Top EU court: Websites must have users' 'active consent' to use tracking data

Oct. 1 (UPI) -- Internet users in the European Union must "actively consent" to be tracked with cookies when online, the bloc's top court ruled Tuesday in a landmark privacy case.

In many cases, websites have been relying on pre-checked consent boxes to obtain users' permission to be tracked with cookies. The European Court of Justice ruling said that method is not good enough.

The ruling stems from a 2013 case in which a German non-governmental consumer advocacy group challenged an online lottery company that had used pre-checked boxes. Many websites ask users to accept cookies, bits of tracking data sent from a company's website to be stored on a user's computer. They help build a demographic profile for users, which can be sold to third-party advertisers.

The EU high court agreed to examine the case at the request of Germany's federal court, to clarify EU privacy laws.

"EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users' terminal equipment without their knowledge," the EU court wrote in its ruling.

"The consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent.

"A pre-ticked checkbox is therefore insufficient."

The ruling said any consent box must explain, in detail, what will happen if users agree to receive cookies.

Some experts expect the EU ruling to have a significant impact on the 28-nation alliance's ePrivacy law, which is set to regulate cookie usage.

Also invalid under the ruling is implicit cookie consent, which is typically spelled out in a website's terms of user agreement. Under the policy, users automatically consent to receive cookies by simply using the site or platform. Facebook and Twitter are two companies that have relied on implicit consent.

Tuesday's ruling also said service providers must tell users how long the cookies will be active and whether third parties have access to the data.

Companies that violate the EU privacy laws, which are currently the subject of proposed reforms, will be subject to a fine.