Global menu

Our global pages

New decisions on the admissibility of cookies

New decisions on the admissibility of cookies

  • United Kingdom
  • Technology, Media and Telecoms - General


There has long been discussion as to whether the use of cookies and other technologies for the purposes of web analysis, tracking and individualised advertising requires the explicit consent of those concerned or whether this can also be based on legitimate interests. Both the Advocate General at the European Court of Justice and the German Data Protection Conference (DSK) have recently commented on this question. Both statements essentially argue that consent is required and that a legitimate interest should no longer be sufficient in the vast majority of cases.

So far, in practice, consent has frequently not been obtained and an opt-out solution has been practiced. Alternatively, so-called cookie consensus banners are frequently used, which attempt to derive consent from the behaviour of the user.

On 21th of March 2019, the Opinion of Advocate General Maciej Szpunar provided a foretaste of the ECJ's possible decision since the ECJ generally follows the Opinion of the Advocate General. The Advocate General stated that under the e-privacy directive and the General Data Protection Regulation, service providers must obtain consent for the use of cookies. However, this consent could not be obtained through a pre-selected checkbox. In addition, users must be informed about the functional life of cookies and whether third parties have access to the cookies (third party cookies).

The consequence of a corresponding ECJ decision would be that the national courts would have to take the case law of the European Court of Justice into account for every new legal dispute on the cookie issue.

Against this background, the orientation guide for providers of telemedia services published on 5th of April 2019 by the “German Data Protection Conference (DSK)”, is particularly relevant. According to the DSK, an opt-out procedure for consent is also not sufficient against the background of recital 32 GDPR. The supervisory authorities even expressly demand that when the website is opened in the cookie banner, all processing operations requiring consent must be explained and activated via a selection menu, stating the actors involved and their functions. In addition, they make it clear that the selection options must not be "activated" by default. While the banner is displayed, all further scripts of a website or web app that potentially collect user data should be blocked with technical measures. Data processing may only actually begin with active consent.

In its guidance, the DSK comments on the matter of legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR. Website operators may assert legitimate interests if only statistical data were used for the measurement and no extensive profiling and transfer of data to third parties took place.

With regard to the weighing of interests when using tracking pixels of social networks, the DSK explains in detail that the rights of the persons concerned outweigh the interests of the website operators, since the average user of social networks is not aware of "invisible" pixels, has no possibility to object and usage data is stored over a longer period of time.

A blanket "By using the website you agree to all cookies" will no longer be sufficient. It is advised to check the use of cookies and tracking techniques and to adjust to the fact that active user consent will be required much more frequently than before. The information texts will also probably have to be revised in order to create the required transparency.

< Go back

Print Friendly and PDF
Subscribe to e-briefings