Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH (2019) Case C‑673/17 is a decision of the Court of Justice of the European Union (CJEU, Court) on the consent requirement for the placement of cookies under Article 2(f) and Article 5(3) of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (‘ePrivacy-Directive’), as amended by Directive 2009/136/EC.
The judgment was based on a request for a preliminary ruling under Article 267 TFEU from the Federal Court of Justice of Germany.
The Court established that a web site cannot legitimately seek consent under the ePrivacy-Directive using pre-ticked checkboxes. The standard established by the General Data Protection Regulation (‘GDPR’) applies to the consent requirement for the placement of cookies under the ePrivacy-Directive. In addition to that, the Court clarified that Article 5(3) of the ePrivacy-Directive does not only apply to the collection of personal data, but to the collection of any information. In response to the second question of the German Federal Court, the European Court of Justice decided that in order to meet the requirement to provide "clear and comprehensive information", the website operator must provide information to the user on the duration of the operation of cookies and whether or not third parties may have access to those cookies.
Facts
Planet49 GmbH (‘Planet 49’) ran a promotional lottery on the website www.dein-macbook.de. Upon entering the lottery, users were required to provide their name, address and post code. They were then presented with two checkboxes. The first checkbox was unchecked and required the consent to receiving third party advertising. It was mandatory for the user to tick this box in order to enter the competition. The second checkbox was pre-checked and allowed Planet49 to set cookies to track the user’s online behaviour using a web analytics firm called Remintrex. Users were able to opt-out of the use of cookies by unchecking the box. They could still participate in the lottery, if they did not consent to the use of cookies.
The German Federation of Consumer Organisation brought an action against Planet49 claiming that the two checkboxes were not compliant with German law requirements and sought an injunction to cease using them against Planet49.
The questions referred to the Court of Justice only concerned the second pre-ticked checkbox.
Ruling
German courts
In the prior proceedings in Germany, the Landgericht Frankfurt am Main (Regional Court) upheld the action for an injunction by the Bundesverband and required Planet49 to cease using such consent declarations. The Oberlandesgericht Frankfurt am Main (Higher Regional Court) upheld the injunction regarding the first checkbox, but held that the statement for the pre-checked checkbox was compliant with the requirements for consent to the use of cookies under the relevant legislation. Both parties have appealed against the decision. The German Federal Supreme Court suspended the proceedings by order of 5 October 2017 and referred various questions to the European Court of Justice on the interpretation of Union law regarding the effectiveness of consent to the setting of cookies by means of a pre-ticked checkbox.
Court of Justice of the European Union
The CJEU first addressed the question, whether consent can be validly obtained under Article 2(f) and Article 5(3) of the ePrivacy-Directive by a pre-ticked checkbox. The CJEU turned to the ePrivacy-Directive and interpreted the term ‘indication’ as a requirement for active behaviour by the user. The Court points out that
It is not sufficient that the users selects the button to participate in the promotional lottery, but the consent must specifically relate to the processing of the data in question. The Court underlines its decision by stating that the GDPR explicitly requires active consent pursuant to Article 4(11) and Article 6(1)(a). Recital 32 of the GDPR expressly precludes "silence, pre-ticked boxes or inactivity" from constituting consent.
Secondly, the German Federal Court asked "whether Article 2(f) and Article 5(3) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46 and Article 6(1)(a) of Regulation 2016/679, must be interpreted differently according to whether or not the information stored or accessed on a website user’s terminal equipment is personal data within the meaning of Directive 95/46 and Regulation 2016/679." The CJEU notes