Top European Court Rules Companies Must Obtain Active User Consent to Cookies

The Court of Justice for the European Union has ruled that under EU law companies must obtain active, specific consent from users to store persistent identifiers, or “cookies," on the user's device. In Planet49, the Court ruled that a pre-checked box does not constitute consent. The case was brought by the German Federation of Consumer Organisations. The European high court also ruled that companies must inform users about the duration of the cookie and whether data will be transferred to third parties. EPIC made a similar argument about consent in the first US case concerning cookies, contending that US federal wiretap law requires companies to obtain explicit consent from users for tracking.