On 1 October 2019, the Court of Justice of the European Union published its judgement for a case involving the online gaming company, Planet49. The judgement provides some helpful clarifications on the laws surrounding the use cookies, and in particular:

  1. Where consent is required for cookies under the EU’s e-Privacy Directive (2002/58/EC), the GDPR standard of consent applies, and pre-ticked boxes are not valid. Under the GDPR, ‘consent’ must be freely given, specific, informed and an unambiguous indication of the individual’s wishes by a clear affirmative action.
  2. The court issued a reminder that the consent rules for cookies as outlined in the e-Privacy Directive apply regardless of whether any personal data is processed by the cookie.
  3. Website operators must inform users about the duration of the cookie (e.g. how long it will last on a user’s device) and any third party access and sharing.

This article was written by Melissa Hall for the American Bar Association's 'Business Law Today: Month-In-Brief'.