Cookie banner after the CJEU ruling
The ECJ, based in Luxembourg, has made a significant ruling on the cookie information obligations of website operators.
In a referral request from the German Federal Court of Justice (BGH) to the ECJ concerning a legal dispute between the Federation of German Consumer Organisations (vzbv) and the lottery company Planet49 , the judges supported the rights of Internet users and made it more difficult for them to obtain free access to information or tools that rely on the use of cookies.
In addition, the European Court of Justice has ruled that in an opt-in cookie banner no pre-selection may take place but that active consent of the user must be given. The setting of such cookies is therefore only permissible if the user has set the corresponding cookie consents himself.
Whether Internet users really want and appreciate this or regard it as paternalism remains unclear for the time being. It is probable that in the future, website visitors will have to click more frequently to use a website.
WHAT IS A COOKIE?
A cookie is a text entry with information about the user, which a visited website creates about the user and can store in the browser.
The cookie can be created on the client side using JavaScript or it can be created on the server side by the web server and sent to the browser.
When the user visits the website again later, the web server can retrieve this information directly from the server or the information is sent directly to the server via a script of the visited website. Thus the visitor can be recognized.
WHERE DO YOU USE COOKIES?
Services affected by this regulation could be, for example, the following:
- Web analytics tools like Google Analytics, Piwik, Adobe Analytics
- Interactive maps like Google Maps, Bing Maps, Open Street Map
- Tools for lead generation such as LeadingReports
- Use of Google Fonts and other external font providers
- Remarketing tools like Critero, SmarterHQ or Google Ads
- Facebook pixel and any social media pixel
- Youtube, Vimeo or other video streaming services
Summary of our data protection officer
on the subject of cookie banner decision
Please note that you should discuss this issue with your data protection officer and that, as a digital agency, we do not provide any legally binding information or advice with this information.
1. Consent requirement for online marketing cookies
The ECJ ruled that cookies may only be used with and after cookie consent (ECJ, 1.10.2019 - C-673/17).1
Before the code of the online marketing services is executed on the website, users must give their consent to the processing and storage of their personal data in cookies (and similar procedures, such as digital fingerprinting).
2. Exceptions only for absolutely necessary cookies
No consent is required for "absolutely necessary" (or essential) cookies, such as the shopping cart cookie of a shop, cookies for load balancing purposes or saving the login status and language selection on a website. This also applies to the cookie in which a given/failed cookie consent is noted. According to the ECJ, cookies used for online marketing purposes do not constitute required cookies.
3. Observe the cookie consent requirement already now
Although the judgment of the ECJ is an interlocutory judgment, the BGH, which pronounces the final judgment, will have to comply with the decision of the ECJ.
Design and contents of a cookie consent
Currently, cookie consent can practically only be obtained with so-called "cookie (consent / opt-in / content) banners".
Alternatively, consent could also be obtained as part of a registration or purchase procedure. In practice, this is unlikely to be feasible without considerable disadvantages in terms of the rate of conclusion/conversion due to the obligation to provide information.
Consent must be expressly declared by clicking on a button or other checkbox.
According to the ECJ, an opt-out solution is not permissible, in which case the cookies are already active when the user enters the website and users must deactivate them. The cookie banners "We use cookies - if you continue to use our website, you agree to the use of cookies", which were frequently used up to now, are no longer sufficient.