Newsroom / News / Media / Info Magazine LGP NEWS 01/2020 / Recent ECJ ruling on cookies

Recent ECJ ruling on cookies

Recent ECJ ruling on cookies

At present, there are numerous different ways to ensure that the use of cookies on your website complies with the law. The ECJ’s judgement in case C-673/17 now provides greater clarity by requiring the user’s active consent.

In terms of content, the ECJ dealt with the requirements for the effectiveness of consent within the meaning of the ePrivacy Directive and the Data Protection Directive (now known as the GDPR). In particular, it looked at the question as to whether a pre-selected checkbox (‘opt-out’) constitutes valid consent. In doing so, it unequivocally rejected this widespread approach, while also emphasising that consent must be given actively by means of a ‘clear expression of intent’ and ‘in full knowledge of the facts’ (‘opt-in’). As a result, the use of sham declarations of consent (e.g. ‘By using this website, you consent to the use of cookies’) is actively discouraged, since no consent is given at all in these instances. 

Another aspect needs to be considered when cookies are used: the first step involves distinguishing what kind of cookies are actually involved. Unlike marketing or tracking cookies, no consent is required for the use of cookies that are ‘absolutely necessary’ from a technical perspective (e.g. for the functioning of the website). If consent is required, it must be ensured that cookies are not stored before this is given (e.g. as soon as the website is accessed). According to art. 96 para. 3 of the Telecommunications Act or the ePrivacy Directive and art. 13 GDPR, the information needed by the user so they can understand how the cookies work must also be provided in advance. In this respect, the ECJ also explicitly mentions that the duration of their functioning and potential recipients should be indicated. 

It is also of practical importance that all-encompassing consent may not be obtained: the consent only applies to the specific instance in question. Many of the ‘cookie banners’ currently in use do not meet this requirement. It is no longer sufficient to gain (overarching) consent for all types of cookies, and to provide a simple reference to the privacy policy. Consequently, it is recommended to create comprehensible cookie categories so that data subjects can consent to each of them separately. 

In summary, from a company’s point of view, it is recommended that the cookie solution in use be evaluated. Opt-out solutions, sham consents or blanket consents are still widespread, despite the ECJ’s clear ruling. Nevertheless, the ePrivacy Regulation will also provide more clarity in the future, and solutions may need to be adapted further. This Regulation is intended to provide precisely defined exceptions (e.g. for reach measurements or software updates) and facilitations (e.g. for tracking free content) relating to consent requirements. However, it remains to be seen whether there will be any further changes made before it comes into force. 

Author: 

Mag. Katharina Raabe-Stuppnig, Rechtsanwältin, Managing Partner and Head of TMT at LANSKY, GANZGER + partner

My documents

Add page

There are currently no documents in your basket.