On 21 March 2019, Advocate General Maciej Szpunar (“AG”) delivered an opinion on cookie consent, information obligations regarding cookies and consent bundling (Case C-673/17, Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.). In the case at issue, users entering into a promotional lottery were confronted with two checkboxes:
- A checkbox obtaining consent for marketing emails that was not pre-ticked, but was mandatory to tick in order to participate in the lottery (“Marketing Checkbox”)
- A pre-ticked checkbox obtaining consent to cookies, which users could opt out of at any time (“Cookie Checkbox”)
Article 4(11) of the General Data Protection Regulation (“GDPR”) defines consent as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Information obligations regarding cookies
To fulfill the transparency obligations under Articles 13 and 14 GDPR, information about the duration of the cookie and any third-party access must be provided as must the identities of any third parties with access. Such information must be crystal clear and not subject to ambiguity or interpretation since the average internet user would not be expected to know how cookies work due to the technical complexity.
Bundling of consent
The AG raised two concerns in terms of consent. The first related to the form of consent, as the AG would have preferred a user to click on a participation button rather than a checkbox. The second was that by ticking the checkbox, there was a bundled consent rather than separate consents for participating in the lottery and for accepting cookies. In other words, consent should be separate rather than bundled and the form can be via separate checkboxes or buttons. More importantly, however, the AG reiterated that the prohibition against bundling consent is not absolute in nature.
The AG discussed the prohibition of bundling consent under Article 7(4) GDPR, which provides that any assessment of whether consent is freely given should consider whether performance of a contract is conditioned on consent to process additional personal data not necessary to contract performance. He referred to situations where users effectively “pay” for free services by providing their personal data. The Marketing Checkbox might be one of those cases because the main obligation of the user is to provide personal data in order to participate in the lottery. Thus, processing the personal data may be necessary for participation in the lottery.
The judges of the Court of Justice of the European Union are not generally bound by the opinion of an advocate general, but these opinions are very influential. What is interesting is that the opinion touches on two similar matters relating to cookies and consent bundling, one from Austria and one from the United Kingdom.
The Austrian supervisory authority (“Austrian DPA”) dismissed a complaint late in 2018 concerning the cookie wall of a local newspaper. It reasoned that the user’s consent to the cookie wall offered the user a considerable advantage in access to the newspaper. The choice to use other sources of information meant that the Austrian DPA did not consider the consent compromised.
At a similar time the UK’s Information Commissioner’s Office (“ICO”), as we commented on, took an alternative view on this question. The ICO found that consent could not be considered to be freely given if accepting cookies was the only way to access the service without payment.
In this instance, the AG accepts that the provision of personal data is necessary for participation in the lottery. This view on bundling consent with processing personal data as payment for free services is a reasonable approach and also in line with previous guidance by supervisory authorities (see the paper of the German supervisory authorities on advertisements here and guidance from the UK equivalent here).
The AG’s opinion to cookie consent aligns with a more conservative approach taken by a number of supervisory authorities where additional data are collected beyond what is required for the performance of a contract. For example, the German supervisory authorities published an opinion paper in spring 2018 stating that tracking and profiling cookies require opt-in consent (see more on our blog here).