evaluating the surf- and use-behaviour on websites of the advertising partners by selecting an ID to the user. The ads were managed by the web analytics tool.

The purposes of the cookies were described in a link as enabling a user-friendly and effective advertising. The user has the opportunity to withdraw his “consent”.

In the present case at least ‘clickbox no 1’ had to be ticked by the user to participate in the lottery.

2. Legal framework

Directive 2002/58 regulates privacy in electronic communications and i.a. the use of cookies. With the amendment of the directive in 2009 informed consent is required.² Nevertheless, Germany did not implement this adjustment into national law. Directive 2002/58 refers to directive 95/46 on how to declare an informed consent.³ Since May 2018 GDPR is applicable in this respect.

3. The rationale of the ECJ

The ECJ leaves no doubt that for consent an opt-in as active and unambiguous behaviour by the user is required. Therefore, a pre-selected box is an opt-out and not be regarded a valid consent. It follows, ‘clickbox No 2’ of Planet 49 is invalid. This equally applies for Directive 2002/58 in reference to Directive 95/46 and at the same time in reference to GDPR.

The ECJ requires the controller to provide complete and comprehensive information to the user. Focussed on the question of the German court the ECJ clarified that the storage period of the data and the third party to which the data is transferred shall be part of the information.

Since the storage period is not explicitly mentioned in the non-exhaustive list of Art. 10 of Directive 95/46 the duration of the cookie must be seen as a part the fairness principle. This equally applies of GDPR.

As third aspect the ECJ held whether cookies process personal data is not relevant from the perspective of Directive 2002/58.

4. Assessment

The most exiting aspect of the decision is that the decision contents – from a strictly legal perspective – no surprise at all.⁴ The decision is in most parts a literal interpretation of the wording of Directive 2002/58, Directive 95/46 and GDPR and the respective recitals.

This clarity puts the question to the parties which were provoking the proceeding to the ECJ whether the proceeding to ECJ was really necessary in legal terms.

First, the online business: the disregard of the Right to Privacy and the misinformation of its users is a common pattern of the whole industry. It is not solely a question of different interpretations of the law. The time consuming proceeding from September 2013 on prolongs the period of the abuse of user data by Planet 49 and multiple websites using pre-ticked boxes.

Second, the German government refused to implement the unambiguous amendment of Directive 2002/58 in 2009 into national law. The government ignored the change of the EU-Directive which is simply a breach of the rule of law by the German government.

Third, the German courts have to ask themselves why these courts were not capable to provide a literal interpretation of European Law.

Of course, the ECJ provides an unambiguous statement but not to any aspect of the case. The German court did not ask for an interpretation whether ‘clickbox No 1’ represents a valid consent. It will be exiting to see whether the High Court of Germany (Bundesgerichtshof) is able to subsume ‘clickbox No 1’ as conditional consent according to Art. 7 (4) GDPR on its own behalf – without reaching out to the ECJ. This ‘take it or leave’-approach of Planet 49 is equally common on multiple websites. However, this approach is no consent which is freely given by the user.⁵