German Federal Supreme Court Issued Cookie Decision in Planet 49 Case

Major Facts:

Planet49 GmbH, an online gaming company, offered an online lottery service. To use the service, users had to register and provide personal data. The registration form contained two checkboxes. The first one asked users to tick a box allowing Planet49 GmbH to share their data with commercial partners. Ticking this box was mandatory for participation in the lottery. The second checkbox was pre-ticked and allowed users to opt out from the use of cookies (by unticking the box).

Rule:

• The use of pre-ticked boxes was not a valid form of obtaining consent for cookies before May 24, 2018 and remains an invalid way of obtaining consent under the GDPR. 
• Consent is required even where users are assigned a randomly generated ID number and the data collected through the cookies is “pseudonymised”. 
• Transparency requirement.
  • The CJEU decision clarifies that information given to users must indicate the life span of each cookie and whether any third parties may have access to those cookies.

In the court’s logic, a user that has not given his or her valid consent has objected to the creation of user profiles.