Pre-checked cookie consent boxes are not legal says top EU court

Josh Hall's picture

Active consent must be obtained before non-essential cookies are stored or accessed, the top European court has confirmed.

In a ruling the Court of Justice of the European Union found that websites that simply give information about cookies, rather than seeking explicit content, are operating illegally.

This means that pre-checked consent boxes are not sufficient to comply with GDPR.

Embedded rich media on Twitter

It is still common for sites to declare their use of cookies, with a link for the user to read more information, meaning that large numbers of businesses have been found to be operating outside the law.

As TechCrunch report, the Court of Justice ruling relates to a case involving lottery website Planet49, which had been referred to it by a German court.

It confirmed a previous ruling that a user's lack of explicit opposition to the use of cookies is not sufficient to constitute consent.

In a statement the Court of Justice said: "In today’s judgment, the Court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent.

"That decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.

"The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.

"Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies."

Digital City Festival has launched

Five days of events showcasing the best of digital in the North