Europes highest court is not satisfied with a pre-ticked box.
On Tuesday, judges at the Court of Justice of the European Union (CJEU) ruled that websites must obtain explicit consent from users in order to collect their personal data.
In their decision, the judges ruled it is not enough to flash a pre-ticked box in front of people to have them consent for their digital information to be collected. Instead, websites must ask users to actively opt in to sharing their data.
The ruling from the Luxembourg-based court dealt a blow to search engines, social media platforms and other websites that rely heavily on such boxes to obtain consent with minimal input from people across the 28-country bloc.
The ruling, which will apply across the European Union, originated in Germany where a group of consumer organizations filed a lawsuit against Planet 49, a local website that hosted an online lottery.
By prompting users to make a proactive choice, the ruling may lead people to deny consent and potentially deprive websites of personal data that is now the lifeblood of the digital economy.
The ruling is the latest from Europes highest court that aims to rein in tech companies activities. On Thursday, the same judges will rule if Facebook should be held responsible for removing defamatory content from its global platform or merely from the country where the complaint was filed.
The ruling also marks a victory for privacy campaigners who have pushed back against the use of so-called cookies, or technology that allows firms to collect information on peoples digital activities.
Case born in Germany
The ruling, which will apply across the European Union, originated in Germany where a group of consumer organizations filed a lawsuit against Planet 49, a local website that hosted an online lottery.
To participate in the sweepstake, users needed to check two boxes, one of which had been pre-checked to allow the use of cookies. To revoke consent, the user needed to actively uncheck the box.
The ePrivacy Regulation has been stuck in negotiations between national interests at the Council of the European Union | Alexander Nemenov/AFP via Getty Images
That was incompatible with Europes tough privacy standards, the German consumer advocates argued.
On Tuesday, the CJEU sided with them, fueling a debate over how much say people should have over how their data is collected, and exactly how consent should be granted.
“The court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent,” the judges wrote in a statement.
As a new European Commission prepares to take office November 1, consumer protection groups and Silicon Valley companies are ramping up lobbying around several planned pieces of legislation — including the so-called ePrivacy Regulation, which aims to set privacy rules for online communications — that will affect how digital information is collected and managed.
The courts ruling “spells it out for the industry and calls for clear rules on confidentiality of our communications,” said Diego Naranjo, head of policy at EDRi, a consumer rights group. “EU member states need to finally move forward with legislating this practice, and take the much-needed ePrivacy Regulation out of the EU Councils closet.”
The ePrivacy Rgulation has been stuck in negotiations between national interests at the Council of the European Union.
Several lawsuits argue that websites are bypassing new data protection rules, notably by making access to online services such as Google and Facebook conditional on providing consent for data gathering.
“The ruling is an important sign for the protection of digital privacy,” Heiko Dünkel, the German consumer organizations legal officer, said in a statement. “Tracking cookies enable website operators and third-party providers to make a comprehensive evaluation of the surfing and usage behavior of customers.”
A representative for Planet 49 did not immediately respond to a request for comment.
In
