EU rules active consent is required for tracking cookies

(Image credit: Rawpixel/Pixabay)

A big change will soon be coming to websites in the EU as Europe's top court has ruled that pre-checked consent boxes for cookies are not legally valid.

Going forward, consent will need to be obtained before a website stores or accesses non-essential cookies such as tracking cookies used for targeted advertising

Websites in Europe could soon face legal troubles if their cookie notices fail to ask for consent first which is typically the case as site owners prefer not to risk having their ability to track users for ad targeting taken away from them.

Currently many websites display a cookie banner which users need to click okay on before they can gain access to a site's content. This practice will no longer be legal in the EU and site owners will likely have a much more difficult time getting European users to opt into ad tracking cookies.

The ruling by the European Court of Justice (ECJ) comes after a German court asked it to make a decision in regard to a case involving the lottery website Planet49 which required that users first consent to the storage of cookies in order to play a promotional game. The ECJ provided further details on its ruling in a press release, which reads:

“In today’s judgment, the Court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent.”

This means that pre-checked consent boxes as well as cookie banners are not valid under EU law. Additionally, cookie consent cannot be bundled with another purpose such as allowing a user to access a site's content or giving them the ability to play a promotional game as is the case with Planet49.

Users must also now be provided with some specific information on what a cookie tracks for consent to be legally valid. This includes details on how long the cookie will operate and who a user's data will be shared with.

The ECJ's ruling is a big win for internet privacy but it will likely have far reaching implications for European website owners that have abused the tracking ability of cookies for too long.

Via TechCrunch

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.