CURIA rules pre-checked cookie consents invalid

The Court of Justice of the European Union (CURIA) has ruled that a pre-ticked checkbox is not sufficient for advertisers and online service providers to claim active consent from their users when it comes to data collection and cookie storage.

The Court of Justice of the European Union (CURIA) has been deliberating on a case, referred to it by the German Federal Court of Justice, against gambling and advertising specialist Planet49, which hosts lottery-style competitions on its website. Those entering the contents had cookies stored on their system for the purposes of targeted advertising from Planet49 partners, and in what the company claimed was a legally-correct interpretation of European Union guidelines on user consent featured a pre-ticked checkbox underneath the entry form. If the checkbox was left ticked, either because the user was willing to be tracked or because the user hadn't noticed its presence, the cookies were stored and the tracking and advertising took place.

CURIA has now ruled that Planet49's interpretation of the law is wrong, and that a pre-ticked checkbox does not give the required consent. 'The court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent,' a statement from the court released this morning explains.

'That decision is unaffected by whether or not the information stored or accessed on the user's equipment is personal data. EU Law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users' terminal equipment [computer] without their knowledge,' the statement continues. 'The Court notes that consent must be specific so the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies. Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.'

The ruling effectively outlaws the use of pre-checked consent boxes on website throughout Europe. Planet49, the entire business model of which relies on users consenting to tracking and advertising on the promise of the chance at a free TV or holiday, has not commented on the ruling.