ICAEW.com works better with JavaScript enabled.

Case law: Pre-ticked consent boxes on websites are not sufficient consent to use of personal data under EU laws

Website owners and operators must ensure that consent to the collection and use of personal data of their site visitors, required under EU data protection laws, are specific and express and given in relation to each relevant activity. Pre-ticked consent boxes do not amount to lawful consent, according to a recent ruling.

November 2019

This update was published in Legal Alert - November 2019

Legal Alert is a monthly checklist from Atom Content Marketing highlighting new and pending laws, regulations, codes of practice and rulings that could have an impact on your business.

A German company presented website visitors choosing to take part in an online lottery with a pre-ticked consent box. This, the company claimed, amounted to consent to process personal data collected about them as required under EU laws. Visitors had to untick it if they did not consent.

A German national court referred the issue of whether pre-selected tick boxes amounted to consent under EU law to the Court of Justice of the European Union (CJEU).

The CJEU said the law required that website visitors must be given clear, comprehensive information about the collection of their personal data – such as duration and operation, and whether third parties would be given access to them. It doubted that, if websites purported to use a pre-ticked box as evidence of such consent, visitors would read the information that accompanied it or, if they did, take note of it.

The CJEU therefore ruled that a pre-ticked consent box did not establish valid consent. It said that ‘the consent referred to in [the relevant EU law] is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his or her consent’.

This is in line with guidance recently published by the UK’s Information Commissioner’s Office. This says that behavioural advertising cookies may not be used on a website without consent from the user.

The CJEU also said that consent would not be specific if a single consent was asked for in respect of a bundle of disparate activities.

The decision also casts doubt on rulings in some domestic courts within the EU saying that a statement on a website telling visitors that by continuing on the site they are automatically consenting to collection and use of their personal data, complies with data protection law. So it is likely this does not satisfy the requirement to obtain express consent to that activity.

Operative date

  • Now

Recommendation

  • Website owners and operators should ensure that consents to their online collection and use of personal data are specific and express and given in relation to each relevant activity - and note that pre-ticked consent boxes do not amount to lawful consent.

Case ref: Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH Case: C 673/17

Disclaimer: This article from Atom Content Marketing is for general guidance only, for businesses in the United Kingdom governed by the laws of England. Atom Content Marketing, expert contributors and ICAEW (as distributor) disclaim all liability for any errors or omissions.

Copyright © Atom Content Marketing