Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

Many companies’ websites use cookies (small text files) to track users’ online content viewing activities. Cookies can be used to do things like save a user’s login credentials to make repeated sign-ins easier, allow a user to leave a web session and return later and find the same product in their shopping cart, or collect information for marketing purposes. Under EU law, websites must obtain users’ consent prior to using cookies.

contentpilot/introduction

On October 1, 2019, the Court of Justice of the European Union (CJEU) issued a highly anticipated decision in a case involving Planet49 GmbH. The case analyzed consent requirements for the use of cookies under the EU’s Privacy Directives and the GDPR, and the CJEU ultimately held that Planet49’s use of a “pre-ticked” box did not meet those requirements.

core/paragraph

Planet49 offered an online lottery service that required interested users to register. The registration form first asked users to tick a box allowing Planet49 to share their data with commercial partners, which was required to participate in the lottery. Next, the form presented users with a pre-ticked box that permitted them to opt out of the use of cookies only if they unticked the box. If they chose to opt out, they could still participate in the lottery. Finally, users were asked to click on the button “participate” to submit their registration form.

The CJEU noted that, to be valid under applicable law, a consumer’s consent must be “unambiguous,” “informed,” “specific” and “freely given.” The court decided that consent obtained using a pre-ticked box did not meet those requirements, although it ultimately declined to analyze whether such consent was freely given because that inquiry was not included in the questions submitted by the lower court.

According to the CJEU, the use of a pre-ticked box makes it impossible to objectively ascertain whether a user had unambiguously given consent to the use of cookies or whether that consent was informed. The court reasoned that a user may not have read or noticed the information accompanying the pre-ticked box. And despite Planet49’s argument that users provided specific consent by clicking “participate,” the CJEU determined that because the action did not relate explicitly to the use of cookies, specific consent was not obtained. The court went on to say that specific consent could not be inferred from an indication of the user’s desire to participate, which suggests that it would consider implied consent (like consent assumed from a continued use of a service) to be unacceptable.

In response to additional inquiries from the lower court, the CJEU also held that the consent requirement applied even if the cookies were not used to collect personal data, and that users must be informed of the duration of the cookies and whether third parties can access them.

In light of the Planet49 decision, companies using cookies to track users’ activities should review their methods of obtaining consent. Clearly, the use of pre-ticked boxes will not be sufficient to comply with EU law, and site owners should disclose key details of any cookies placed by their sites, including information regarding duration and third-party access. That said, companies should be aware that the various data protection authorities do not necessarily agree on the minimum requirements for all aspects of cookie use (such as whether consent is required for analytic cookies or how prominent the options should appear to users), which means that how and when users must provide unambiguous, informed, specific and freely given consent to cookie use are issues that remain to be reconciled. We will continue to monitor developments in this area and keep you informed.

core/heading

Thomas F. Zych 216.566.5605 <a href="mailto:Tom.Zych@ThompsonHine.com">Tom.Zych@ThompsonHine.com</a>

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Craig A. Foster 614.469.3280 <a href="mailto:Craig.Foster@ThompsonHine.com">Craig.Foster@ThompsonHine.com</a>

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/Privacy__Cybersecurity_Update_-_Pre-Ticked_Boxes_to_Obtain_Cookie_Use_Consent_Fail_Under_EU_Law.pdf

“Pre-Ticked” Boxes to Obtain Cookie Use Consent Fail Under EU Law

Services