Court decision · 1 October 2019
Planet49 GmbH v Bundesverband der Verbraucherzentralen
Case C-673/17, ECLI:EU:C:2019:801 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
Consent checkboxes and cookie toggles must default to off, and the banner must disclose cookie duration and third-party access.
What happened
An online lottery used a pre-ticked checkbox to obtain consent for cookies placed for advertising. The Court examined whether that constituted valid consent under the ePrivacy Directive read with the GDPR.
What was decided
Consent to storing or accessing cookies is not valid when given through a pre-ticked checkbox the user must deselect; this applies whether or not the data is personal data, and users must be told how long cookies last and whether third parties can access them.
The legal test applied
- Storing or accessing information on a user's device requires prior consent unless strictly necessary (Art. 5(3) ePrivacy)
- Consent must be an active, unambiguous indication of wishes (Art. 4(11) GDPR); a pre-ticked box is not consent
- The rule applies whether or not the information stored or accessed is personal data
- Users must be told the duration of cookies and whether third parties can access them
What would have changed the outcome
- Cookies strictly necessary for a service the user requested are exempt
- An unticked opt-in shown before any non-essential storage satisfies the test
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.