For Cookies Fans: The EUCJ’s Decision in the Planet49 Case

The European Court of Justice (EUCJ) ruled in case C‑673/17 – the Planet49 case, published today – that pre-checked boxes through which users are asked to grant consent to the use of advertising cookies do not satisfy the requirements of Directive 95/46/EC (the predecessor of the GDPR) and Directive 2002/58/EC (the e-Privacy Directive) as amended by Directive 2009/136/EC (the Cookie Directive).

The EUCJ clarified that consent regarding cookies, specifically those cookies which are placed in the end user’s terminal equipment for advertising purposes, and where the data collected is being shared with third parties, required an affirmative consent of the user. But the consent also must be informed, meaning specifically that operators of such cookies must comprehensively inform the user about the duration of the operation of the cookies and whether third parties may have access to information collected through those cookies.

So – How does this relate to privacy icons? The latest e-Privacy Regulation draft published by the Council of the EU on 18 September 2019 mentions privacy icons several times:

• Draft Recital 41 – in connection with the empowerment of the European Commission to adopt delegated acts “in order to give an easily visible and intelligible overview of the collection of information emitted by terminal equipment, its purpose, the person responsible for it and of any measure the end-user of the terminal equipment can take to minimise the collection”
• Draft Article 8(3) – in connection with general transparency requirements regarding the collection of data
• Draft Article 8(4) – in connection with delegated acts by the Commission to determine “the information to be presented by the standardized icon and the procedures for providing standardized icons”
• Draft Article 19(2)(e) – concerning the European Data Protection Board’s task of providing the Commission with an opinion on icons subject to delegated acts pertaining to fulfilment of transparency obligations under draft Article 8.

The e-Privacy Regulation is expected to replace the e-Privacy Directive and the Cookie Directive. The requirement of an affirmative, active and informed consent to cookies is likely to persist, with the EUCJ’s decision in the Planet49 case looming large.

Under the forthcoming e-Privacy Regulation, both the European Commission and the EU Data Protection Board can become active in implementing icons as part of the EU data protection regulatory scheme.