On October 1,2019 the European Court of Justice ruled that website operators cannot obtain consent to the setting of cookies for advertising purposes by ticking an already checked box (Judgment of October 1,2019, Rs C-673/17).

Much rather, the user must actively tick a checkbox in order to give his consent. The decision of the ECJ applies regardless of whether the data stored in the cookie constitute personal data or not. Another requirement for legally effective consent is that the user has been informed about the duration of the cookie's function and possible access rights of third parties to the cookie.

The background to the court proceedings is a German legal dispute. The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband) had claimed injunctive relief from a lottery provider because, within the scope of participating in a lottery, consent to the setting of cookies was to be obtained by ticking a box. The cookie was used to track the user behaviour of the participants across several websites. However, the ECJ's rulings do not address the special features of cookies, but generally address the issue of consent. The rulings are therefore also applicable to the (still) commonly used cookie banners implemented by website operators to inform users about the installation of cookies and merely provide an option for opting out ("By continuing to use our site, you consent to the use of cookies.").

In its decision, the ECJ did not deal with the question in which cases consent to the setting of a cookie is required. However, the ECJ has defined concrete guidelines for how consent is to be obtained. The decision therefore has no influence on cookies, which are technically necessary for the functionality of a website (login sessions, shopping cart, language settings).

The German Data Protection Conference ("DSK") published a guideline for providers of telemedia services in March 2019 in which it outlined its position on cookies once again. In the opinion of DSK, cookies, which track user behaviour via various websites, cannot be used on the basis of the legitimate interest of the website operator, but only with an active consent.

Practical tip: Website operators should check whether and which cookies are used on the site. Consent must be adapted to the requirements of the ECJ. Cookies, for which consent is to be obtained, must then be inactive before an active consent is given. In the privacy policies, the storage period of cookies must be specified and it must be clarified whether third parties have access to the cookies.