Pre-ticked consent boxes on websites aren’t sufficient consent to gathering and using data about visitors, or using cookies
Businesses with websites that collect personal data from visitors to the site, and/or put cookies on their computers, and which use pre-ticked consent boxes as evidence the visitors have consented to this – so that visitors have to choose to untick them if they do not consent – must stop doing this immediately, because the European Court has ruled that pre-ticked consent boxes do not satisfy the legal requirement that these consents must be express and specific.
What happened was that visitors to a German company website were offered the chance to take part in an online lottery and sweepstake on its website. If they chose to do so, they were presented with a page containing a pre-ticked consent box, which the company claimed amounted to consent from them for it to gather and use personal data collected from them as they took part, and use of cookies by the website operator – consent the company was required by law to get from them.
The German national court asked the Court of Justice of the European Union (CJEU) to rule on whether using pre-ticked consent boxes satisfied the legal requirement for specific, express consent to gathering and using personal data, and depositing cookies on their computers, laptops, etc.
The CJEU ruled that ‘the consent referred to in [the relevant EU law] is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his or her consent’.
The decision also implies that rulings in some domestic courts in the EU saying that a statement on a website telling visitors that, by continuing on the site, they are automatically consenting to collection and use of their personal data, or the deposit of cookies on their equipment, are wrong, as this does not amount to express, specific consent either.
Website owners and operators should therefore check that the consents to their collection and use of personal data, and use of cookies, are specific and express – and note that, particularly, pre-ticked consent boxes do not amount to consent for these purposes.
In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.