Cookies consent does not escape the GDPR: CJEU issues decision in the Planet49 case

On 1 October 2019, the Court of Justice of the European Union (CJEU) issued its long-awaited decision in the case Planet49 (Case C 673/17). The decision clarifies the requirements for valid cookie consent under Directive 2002/58 (ePrivacy Directive). In particular, the CJEU rejects pre-ticked boxes as a means of providing valid consent to the use of cookies. The CJEU clarifies that valid cookie consent must comply with the consent requirements of the General Data Protection Regulation 2016/679 (GDPR). This clarification does not come as a surprise in view of recent guidance issued by a number of supervisory authorities on the interplay of the ePrivacy Directive and the GDPR as well as local regulator guidance (for instance from the French CNIL or the UK ICO). The court further holds that when consent to the placing of　 cookies is requested, users must be informed about both the operation period of the cookies and whether or not third parties are given access to those cookies.

The CJEU objects to tying cookie consent to the participation in an online lottery but, unlike in the opinion of the Advocate General in this case, the CJEU leaves open the question of whether users may ‘sell’ their personal data in exchange for a service (e.g. to recieve a discount) in other circumstances. Guidance on selling personal data in this context is expected from the European Data Protection Board (EDPB), which considered this issue during its plenary meeting on 10 September 2019.

For a more detailled analysis of the decision please see our full article here.

Authors: Catherine Di Lorenzo, Nigel Parker, Peter Van Dyck, Nicole Wolters Ruckert, Livio Bossotto, Paul Wagner, Elena Cirotti, Anna van der Leeuw-Veiksha