The Court of Justice of the European Union has released a new ruling; storing cookies requires internet users’ active consent, which essentially means website operators cannot present users with pre-checked options to agree to cookies.

We’ve all seen and dealt with cookies when entering a new website; those overly stretched banners that run across the bottom of a page or the annoying pop ups that appear right before you get into your favourite site or article online. They ask us for our consent with regards to cookies and explain how the site will track our activity. Without giving it too much thought, most of us will click the “Okay” or “I consent” button. All of this is about to change thanks to the new ruling.

On the 1st October, the courts ruled that pre-ticked cookie boxes, which many companies use, do not legally gather consent from the user and instead users must now actively opt-in to allow each company to follow them across the web. Alongside this, the ruling  specifies that user consent for each use of a cookie must be obtained as a separate instance, and that a list of names of all companies controlling the tracking technology, duration of time that the cookie is active and information on third party access must be visible to the individual giving consent.

The ruling also states that asking for consent cannot be tied or associated to unrelated actions on the site, for example, allowing a PDF to be downloaded in exchange for consent. This comes in reference to a decision that was made involving online lottery company Planet 49 and the German high courts. The online company would allow its users to enter a promotion on the site in exchange for their consent on cookies. This was ruled to be unlawful as an incentivised, pre-checked box was ‘not enough’ to garner consent from a user (

What does this mean for companies like Space & Time, our clients and other brands? Well, this will cause a problem for companies that have used generic cookie consent box to comply with GDPR, and you may already have seen new, longer more onerous consent forms appear online. Websites will need to be exhaustively detailed and transparent on how and why the user’s data is being used and more importantly who is using it. Since Google Analytics is based on information gathered by cookies, it’s possible that this ruling could have a substantial impact on the most basic web tracking information.

It is important to be aware that our website, like most websites, uses cookies to distinguish first time visitors from other users of our website. Cookies help us to improve the experience when visitors are browsing the site and also helps us to improve our website. By using cookies, our website is able to ‘remember’ you during a single visit to the site, known as session cookie, or for repeat visits, known as persistent cookies. GDPR states that websites must:

  • Tell people the cookies are there
  • Explain what the cookies are doing and why
  • Get the person’s positive consent to store a cookie on their device

So, in effect this could be a problem for companies that have used a generic cookie consent box to comply with GDPR. They will now need to be more open, straight forward and explicit on how and why the user’s data is being used and more importantly who is using it and has access to it.

At Space & Time we will be monitoring this closely as it develops in order to provide the best service and advice to our clients.