On 1 October 2019, the Court of Justice of the European Union published its judgement for a case involving the online gaming company, Planet49. The judgement provides some helpful clarifications on the laws surrounding the use cookies, and in particular:
- Where consent is required for cookies under the EU’s e-Privacy Directive (2002/58/EC), the GDPR standard of consent applies, and pre-ticked boxes are not valid. Under the GDPR, ‘consent’ must be freely given, specific, informed and an unambiguous indication of the individual’s wishes by a clear affirmative action.
- The court issued a reminder that the consent rules for cookies as outlined in the e-Privacy Directive apply regardless of whether any personal data is processed by the cookie.
- Website operators must inform users about the duration of the cookie (e.g. how long it will last on a user’s device) and any third party access and sharing.
This article was written by Melissa Hall for the American Bar Association's 'Business Law Today: Month-In-Brief'.
