In its ruling of May 28, 2020 (I ZR 7/16), the German Federal Supreme Court (BGH) addressed the question of whether users must actively consent to certain cookies.
The Federal Association of Consumer Associations had filed a lawsuit against a sweepstakes provider because of a pre-ticked checkbox for cookies that were intended to serve the creation of usage profiles for purposes of advertising or market research.
After referring the matter to the ECJ (judgment of 1.10.2019, C-673/17), the BGH rendered a judgment as the final instance.
Thus, the consent requirement only covers technically unnecessary cookies. These are those that serve tracking for advertising purposes or profiling. In contrast, consent is not required for all cookies that are technically necessary for the operation of a website and its functions.
Neither a “You can continue surfing quietly banner” is sufficient, nor an already pre-ticked checkbox. Users must declare their consent by actively agreeing.
The decisions of the ECJ and BGH have provided clarity on a topic that the GDPR does not address. And a European ePrivacy Regulation, which would contain a clear regulation on cookies, will not come into force any time soon.
Thus, an opt-in instead of an opt-out applies to all technically unnecessary cookies.