The ECJ’s Decision in “Planet49” (Case C-673/17): A Cookie Monster or Much Ado About Nothing?

In “Planet49”, the ECJ ruled that a pre-selected checkbox on a website (which the user must actively deselect to refuse consent) does not constitute valid consent under data protection law. In this context, the Court also provided guidance on the extent of the existing informational duties. It furthermore found that it does not make a difference with respect to Art. 5(3) ePrivacy Directive whether or not information that is stored or accessed on the terminal device of a user constitutes personal data. The majority of these findings is not surprising and in accordance with the values underlying today’s data protection and privacy regulations. Unfortunately, the ECJ failed to address the role Art. 7(2) GDPR plays for online declarations referring to both consent and other matters. It thus missed a valuable opportunity to provide further clarity on how consent can be given in a way that is compliant with data protection regulations and user-friendly at the same time. Unfortunately, the Court was not asked to show a way out of the dogmatic Gordian knot arising from the German Telemedia Act, parts of which are still in clear contradiction to Art. 5(3) ePrivacy Directive.