CJEU: "opt-out" language does not create valid cookie consent - Austria

On 1 October 2019 the Court of Justice of the European Union ("CJEU") provided guidance on whether website operators may obtain consent to the use of cookies via a preselected tick-box.

1 Background of the case

A German company organised a promotional lottery on its website. It obtained the consent of the participants to store certain cookies by implementing a preselected tick box. Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV (Federation of German Consumer Organisations), which is entitled to bring court proceedings in case of breaches of - inter alia - consumer law, challenged whether such pre-selected checkbox satisfies the requirements of German Law against Unfair Competition and Law on telemedia.

The Federal Court of Justice expressed doubts on the validity of a consent obtained through a pre-selected checkbox and referred the case to the CJEU (provisions for clarification had been: Article 5(3) and Article 2(f) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46 and Article 6(1)(a) of Regulation 2016/6791).


2 Outcome

The outcome is good for consumers and bad news for traders.

The CJEU ruled as follows:

• The consent to the use of cookies obtained by way of a preselected checkbox does not satisfy data protection law requirements.
• It does not make any difference whether or not the information stored or accessed on a website user’s terminal equipment is personal data.
• In general terms the CJEU clarified that users must be provided with clear and comprehensive information. Thus, the service provider is obliged to give information on the duration of the operation of cookies and whether or not third parties may have access to those cookies.

Most notably for the present case, the CJEU has expressed doubts whether a user in fact reads the information accompanying the preselected checkbox or whether he will even take notice of it. The CJEU therefore concluded that a preselected checkbox does not establish valid consent.

This ruling is particularly interesting in light of a most recent ruling of the Austrian DP regulator. There the regulator deemed cookie storage lawful which essentially was based on a website's explanation that it delivers services for free but, in exchange, asks for cookie storage. It remains to be seen whether such solutions may persist in light of the transparency requirements the CJEU has now imposed on cookie consent.

3 Comments

The CJEU gives no indication on the technically necessary cookies, for which consent is not necessary. A website operator will therefore need to take precise technical measures in order to differentiate between the technically necessary cookies and unnecessary ones.

This decision will have a major impact on providers using cookies. Many service providers need to customise their websites and their cookie consent in order to comply with this decision. Not least to mention, it certainly gives strong guidance on the still lingering ePrivacy Regulation. It may be expected that this Regulation, once it comes into force, will set forth an "opt in" regime for cookie placement.

Authors: Wolfgang Tichy, Günther Leissler and Serap Aydin

_____________________________________________

1 Directive 2002/58/EC = Directive on privacy and electronic communications; Directive 95/46/EC = on the protection of individuals with regard to the processing of personal data and on the free movement of such data (EU) 2016/679 = General Data Protection Regulation.

---------

We're on top of legal developments in Austria and CEE. Are you? Subscribe to our weekly updates!