ECJ case C-673/17 (Planet49)

Opt-out does not constitute valid consent

Today, 1 October 2019, the Court of Justice of the European Union (ECJ) ruled that an opt-out, i.e. the deselection of a pre-ticked checkbox, does not meet GDPR requirements for obtaining consent for cookies under data protection law. In addition, website operators must inform whether third parties can access cookies and how long cookies are actively used on the terminal device.

Controllers should critically examine whether consent meets the requirements of the ECJ and whether they inform properly on the use of cookies.

Background of the ruling

The decision of the ECJ is based on the reference for a preliminary ruling of the Federal Court of Justice (BGH) of 5 October 2017 (Ref.: I ZR 7/16). The Federation of German Consumer Organisations – Verbraucherzentrale Bundesverband e.V. (vzbv) had first issued a warning to Planet49 GmbH and subsequently claimed injunctive relief before the Frankfurt Regional Court, since Planet49 GmbH had obtained, among other things, consent to the use of a website analysis service by means of a pre-ticked checkbox.

The Frankfurt Regional Court ruled in favour of the vzbv. However, the appeal of the defendant Planet49 GmbH before the Frankfurt Higher Regional Court against this ruling was successful. The Higher Regional Court overturned the decision of the first instance on this point and ruled in favour of the defendant Planet49 GmbH. The BGH had to decide on the appeal on a point of law, suspended the legal dispute and referred the questions now decided by the ECJ to the Court of Justice of the European Union.

Need for action for website operators and other controllers

Website operators who currently use cookies with opt-out need to review this practice. In the opinion of the court, the dropping cookies, which require consent, actually require consent that is explicit, i.e. the setting of a tick or a slide switch, etc. In future, simply ‘surfing on’ despite notification or pre-set consent will no longer suffice in these cases. The German supervisory authorities had also taken a stand on the use of cookies in April 2019 (guidance for telemedia providers, only available in German).

In addition, cookie policies and privacy statements should be reviewed to ensure that the catalogue of information that the ECJ considers necessary is fully reflected. In the opinion of the ECJ, information on the duration of the operation of cookies and whether or not third parties may have access to those cookies.