CJEU’s judgement of 1st of October 2019 in the case C-673/17(Planet49) clarifies that a website user must provide his or her consent for the use of cookies by way of an “active”, rather than “passive” behavior. The consent is not validly constituted if the storage of information in the website user’s terminal equipment is permitted by way of a checkbox which is pre-ticked by the service provider and which the user must deselect in order to refuse his or her consent. In order to meet the conditions for a valid consent it is necessary the action of actually “ticking” the checkbox for consent.
Moreover, the duration of the operation of the cookies and whether or not third parties may have access to those cookies form part of the clear and comprehensive information which must be provided to the user.
Website service providers and operators should review cookie notices and checkboxes to assess whether they comply with these requirements for an informed consent.
The legal texts which have fallen under the CJUE’s analysis were, inter alia, articles 2 and 7 of the Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, articles 4 and 6 of the Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and articles 2 (f) and 5 (3) of the Directive 2002/58 concerning the processing of personal data and the protection of privacy in the electronic communication sector.
You may consult the judgement of the Court at the following link:
http://curia.europa.eu/juris/document/document.jsf?docid=212023&doclang=en
