## Facts

- A consumer protection association sought an injunction against a company operating an online promotional lottery that used checkbox-based “consent” for marketing and cookies.
- To enter the lottery, users provided personal details on a registration page displaying two consent declarations.
- The first checkbox (for third-party marketing contact) was unticked; users had to tick it, and participation was conditioned on accepting at least this marketing consent.
- The second checkbox (for storing/reading cookies for tracking and interest-based advertising via an analytics service) was pre-ticked; users had to untick it to refuse cookie use.
- The cookies included an identifier linked to the user’s registration data, enabling tracking tied to identified participants.
- The national supreme court referred questions to the Court of Justice of the European Union on whether pre-ticked cookie consent is valid, whether the answer depends on whether data are “personal,” and what information must be given to users.

## Issues

1. Whether consent to store or access cookies is valid when obtained through a pre-ticked checkbox that the user must deselect to refuse.
2. Whether the validity requirements for cookie consent differ depending on whether the information stored/accessed is personal data.
3. What “clear and comprehensive information” must be provided to users for cookie consent, including whether duration and third-party access must be disclosed.

## Decision

- The Court held that consent for cookie storage/access is not valid when given via a pre-checked checkbox that requires user inaction to accept and action only to refuse.
- The Court held that the interpretation does not change based on whether the information stored/accessed is personal data.
- The Court held that the information duty requires, at minimum, disclosure of cookie duration and whether third parties may access the cookies.

## Legal Principles

- Valid consent for cookie storage/access requires an active, unambiguous indication of wishes; passive conduct (such as leaving a pre-ticked box selected) is insufficient.
- Cookie consent standards apply regardless of whether the information involved qualifies as personal data, because the rule targets interference with the user’s terminal equipment.
- Consent must be informed; “clear and comprehensive information” includes the cookies’ duration of operation and the identity or categories of third parties with access.
- Consent must be specific to the processing operation; agreement to participate in a promotion does not, by itself, constitute consent to unrelated tracking or cookie-based advertising.

## Conclusion

The Court required opt-in consent for cookies through an affirmative user action and held that websites must provide users with clear information, including cookie lifespan and third-party access, with these requirements applying even when the stored/accessed information is not personal data.


Bundesverband der Verbraucherzentralen & Verbraucherverbände v. Planet49 GmbH, Case C-673/17 (C.J.E.U. 2019)