Users consent must actively consent to online tracking cookies: European Court of Justice

The European Court of Justice (ECJ) has ruled that internet users need to give active consent and not mere opt-out of an automatic default that would otherwise plant cookies in the users’ device’s system. With this ruling, online companies in the European Union (EU) can no longer present internet users with a pre-checked box telling them cookies will be planted on their smartphone or computer if they don't deselect the option.

Cookies are small pieces of computer code that are downloaded into a user’s device to track what sites they visit, how they interact with them, and potentially other bits of information.

A German court had asked for guidance of an EU law protecting privacy through electronic communications to which the ECJ gave this ruling. The ruling stems from a 2013 case when the German Federation of Consumer Organizations took legal action against online lottery company Planet49, which had a pre-ticked checkbox to authorize the use of cookies. The cookies – data sent from a website and stored on a user’s computer – collected information to help target advertisements for products offered by Planet49’s commercial partners - a common methodology used by online companies.

The consumer organization argued this was illegal because the authorization did not involve explicit consent from the user.

The Norwegian Research Center for Computers and Law at the University of Oslo said in a statement that the ruling is “likely to have a significant impact on the ongoing negotiations on the ePrivacy regulation which is set to regulate cookie usage”.

Major internet companies, such as Facebook and Twitter currently have implicit cookie consent, where by using the site, consent is deemed to have been given.

The ruling comes with authorities in Europe, and increasingly in the United States and elsewhere, grappling with how to protect citizens’ privacy online as internet companies gather and cross-reference information garnered from web use. The ECJ also ruled that service providers had to furnish complete information to users, including how long the cookies would operate for and whether third parties would have access to gathered data.