European Court: Websites need to obtain explicit users' consent before tracking them with cookies
Planet49 was accused of using a pre-checked consent box as an authorisation to store cookies on users' machines
Pre-checked consent boxes shown by websites for storing cookies on a computer are not legally valid, the European Court of Justice has ruled.
According to the Court, user's consent on cookies cannot be assumed or implied, and websites must obtain specific and active consent from users before dropping cookies on their device.
The ruling stems from a 2013 case, in which a consumer group accused online lottery website Planet49 of displaying a pre-checked consent box at its login page and using it as authorisation from users to store cookies on their machines.
The German Federation of Consumer Organisations (VZBW) said that Planet49 was checking the consent box on users' behalf, which was illegal as the permission didn't come as an explicit consent from users.
Moreover, consenting to cookies was not compulsory to participate in the competition.
According to VZBV, this activity by Planet99 was completely illegal.
The case was filed in the German Federal Court of Justice but was later transferred to the European Court of Justice, as the German Court wanted the ruling to be given in relation to European Union's laws on users' privacy.
The case lasted for about a year in the European court, which passed its final judgement on 1st October.
"The court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent," the court said in its order [pdf].
It also ruled that websites needed to fully inform users about how long the cookies would remain active on their systems, and if third parties would also access users' data.
The ruling is likely to spark a new debate on users' online privacy and the degree to which websites can be allowed to track their users.
Many social media firms, such as Twitter and Facebook, currently use implicit cookie consent, where, by using a website, are users deemed to have provided their consent to storing website cookies on their system.
In July, the US Federal Trade Commission fined Facebook $5 billion for violating a 2012 settlement by sharing users' data with political consultancy Cambridge Analytica.
The FTC opened its investigation in March 2018, following claims that data from approximately 87 million Facebook users had been acquired by Cambridge Analytica.