This page is also available in English. Change to English page

Important questions concerning the cookie decision of the European Court of Justice

EN-Cookie-Entscheidung-860x325-px

To the German article

 

On 1 October 2019, the ECJ issued its long-awaited judgment concerning consent to the storage of cookies. You can find answers to frequent questions on the topic from our technology partner, Händlerbund.

What was the case about?

An online gaming company asked its users whether cookies could be stored in their browsers to display “interest-based targeted advertising” through service providers. This question was accompanied by a pre-ticked checkbox. Using the opt-out feature, users were able to revoke their “consent”.

The European Court of Justice (C-673/17) then had to deliberate the extent to which website operators must obtain the consent of visitors in order to use cookies.

Why is this case relevant?

This is the first decision concerning cookies. Opinions about whether consent is required for processing cookies vary widely, leading to general uncertainty among website operators.

This is complicated by the fact that the underlying cookie directive is implemented differently in each EU state. This judgment now provides clarity and a point of orientation.

What does German law say?

The German Telemedia Act (Telemediengesetz, TMG) does state that personal data may only be processed with the data subject’s consent, but in accordance with Section 15 (3) of the TMG, this does not apply for data that are collected for marketing purposes using anonymised profiles. For such data, users merely need to be given the option of objecting to their use.

What does European law say?

This judgment has now made it clear: the regulations of the TMG contradict EU law – the Cookie Directive (2009/136/EC) requires consent for the storage of cookies. The directive does not differentiate whether the data concerned is personally identifiable or anonymised data.

In today’s decision, the ECJ has clearly stated that no cookies may be processed without consent. The law only provides for exceptions to a very limited extent. EU law thus makes informed, explicit and freely given consent a prerequisite for the use of cookies.

What does consent look like under these conditions?

The first time users visit a website, they must be asked whether they consent to the processing of cookies. Informed, explicit and freely given consent must be obtained.

  • Consent: Visitors must actively participate in order to initiate the process. Therefore, an opt-out solution is not considered effective consent. After all, such solutions require users to be active to prevent something from happening.
  • Informed: Visitors are given an explanation regarding the purpose of cookie processing.
  • Freely given: Consent is not mandatory. This would be the case if the visitor could only use the website after giving consent (coupling prohibition).
  • Explicit: Consent is established in an unambiguous manner, for instance by ticking a checkbox rather than by clicking away a cookie pop-up.

Is an exception made for necessary cookies?

Such cookies may still be processed without consent. Necessary cookies are cookies that enable basic functions such as website navigation and access to secure areas of the website. For instance, this applies to the function allowing products placed in the basket to remain there when the user leaves the page. Accordingly, necessary cookies include the following: 

  • Cookies that save user settings (called session cookies)
  • Cookies that are necessary for the reproduction of media content
  • Cookies that are necessary for operating consent tools (cookie banner) in a legally compliant manner

What are non-necessary cookies?

Consent must be given for cookies that are not necessary for technical reasons. These include cookies for the following:

  • Analysis tools such as Google Analytics
  • Social media plugins for Facebook, Instagram and other platforms
  • Marketing tools

Do you have to make changes right away?

With this decision, the ECJ has answered the questions of the German Federal Court of Justice. Based on this decision, the German Federal Court of Justice must now issue a final judgment concerning this specific dispute. However, this decision already makes it clear that the requirements of the German Telemedia Act do not fulfil the European requirements. For this reason, it is recommended for retailers to take action now.

Do marketplace dealers have to make any changes?

No, only the marketplace operators are required to take action. As a distributor on eBay, Amazon or similar platforms, you are not required to make any changes.

How can retailers comply with this obligation?

There are various tools, also known as “consent tools”, to ensure compliance with this obligation. These are integrated on a website, making it possible to obtain consent to the use of various cookies.

Do you need to adapt your privacy policy?

The privacy policy must also state the legal basis for the use of cookies. For some time now, Händlerbund members have already had the advantage of selecting relevant settings in the legal text editor. This makes it easy to bring your privacy policy in line with the ECJ judgment.

What does Shopware provide for you?

To react to the ECJ’s cookie decision, we have developed a cookie consent tool for our Shopware 5 and Shopware 6 customers that is already integrated in the Shopware core and available as a standard feature. This consent tool allows each plugin provider to obtain an opt-in for their cookies.

If you would like to know how you can use these new cookie settings and what they look like in the Shopware 5 and Shopware 6 frontend, consult our follow-up article about the ECJ’s cookie decision: Shopware reacts with cookie consent tool.

To the follow-up article

About the Händlerbund

Händlerbund is the service network for everything about digital and stationary trade. With its members and partners, it drives the professionalization of tens of thousands of online retailers across Europe. Among other things, Händlerbund relies on service partners that cover the entire value chain. With its many years of experience in e-commerce, Händlerbund is also committed to the interests of the entire industry on a political level.