However, the EU Court recently stated in a judgement based on the e-privacy directive and GDPR, that an active consent is necessary for cookies with a marketing purpose. All who operates internet pages should examine the cookies they use and make sure they have the necessary basis for using such cookies.
Cookies are small information capsules which users of the Internet receive when visiting various net pages. The cookies may be necessary for the page to remember user settings, for the web shop to work, etc., but they may also have other purposes, including to collect data for tailored marketing.
The case which were handled by the EU Court of Justice concerned the company Planet49, which wanted to use cookies for marketing purposes. By way of the cookie in question, Planet49 could follow the user’s visits to other pages and tailor its marketing based on each user’s behaviour. The company’s internet page had a check box for consent, but the problem was that the check box was completed in advance. According to the EU Court, Planet49 thus did not fulfil the requirements of consent in the e-privacy directive as this were to be interpreted in relation to i.e. GDPR.
The decision is a clarification of Norwegian law. Where consent is necessary for cookies, an active consent must be collected in the same manner as under GDPR. The views on this have previously been divided in Norway. The preparatory works for the e-com law state that also a passive consent to the use of cookies, in the form of the user’s browser settings, is sufficient, which has also been supported by the Norwegian Communications Authority (Nkom) and the Ministry of Transport and Communications. The Norwegian Data Protection Authority has been of the opinion that a more active consent is needed, in line with the decision which has now been made by the EU Court in the Planet49-case.
This judgement also clarifies that the user must be given clear and adequate information on the purpose of the use of cookies, how long cookies will remain downloaded and whether third parties will be given access to the information.
The judgement is of practical importance, as most internet pages use cookies. What does not appear from the judgement is what types of cookies, apart from the types used for marketing, will require active consent. According to the current e-privacy directive there is no requirement for consent to the use of cookies which are necessary to deliver a service which the user have expressly asked for or which is necessary to facilitate transfer of information in networks. The scope of these exceptions is not addressed in this judgement. The remaining questions is thus whether it is also a requirement for active consent for all forms of functional cookies related to logging in, user settings, web shop solutions, etc. And what about cookies used for analysing the traffic on the page?
Practical considerations calls for a waiver of active consent for such cookies, but there is a need for clarification on this. Nkom has, after the EU Court’s judgement, stated that they are now considering whether there is a need for change in the Norwegian e-com legislation. Simultaneously EU is in the process of replacing the e-privacy directive with a new e-privacy decree. Hopefully, these revisions will contribute to clarify which cookies will require active consent.
In the meantime everyone should investigate the cookies they use and whether they have the necessary legal basis for using them, and whether they need to revise their routines.
