A pre-checked checkbox is not enough

Court of Justice of the European Union (CJEU) decided that website user did not given his/her consent to the processing of his/her cookies if he/she only “agreed” with a pre-checked checkbox including the information on consent to the processing of user cookies (the check would need to be unchecked by the user in order to refuse to give the consent).

CJEU emphasized that the consent to the processing of cookies may be given by any appropriate method enabling a freely given specific and informed indication of the user’s wishes. In this particular case, the user selected the button to participate in the promotional lottery and by this method gave his consent to the processing of cookies. In this regard, CJEU decided that it is not an expressly given consent since the user primarily agreed with something else than the processing of cookies.

Besides, CJEU wrote that the information that the service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.

Conclusions in the above judgment are not new – these conclusions were already introduced by the European Data Privacy Board in its opinions. However, these opinions are not formally binding (from a legal point of view), although being normally used as an interpretation source. Thus, the CJEU case law fill in certain legal gap in the situation where the bill on new european legal regulation of e-privacy is not yet complete and, at the same time, confirm that the principles and policies of the GDPR are fully applicable in the field of the Internet.

The full wording of the judgment is here.

< Return