April 1, 2019

In order to participate in a lottery organised by Planet49 GmbH, an internet user was confronted with two checkboxes which had to be clicked or unclicked before he could hit the “participation button”.

One of the checkboxes required the user to accept being contacted by a range of firms for promotional offers and the other required the user to consent to cookies being installed on his computer.

The Bundesverband der Verbraucherzentralen (Federation of German Consumer Organisations) issued proceedings in the Frankfurt Regional Court requesting that Planet49 stop using the declarations of consent associated with the checkboxes.

The matter eventually reached the Federal Court of Justice (the Bundesgerichtshof) on a point of law in relation to the use of cookies.

The Bundesgerichtshof referred various questions to the CJEU on the interpretation of Articles 5(3) and 2(f) of the e-Privacy Directive (2002/58/EC), read in conjunction with Article 2(h) of the Data Protection Directive (95/46/EC), and of Article 6(1)(a) of the General Data Protection Regulation (2016/679/EU).

Interpreting the relevant legislation and case law, the AG said that there is no valid consent where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox that the user must deselect to refuse his consent and where consent is given, not separately, but at the same time as confirmation to participate in an online lottery. This was true whether Articles 5(3) and 2(f) of the e-Privacy Directive are read in conjunction with either the Data Protection Directive or the GDPR.

In the AG’s view, requiring a user to actively un-tick a box and therefore become active if he does not consent to the installation of cookies does not satisfy the criterion of active consent. In that situation, it is virtually impossible to determine objectively whether or not a user has given his consent on the basis of a freely given and informed decision, as required by the legislation. By contrast, requiring a user to tick a box makes the assertion far more probable.

Secondly, participation in an online lottery and the giving of consent to the installation of cookies cannot not form part of the same act. In this case, the user was only required to click once on the participation button in order to participate in the lottery. At the same time, he consented to the installation of cookies. These two expressions of participation should not both be subject to the same participation button, the AG said. In this case, consenting to cookies was ancillary in nature, in the sense that it was in no way clear that it formed part of a separate act. In other words, (un)ticking the checkbox on the cookies was a preparatory act to the final and legally binding act which was hitting the participation button.

In that situation, a user was not in a position to freely give his separate consent to the storing of information or the gaining of access to information already stored in his terminal equipment.

Further, participation in the lottery was only possible if at least the first checkbox had been ticked. As a consequence, participation in the lottery was not conditional upon giving consent to the installation of and gaining access to cookies: a user could just click on the first checkbox in order to participate.

At no point in the process was the user informed of this. Therefore, the criteria of fully informing users had not been met.

In the AG’s view, it made no difference whether the information stored or accessed constituted personal data or not.

Finally, the AG said, the clear and comprehensive information a service provider has to give to a user, under Article 5(3) of the e-Privacy Directive, includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies or not. (Case C-673/17 Planet49 GmbH v Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e V, EU:C:2019:246 (Advocate General Opinion) (21 March 2019) — to access the Opinion in full, go to the curia search form, type in the case number and follow the link).