On October 1,2019 the European Court of Justice ruled that website operators cannot obtain consent to the setting of cookies for advertising purposes by ticking an already checked box (Judgment of October 1,2019, Rs C-673/17).
Much rather, the user must actively tick a checkbox in order to give his consent. The decision of the ECJ applies regardless of whether the data stored in the cookie constitute personal data or not. Another requirement for legally effective consent is that the user has been informed about the duration of the cookie's function and possible access rights of third parties to the cookie.
In its decision, the ECJ did not deal with the question in which cases consent to the setting of a cookie is required. However, the ECJ has defined concrete guidelines for how consent is to be obtained. The decision therefore has no influence on cookies, which are technically necessary for the functionality of a website (login sessions, shopping cart, language settings).
The German Data Protection Conference ("DSK") published a guideline for providers of telemedia services in March 2019 in which it outlined its position on cookies once again. In the opinion of DSK, cookies, which track user behaviour via various websites, cannot be used on the basis of the legitimate interest of the website operator, but only with an active consent.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.