Websites that ask visitors to accept cookies by means of a check box should not pre-check that box, according to an advice to the European Court of Justice. The user would thus not have given active consent.
So says Advocate General Maciej Szpunar in his advice to the European Court. According to Szpunar, the law states that users must have clearly given their consent for the cookies. That means the action must be active. When a checkbox is already checked, users have not actively chosen to accept cookies, the Pool states.
The Advocate General’s opinion was given prior to the hearing of the case by the European Court of Justice. That received questions from a German judge about the interpretation of EU law in a case between the German consumer association and lottery organizer Planet49. The EU Court almost always follows the advice of the Advocate General.
In September 2013, Planet49 had published a lottery. To participate, users came to a page where they had to enter their name and address. Below those fields were two electives. The first course was about whether users gave permission for Planet49 to give certain data to sponsors, so that those sponsors could approach the user for commercial offers. This box was not checked in advance, but it was mandatory for participation. The second box asked whether the site was allowed to place analytical cookies. This box was not mandatory for participation, but it was checked beforehand.
The lottery provider was of the opinion that the permission to place the cookies was clear, as the user also had to actively press a participation button to participate in the lottery. Szpunar disagrees, saying that the act of consenting to cookies should be separate from all other actions. Just as continuing to use a site does not give permission for the placement of cookies, participation in a lottery also does not give permission for the placement of cookies, says the Advocate General.
In a response, IAB Europe says it does not find the Advocate General’s findings surprising. “There were many ambiguities in the law, but this was not one of them. Publishers, advertisers or technology companies who are surprised by this statement should see it as a subtle hint to improve their data protection.”