Today, 1 October 2019, the Court of Justice of the European Union (ECJ) ruled that an opt-out, i.e. the deselection of a pre-ticked checkbox, does not meet GDPR requirements for obtaining consent for cookies under data protection law. In addition, website operators must inform whether third parties can access cookies and how long cookies are actively used on the terminal device.
Background of the ruling
The decision of the ECJ is based on the reference for a preliminary ruling of the Federal Court of Justice (BGH) of 5 October 2017 (Ref.: I ZR 7/16). The Federation of German Consumer Organisations – Verbraucherzentrale Bundesverband e.V. (vzbv) had first issued a warning to Planet49 GmbH and subsequently claimed injunctive relief before the Frankfurt Regional Court, since Planet49 GmbH had obtained, among other things, consent to the use of a website analysis service by means of a pre-ticked checkbox.
The Frankfurt Regional Court ruled in favour of the vzbv. However, the appeal of the defendant Planet49 GmbH before the Frankfurt Higher Regional Court against this ruling was successful. The Higher Regional Court overturned the decision of the first instance on this point and ruled in favour of the defendant Planet49 GmbH. The BGH had to decide on the appeal on a point of law, suspended the legal dispute and referred the questions now decided by the ECJ to the Court of Justice of the European Union.
Need for action for website operators and other controllers
In addition, cookie policies and privacy statements should be reviewed to ensure that the catalogue of information that the ECJ considers necessary is fully reflected. In the opinion of the ECJ, information on the duration of the operation of cookies and whether or not third parties may have access to those cookies.