EU COURT : INTERNET USERS COOKIES

INTERNET users must actively consent to use of cookies, EU court rules. The ruling can significantly impact on ePrivacy regulations.

BRUSSELS : internet users must actively consent to companies storing cookies that are used to track online behaviour, the European Court of Justice said on Tuesday in a ruling that could significantly effect the ePrivacy regulation.

The ruling stems from a 2013 case when the German Federation of Consumer Organizations took legal action against online lottery company Planet49, which had a pre-ticked check box to authorize the use of cookies.

The cookies - data sent from a website and stored on a user's computer - collected information to help target advertisements for products offered by Planet49's partners.

The consumer organization argued that this was illegal because the authorization did not involve explicit consent from the user.

The German Federal Court of Justice asked for guidance from the EY's highest court to rule on the case in relations to EU laws on internet privacy.

The EU court sided with the German consumer group, saying EU law aimed to protect consumers  from interference with their private lives.

''A pre-ticked check box is therefore insufficient,'' the court said in a press release, adding that cookie consent must be specific and explicit and and that clicking a button to participate in a game or browsing a website, and through that allowing cookies was not enough.

Luca Tosoni, research fellow at the Norwegian Research Center for Computers and Law at the  University of Oslo said in a statement that the ruling is 'likely to have a significant impact on the ongoing negotiations on the ePrivacy regulation which is set to regulate cookie usage'

Several of the largest Internet companies, such as Facebook and Twitter currently have implicit cookie  consent, where by using the site, consent is deemed to have been given.

Facebook was not immediately available for comment and Twitter declined to comment.

The case predates General Data Protection Regulation [GDPR] - the May 2018 Internet privacy regulations that stipulate how companies must inform users about their personal information is gathered.

The EU court also ruled that service providers had to fully inform users, including how long the cookies would operate for and and whether third parties would have access to gathered data. [Reuters]