Federal Court of Justice rules: Cookies may only be placed with users’ active consent

Anyone wishing to place cookies on internet sites for advertising purposes may only do so with the user’s active consent. Preset ticks for cookie consent are not sufficient for this purpose. This has been confirmed by the Federal Court of Justice (FCJ) in its ruling from 28th May 2020 in the case brought by the Federation of German Consumer Organisations (German: Verbraucherzentrale Bundesverband) against the company Planet49.

The decision from the FCJ brings much longed-for clarity in the matter of “cookies for creating user profiles for advertising or market research”. In doing so, the FCJ follows the judgement of the European Court of Justice (ECJ). Following a preliminary ruling issued by the ECJ in October 2019 (after presentation by the FCJ regarding the format of consent), it is now abundantly clear that only active consent given by the user represents a valid legal basis for the processing of personal data.

The FCJ confirmed that pre-ticked boxes are not sufficient for obtaining valid consent. Any entity wanting to use cookies on websites for advertising purposes must obtain users’ active and informed consent at all times. Invalid actions (like pre-ticked boxes or the assumption of consent just from continuing to use the website) are not considered valid consent and are not compliant with the GDPR and other privacy laws.

The case of Planet49 has taken up the time of various courts since 2013. Background: In an online raffle from the company Planet49, pre-ticked boxes consenting to the use of cookies had been placed on the registration page. Users who did not wish to consent had to actively remove the ticks. The Federation of German Consumer Organisations regarded this as illegal and filed a lawsuit. The Higher State Court in Frankfurt am Main saw no legal infringement in its ruling from 2015. The FCJ then requested the ECJ to interpret the EU data protection requirements.

In short, companies wishing to use cookies on their websites for advertising purposes may only do so
with informed, explicit and, above all, prior consent. Pre-ticked declarations of consent do not suffice
for this purpose, according to the FCJ.

A video of today’s ruling can be found here.

Authors: Jana Krahforst, Carolin Weißofner, Theodora Zamanakou, Legal Team Usercentrics

DISCLAIMER

The decision to implement a data protection-compliant CMP is ultimately at the discretion of the data protection officer and/or the legal department. These statements do not constitute legal advice. They merely serve to support and inform you about the current legal situation with respect to the implementation of a CMP solution. Please consult a qualified lawyer should you have any legal questions.