Last month, I blogged about how the UK ICO and French CNIL had released over the summer updated cookie guidances.
On October 1, the Court of Justice of the European Union (CJEU) ruled on cookie consents too and its ruling is consistent with the positions by the ICO and CNIL (see Planet49 GmbH, Case C-673/17). The CJEU ruling had three essential elements. First, regardless of whether a cookie concerns personal information, a website operator cannot use pre-checked boxes to obtain consent (a) to store and (b) to access a cookie on a user's computer (paragraphs 65, 71). Second, website operators must provide duration of cookies and if third parties have access to them (paragraph 81). Third, user consent must be specific to the cookie processing and not bundled with other purposes (paragraph 58).
This ruling means that website operators -- other than for strictly necessary cookies -- (1) cannot install cookies without consent, (2) cannot set or pre-check cookies to install by default, and (3) must provide more information about cookies specifics.
Many websites will need to revise when they set cookies and how a user consents (no pre-checked boxes).
Image by Andrew Magill on Flickr licensed under CC BY 2.0.