Cookies 2019 Year in Review: Planet49
In 2019, there were many global developments on the use of website cookies. Over the next couple of weeks, we'll feature a series providing cookie updates that were made in certain regulations this year.
As 2019 comes to a close, CookiePro is looking back on some of the biggest headlines of the year covering all things cookies. Over the next couple of weeks, we’ll feature a series providing cookie updates that were made in certain regulations and frameworks. This week, we’ll highlight the Court of Justice of the European Union (CJEU) ruling on Planet49.
CJEU Ruling on Planet49
On October 1, 2019, the CJEU issued its judgement on the Planet49 case. The case that led to the ruling dates back to 2013 when a company called Planet49 had a promotional lottery in Germany that required users to consent to the storage of cookies before playing the game.
Here are the three top things you need to know:
Active Consent is Now Required
The Planet49 Judgment highlights that it would appear impossible in practice actual consent to the the processing of their personal data is the user deselects a pre-ticked checkbox.
The Planet49 Judgment notes that it’s possible a user may not read the information accompanying the pre-checked checkbox, or may not notice that checkbox before continuing with their activity on the visited website.
As a result, a pre-checked checkbox (when a user must deselect to refuse their consent) is not considered a lawful way to obtain consent for the storage or access of cookies.
Interpretation of Personal Data
The Planet49 Judgment highlights that the interpretation of the ePrivacy Directive should not differ according to whether or not the information stored or accessed on a website user’s terminal equipment constitutes personal data.
According to Recital 24 of the ePrivacy Directive, any information stored on the user’s terminal equipment is part of their own private sphere and requires protection under Article 8 of the European Convention on Human Rights.
As a consequence, information stored in electronic communications networks must be protected, regardless of whether it is personal data within the meaning of the Data Protection Directive and the GDPR.
Clear and Comprehensive Information is Required
In addition, the Planet49 Judgment ﬁnds that information regarding the duration of cookies’ operation and whether or not third parties may have access to those cookies shall be included in the clear and comprehensive information presented to the user.