Case C‑673/17
Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV
v
Planet49 GmbH
(Request for a preliminary ruling from the Bundesgerichtshof)
Judgment of the Court (Grand Chamber) 1 October 2019
(Reference for a preliminary ruling — Directive 95/46/EC — Directive 2002/58/EC — Regulation (EU) 2016/679 — Processing of personal data and protection of privacy in the electronic communications sector — Cookies — Concept of consent of the data subject — Declaration of consent by means of a pre-ticked checkbox)
1. Approximation of laws — Telecommunications sector — Processing of personal data and the protection of privacy in the electronic communications sector — Directive 2002/58 — Cookies — Consent of the data subject — Definition — Declaration of consent by means of a pre-ticked checkbox — Precluded
(European Parliament and Council Regulation 2016/679, Arts 4(11) and 6(1)(a); European Parliament and Council Directives 95/46, Art. 2(h), and 2002/58, as amended by Directive 2009/136, Arts 2(f) and 5(3))
(see paragraphs 49-58, 60-63, operative part 1)
2. Approximation of laws — Telecommunications sector — Processing of personal data and the protection of privacy in the electronic communications sector — Directive 2002/58 — Cookies — Consent of the person concerned — Definition — Whether or not information stored or accessed is personal data — Irrelevant
(European Parliament and Council Regulation 2016/679, Arts 4(11) and 6(1)(a); European Parliament and Council Directives 95/46, Art. 2(h), and 2002/58, as amended by Directive 2009/136, Arts 2(f) and 5(3))
(see paragraphs 68-71, operative part 2)
3. Approximation of laws — Telecommunications sector — Processing of personal data and the protection of privacy in the electronic communications sector — Directive 2002/58 — Cookies — Requirement that clear and comprehensive information be given by the service provider — Meaning — Duration of the operation of cookies — Included — Whether or not third parties may have access to the cookies — Included
(European Parliament and Council Directive 2002/58, as amended by Directive 2009/136, Art. 5(3))
(see paragraphs 74-81, operative part 3)
Summary
Storing cookies requires internet users’ active consent
In a judgment of 1 October 2019, Planet49 (C‑673/17), the Grand Chamber of the Court held that consent to the storage of or access to information in the form of cookies installed on a website user’s terminal equipment is not validly constituted if given by way of a pre-checked checkbox, irrespective of whether or not the information in question is personal data. Furthermore, the Court made clear that the information that the service provider must give to an internet user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.
The case in the main proceedings concerned a promotional lottery organised by Planet49 on the website www.dein-macbook.de. Internet users wishing to take part in that lottery were required to enter their names and addresses on a web page with checkboxes. The checkbox authorising the installation of cookies contained a preselected tick. In an appeal brought by the German Federation of Consumer Organisations, the Bundesgerichtshof (Federal Court of Justice, Germany) harboured doubts as to the validity of the consent obtained from internet users by means of the preselected checkbox and as to the extent of the information obligation owed by the service provider.
The request for a preliminary ruling concerned, in substance, the concept of consent referred to in the Directive on privacy and electronic communications, (1) read in conjunction with Directive 95/46 (2) and the General Data Protection Regulation. (3)
First, the Court observed that Article 2(h) of Directive 95/46, to which Article 2(f) of the Directive on privacy and electronic communications refers, defines ‘consent’ as being ‘any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’. It noted that the requirement of an ‘indication’ of the data subject’s wishes clearly points to active, rather than passive, behaviour. However, consent given in the form of a preselected tick in a checkbox does not imply active behaviour on the part of a website user. Furthermore, the legislative origins of Article 5(3) of the Directive on privacy and electronic communications, which provides as amended by Directive 2009/136 that the user must have ‘given his or her consent’ to the storage of cookies, seems to indicate that user consent may no longer be presumed but must be the result of active behaviour on the part of the user. Finally, active consent is now provided for in the General Data Protection Regulation, (4) Article 4(11) of which requires an indication of the data subject’s wishes in the form of ‘clear affirmative action’ and recital 32 of which expressly precludes ‘silence, pre-ticked boxes or inactivity’ from constituting consent.
The Court therefore held that consent is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent. It added that the fact that a user selects the button to participate in the lottery in question cannot therefore be sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.
Second, the Court stated that Article 5(3) of the Directive on privacy and electronic communications aims to protect the user from interference with his or her private sphere, regardless of whether or not that interference involves personal data. It follows that the concept of consent is not to be interpreted differently according to whether or not the information stored or accessed on a website user’s terminal equipment is personal data.
Third, the Court noted that Article 5(3) of the Directive on privacy and electronic communications requires that the user concerned has given his or her consent, having been provided with clear and comprehensive information, inter alia, about the purposes of the processing. Clear and comprehensive information implies that a user is in a position to be able to easily determine the consequences of any consent he might give and ensure that the consent given is well informed. In that regard, the Court held that the duration of the operation of the cookies and whether or not third parties may have access to those cookies form part of the clear and comprehensive information which must be provided to a website user by the service provider.