EU's new cookie rules that change how people are tracked around the internet

Users must opt in to being followed, European Court of Justice says

Andrew Griffin
Tuesday 01 October 2019 11:44
Comments
This May 26, 2014 photo shows an ethernet connector
This May 26, 2014 photo shows an ethernet connector

Internet users must actively consent to being tracked around the internet with cookies, the European Court of Justice has found.

The ruling has the potentially to fundamentally change how people use the web, and the degree to which websites are allowed to follow their users.

In the major ruling, Europe's highest court said that websites can only track their users if they give explicit and active consent. A pre-ticked checkbox assenting to the tracking is not enough, judges said – websites must instead leave those boxes empty and allow users to tick them if they wish.

The ruling stems from a 2013 case when the German Federation of Consumer Organizations took legal action against online lottery company Planet49, which had a pre-ticked checkbox to authorise the use of cookies.

The cookies – data sent from a website and stored on a user's computer – collected information to help target advertisements for products offered by Planet49's partners.

The consumer organisation argued this was illegal because the authorisation did not involve explicit consent from the user.

The German Federal Court of Justice asked for guidance from the EU's highest court to rule on the case in relation to EU laws on internet privacy. The EU court sided with the German consumer group, saying EU law aimed to protect consumers from interference with their private lives.

"A pre-ticked check box is therefore insufficient," the court said in a press release, adding that cookie consent must be specific and explicit and that clicking a button to participate in a game or browsing a website, and through that allowing cookies, was not enough.

The Norwegian Research Center for Computers and Law at the University of Oslo said in a statement that the ruling is "likely to have a significant impact on the ongoing negotiations on the ePrivacy regulation which is set to regulate cookie usage."

Several of the largest internet companies, such as Facebook and Twitter currently have implicit cookie consent, where by using the site, consent is deemed to have been given.

Facebook and Twitter were not immediately available for comment.

The case predates General Data Protection Regulation (GDPR) - the May 2018 internet privacy regulations that stipulate how companies must inform users about how their personal information is gathered.

The EU court also ruled that service providers had to fully inform users, including how long the cookies would operate for and whether third parties would have access to gathered data.

Additional reporting by Reuters

Register for free to continue reading

Registration is a free and easy way to support our truly independent journalism

By registering, you will also enjoy limited access to Premium articles, exclusive newsletters, commenting, and virtual events with our leading journalists

Please enter a valid email
Please enter a valid email
Must be at least 6 characters, include an upper and lower case character and a number
Must be at least 6 characters, include an upper and lower case character and a number
Must be at least 6 characters, include an upper and lower case character and a number
Please enter your first name
Special characters aren’t allowed
Please enter a name between 1 and 40 characters
Please enter your last name
Special characters aren’t allowed
Please enter a name between 1 and 40 characters
You must be over 18 years old to register
You must be over 18 years old to register
Opt-out-policy
You can opt-out at any time by signing in to your account to manage your preferences. Each email has a link to unsubscribe.

By clicking ‘Create my account’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Already have an account? sign in

By clicking ‘Register’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Register for free to continue reading

Registration is a free and easy way to support our truly independent journalism

By registering, you will also enjoy limited access to Premium articles, exclusive newsletters, commenting, and virtual events with our leading journalists

Already have an account? sign in

By clicking ‘Register’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Join our new commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies

Comments

Thank you for registering

Please refresh the page or navigate to another page on the site to be automatically logged inPlease refresh your browser to be logged in