Data Privacy HubA LINK TO THE FULL JUDGEMENT CAN BE FOUND HERE.
On 1 October 2019, the CJEU ruled on the question of consent for cookies under the ePrivacy Directive (Directive 2002/58/EC) and the GDPR (Regulation (EU) 2016/679) in Case C-673/17, Planet49. The judgment covered some topics which are of relevance to online advertising, such as which actions could be considered as ‘active’ behaviour to signify consent, and whether advertising identifiers can be considered personal data.
Planet49 GmbH organised a promotional lottery online. In order to take part, internet users had to enter their postal code, and subsequently provide their name and address. Alongside the input fields there were two text boxes accompanied by a checkbox.
The first text explained that the user, by clicking the checkbox, indicated their consent to sponsors and ‘partners’ of Planet49 contacting the user about offers - in simple terms, the user was asked to consent to receiving direct marketing by those companies. This first text was not accompanied by a pre-selected checkbox.
The second text indicated the user’s consent to the use of a web analytics service being used which placed cookies. Those cookies would be used by Planet49 to ‘evaluate’ surfing and use behaviour on websites of advertising partners’ - enabling interest-based advertising. The checkbox accompanying this text was pre-selected (pre-ticked), and participation in the lottery was only possible if at least the first checkbox had been selected.
The German Federation of Consumer Organisations brought an action against Planet49 for this, asserting that these declarations of consent did not satisfy the requirements of the law in place at the time. The Case was appealed numerous times, before the German Federal
Court of Justice referred the question to the CJEU as this issue depends on the interpretation of the ePrivacy Directive’s cookie provision as well as the definition of consent under the GDPR (and previously, the data protection directive).
First the CJEU clarifies that the German Federal Court of Justice had noted that the cookies described by Planet49 contain an identifying number, linked to the registration data of the user (name and address). Such linking means that the collection of this data by means of cookies constitutes processing of personal data, which was also confirmed by Planet49. Hereby, the CJEU confirms that consent is required in this situation.
In discussing whether a pre-ticked checkbox can be considered a valid method of providing consent, the CJEU considers that ‘only active behaviour on the part of the data subject’ can signify consent, leading the CJEU to conclude that it is impossible in practice to objectively ascertain whether a user gives consent by ‘ not deselecting a pre-ticked checkbox’.
While Planet49 considered that the act of choosing to participate in the promotional lottery indicated the user took an action signifying consent,the CJEU did not consider that this would satisfy the requirement for consent to be specific. In other words, consent has to be given specifically to the use of advertising cookies, rather than being considered as part of consenting (or choosing) to take part in a lottery.
In this case the CJEU provided clarity on the definition of personal data and on what constitutes an affirmative action signifying consent. For the former, the CJEU formally acknowledged the interpretation that cookie identifiers, tied to personal information about users such as browning history and identifiers, constitute personal data. This is clearly relevant to our industry as it confirms that most data gathering techniques used in the industry fall within the scope of the GDPR.
Additionally, the CJEU’s discussion of what constitutes an affirmative action is helpful in understanding how consent can be given validly in an online context. Essentially, by describing that there must be a way to objectively ascertain that consent has been given specifically to a particular data processing purpose, we know that consent must be indicated through an observable and recordable action in close proximity to the text which describes what the user is consenting to.
For Germany specifically, this judgment has had a bigger impact. In the German Federal Court of Justice’s final ruling on the Planet49 case, they have now confirmed that Section 15(3) TMG should be read as requiring an opt-in - in line with the requirements of the GDPR and with the application of the cookie consent requirement of the ePrivacy Directive as implemented in other EU Member States.
While the GDPR already clearly states that ‘pre-ticked’ boxes can never constitute valid consent, the German legal situation was somewhat more complicated. There is a general consent requirement for placing cookies in the ePrivacy Directive, which was to be transposed into national law in all the EU Member States. However, in Germany’s implementation law, the Telemediagesetz (TMG), Section 15 (3) provided that cookies could be placed for tracking purposes as long as an opt-out was provided. This was effectively overturned by the CJEU, and subsequently confirmed by the German Federal Court of Justice on May 28th, 2020.
