‘Active consent’ needed for cookies, says top European court

Users must give their active and specific consent to have cookies stored. This is regardless of whether or not the information stored or accessed is personal data, the court said, because EU law aims to protect people from ‘interference with their private life'.

It added that service providers must inform users how long the cookies will be in operation for, and whether or not third parties may have access to the cookies.

The ruling came following a 2013 case over the German company Planet49’s use of a pre-ticked checkbox. Users who wanted to participate in an online promotional game were required to consent to cookies. Germany’s federal court of justice asked the CJEU to make a decision on the case, which pre-dated GDPR.

The decision is likely to influence the ongoing reform of the ePrivacy regulation, which was due to come into place alongside GDPR in May 2018 but has been delayed. It is expected to be implemented from late 2019.