Cookies require the active consent of internet users

The Court of Justice of the EU’s ruling, made on the 1st of October 2019, finally clarified whether an internet user must give active, affirmative consent to allow a website to store and access cookies. The answer is a resounding “yes”.

The Court of Justice of the EU clarified that consent to store cookies is not valid if it has been given using pre-ticked boxes which the user must deselect to refuse his or her consent. Implied consent, such as the oft used disclaimer “If you continue on this website, you accept the cookies”, also does not constitute a valid consent.

For consent to be valid, it must meet all the requirements of the GDPR, meaning it must be freely given, informed, specific and unambiguous. As for the requirement of being informed, the Court of Justice of the EU clarified that the service provider must also inform the user about the duration of the operation of cookies and whether third parties have access to those cookies or not.

This court ruling has significant implications for all companies that run their business via website. Many current terms and notifications for the use of cookies, as well as consent request forms, will have to be changed to comply with present requirements. This, however, shall be a challenge if website owners wish for consent provision to remain user-friendly.