The Federal Commissioner for Data Protection and Freedom of Information

Navigation and service

Bonn, 01/10/2019

Press release 23/2019

CJEU strengthens Online Declaration of Consent with Regard to Data Protection Law

In its judgment of 01/10/2019, the European Court of Justice (CJEU) reaffirmed the great importance of the online declaration of consent in connection with data protection law. This means that pre-ticket checkboxes which are unmodified by the user do not meet the requirements of effective consent.

The Federal Commissioner for Data Protection and Freedom of Information, Ulrich Kelber, welcomed the ruling of the Court: “The CJEU has again stressed the importance of the free and informed declaration of consent in connection with data protection law. This message is an important signal, especially in times of progressive digitalization, where it is sometimes increasingly difficult to control one’s own data. I assume that this will be taken into account by the legislator in the forthcoming amendment of the Telemedia Act. A similar, legally clear regulation is more than overdue in particular in the context of the use of so-called “cookie banners”. According to today’s ruling, these cookie banners can in principle no longer be used as a legal basis for the storing of cookies.”

The subject matter of the ruling of the supreme European Court was the question under which conditions Internet providers are allowed to store cookies on their users’ terminal equipment. In this context, the CJEU determined that consent, which is effective according to data protection law, also presupposes the data subject’s active behaviour. In addition, this active behaviour should be specifically pertaining to consent. On the other hand, confirmation via a pre-ticked checkbox by clicking on another button, for example to participate in a promotional game, is not sufficient.

Cookies are small text files that are stored by many website on computers or other devices while surfing the Internet. Cookies can include information that is necessary for navigating the Internet, but they can also be used for tracking the individuals’ user behaviour and for creating profiles based on this behaviour.