Cookies are used by website owners to collect data about users' interactions with the site. They are small text files that are stored on the visitor's device or in the browser's memory. Thanks to them, a website can collect data relating to language preferences, the number of visitors, the pages viewed, and whether access was made from a mobile or desktop device. Some cookies are essential to the functioning of the site and are activated automatically when it is opened.

The cookie policies of most websites inform users that, by the very act of visiting and browsing the content, they consent to the use of cookies. Other sites require the users' explicit consent before they can use the site's services and content. If consent is not given, the user is often denied access to the content.

The Court of Justice of the EU provided important clarifications regarding the legal requirements for the use of cookies in a judgment of 1 October 2019, relating to Case C‑673/17 (Planet49).

The need for explicit consent to cookies

First, users must give explicit consent to the installation and storage of cookies on their devices. The storage of information, or access to data already stored on the user's device, cannot be justified by a pre-ticked consent box that the user must deselect if they do not agree. The absence of a removed tick cannot be regarded as consent, even if the user continues to use the site.

A user cannot be regarded as having consented to the use of cookies if their only action is to continue browsing the site without clicking a button or ticking a consent box. The Court emphasises that consent cannot be implied. The user must actively declare their consent by selecting a button or box; continuing to use the site without such an action does not constitute tacit consent to cookies.

Actions required regardless of the type of data

Another key aspect of the judgment is that the type of information collected is irrelevant – the user's explicit consent to cookies is required regardless of whether the data collected is personal or not. This means that, regardless of the category of cookies and the data collected, it is mandatory for the user to give explicit consent.

Transparency in cookie policies

The Court also draws attention to the content of the cookie policies published on websites. These policies must be easy to understand and sufficiently detailed so that users can understand how cookies work. They must necessarily also include the duration of the cookies and whether third parties have access to them.

The interpretation of the Court of Justice of the EU necessitates an update of cookie policies on websites, with the following elements becoming mandatory:

  • The specific name of each cookie – it is not sufficient to list them only by type (e.g. technical, functional, analytical);
  • The provider of the cookie – e.g. the site owner or a third party;
  • The purpose of the cookie – for example, to save user preferences (such as language settings or open tabs), to store the user's consent, etc.;
  • The lifespan of the cookie – e.g. session, persistent or valid for a specified period;
  • The type of cookie – e.g. HTTP, HTML;
  • Third-party access – e.g. Facebook, YouTube, etc.

Should you need assistance in preparing GDPR documents or a consultation in the field of personal data protection, please contact us on tel.: 0887550706 or by e-mail: [email protected]