Cookie Consent – Heald Solicitors - Commmercial Law Firm
Select Page

Cookie Consent

Useful guidance on the lawful use of cookies 


The Advocate General of the Court of Justice of the European Union (the CJEU) has provided us with some guidance on the lawful use of cookies. A cookie is a piece of software which a website downloads onto a user’s PC or another device to enhance the user’s experience of using the website. Under EU law the user’s consent must be obtained before a cookie is downloaded.

In the Planet49 case, a German company ran an online lottery service. Before using the service, users had to positively tick a box indicating they agreed to Planet49 sharing their data with its commercial partners. A second, pre-ticked, box allowed the user to opt-out from the use of cookies (by unticking the box). The case raised two issues: – (1) Can consent to the use of cookies be obtained by means of a pre-ticked box? (2) What does a cookie policy need to say?

On the first issue, in the Advocate General’s view the pre-ticked box was not a legally effective way to obtain consent to cookie uses under the e-Privacy Directive. To be valid, consent must be shown by a clear affirmative act. A pre-ticked checkbox does not suffice. The consent must be separate and may not be “bundled” with other consents. In the Advocate General’s view, that is what had happened here. Finally, the Advocate General indicated that he considered that the consent requirement for cookies applies to all data collected regardless of whether or not it qualifies as personal data.

Turning to the contents of a cookie policy, in the Advocate General’s view the information provided should enable the user to easily understand how the cookies function and the consequences of giving consent. The information should also include the duration of the cookies and the identity of any third parties who will be given access to the cookies.

A number of caveats need to be made about this Opinion. Firstly, the main focus of the Opinion was the e-Privacy Directive. However, the Advocate General indicated that the position would be the same under the new General Data Protection Regulation (which became law on 25th May 2018). This is almost certainly the case.

Secondly, the CJEU does not have to adopt the Advocate General’s Opinion but it very often does so. Finally, there is the uncertainty of the ever-present spectra of Brexit looming over everything. However, it seems fairly clear that whatever happens there will probably be little change to UK data protection law.  Even taking such points into consideration, however, the Opinion provides very useful guidance on the lawful use of cookies.

You may also be interested to read the following blogs 

Why bother with consent? 

Lessons from the supply chain

To find out more, please contact David Dees on 01908 662277