Unusually for the CJEU, the decision is straight-forward with little ambiguity.
The opinion has four key holdings:
Here are some immediate takeaways from the CJEU’s holding:
- Review your cookie “acceptance” mechanism. Even third party “preference centers” allow for pre-selection of “accept” or “active” buttons with respect to certain types of cookies. The court said “requiring a user to positively untick a box and therefore become active if he does not consent to the installation of cookies does not satisfy the criterion of active consent …..By contrast, requiring a user to tick a box makes such an assertion far more probable.” Also review the acceptance mechanism to ensure that the timing is appropriate and no cookies are dropped before a user makes a choice.
- Do you try to “bundle” cookie consent with other “consents” or other actions?
To avoid potential audits or investigation by EU data protection authorities and potential fines under the GDPR, review and remediation should be undertaken as soon as possible.