The CJEU noted that, to be valid under applicable law, a consumer’s consent must be “unambiguous,” “informed,” “specific” and “freely given.” The court decided that consent obtained using a pre-ticked box did not meet those requirements, although it ultimately declined to analyze whether such consent was freely given because that inquiry was not included in the questions submitted by the lower court.
In response to additional inquiries from the lower court, the CJEU also held that the consent requirement applied even if the cookies were not used to collect personal data, and that users must be informed of the duration of the cookies and whether third parties can access them.
In light of the Planet49 decision, companies using cookies to track users’ activities should review their methods of obtaining consent. Clearly, the use of pre-ticked boxes will not be sufficient to comply with EU law, and site owners should disclose key details of any cookies placed by their sites, including information regarding duration and third-party access. That said, companies should be aware that the various data protection authorities do not necessarily agree on the minimum requirements for all aspects of cookie use (such as whether consent is required for analytic cookies or how prominent the options should appear to users), which means that how and when users must provide unambiguous, informed, specific and freely given consent to cookie use are issues that remain to be reconciled.