European Union rules require people to actively choose to allow companies to install tracking cookies, judges said in another key ruling on privacy from the EU’s top court.
The EU Court of Justice said in a judgment on Tuesday that the placement of cookies requires the active consent of internet users and that “a box checked by default is therefore insufficient.”
Users’ consent has become more of a sensitive issue following a string of privacy scandals. Under a powerful EU privacy law that took effect in May last year, companies risk hefty fines for inadequately informing users about what data they collect about them and for what purposes, or for failing to actively seek their consent.
Tuesday’s case has its origins in Germany in 2013, when a company called Planet49 organized a lottery for promotional purposes. To access the website, people faced a pre-ticked box that would allow placing cookies — tiny pieces of code that allow advertisers to track users as they surf the internet — on their computer.
A consumer protection organization challenged this as unlawful before a German court, which in 2017 sought the EU judges’ guidance on the scope of consent under the bloc’s data protection rules. To refuse consent, users had to un-tick the box.
The case is: C-673/17, Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband e. V.