Europe’s top court says active consent is needed for tracking cookies –TechCrunch

Link articolo originale

Archivio di tutti i clip:
clips.quintarelli.it
(Notebook di Evernote).

LoginDisrupt SF 2019StartupsAppsGadgetsVideosAudioExtra CrunchNewslettersEventsAdvertise—CrunchbaseMoreSearch
AppleEnterprise
Transportation
Facebook privacy
Europe’s top court says active consent is needed for tracking cookiesNatasha LomasImage Credits: joyosity / Flickr (opens in a new window)Europe’s top court has ruled that pre-checked consent boxes for dropping cookies are not legally valid.Consent must be obtained prior to storing or accessing non-essential cookies, such as tracking cookies for targeted advertising. Consent cannot be implied or assumed.It’s a decision that — at stroke — plunges websites into legal hot water in Europe if their cookie notices don’t ask for consent first. As many don’t, preferring not to risk their ability to track users for ad targeting.Now they could be risking a big fine under EU privacy laws if they don’t obtain valid consent for tracking.Full text of the CJEU cookie ruling improves understanding of #GDPR consent. Preselected fields make it impossible to detect if user consented. #ePrivacy t.co/rzuVEzGtRi— Lukasz Olejnik (@lukOlejnik) October 1, 2019Sites that have relied upon opting EU users into ad-tracking cookies in the hopes they’ll just click okay to make the cookie banner go away are in for a rude awakening.Or, to put it another way, the ruling should put a stop to some, er, ‘creative’ interpretations of the rules around cookies that manage to completely miss the point of the law…ehemat here refreshing Curia press release page & noticed their own non-compliant #cookie notice – spot the irony on their cookie information page – looks like the Court are about to render their own site illegal wrt to pre-ticked boxes… a little embarrassing… #privacy #planet49 pic.twitter.com/ewdEqQqrvb— Alexander Hanff (@alexanderhanff) October 1, 2019The decision is also likely to influence the ongoing reform of ePrivacy rules — which govern online tracking.While the outcome of that very heavily lobbied piece of legislation remains to be seen today’s ruling is clearly a win for privacy.Planet49 caseThe backstory to today’s ruling is that a German court asked the CJEU for a decision in a case relating to a lottery website, Planet49, which had required users to consent to the storage of cookies in order to play a promotional game.In an earlier opinion an influential advisor to the court also took the view that affirmative action not simple inaction must be necessary to constitute consent.Today the CJEU agreed, handing down a final judgement which makes it plain that consent can’t be assumed — it requires an active opt-in from users.In a punchily brief press release the court writes:In today’s judgment, the Court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent.That decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.So, to sum up, pre-checked consent boxes (or cookie banners that tell you a cookie has already been dropped and pointlessly invite you to click ‘ok’) aren’t valid under EU law. Furthermore cookie consent can’t be bundled with another purpose (in the Planet49 case the promotional lottery) — at least if that fuzzy signal is being used to stand for consent.There’s also an interesting new requirement which looks set to shrink the ability of service operators to obfuscate how persistently they’re tracking Internet users.For consent to cookies to be legally valid the court now says the user must be provided with some specific information on the tracking, namely: How long the cookie will operate, and who their data will be shared with. So, er, awkward…The most interesting thing is how the Court justifies that info on cookie duration/those who can access should be provided. ePrivacy refers to data protection law on the information provided, but as ePrivacy is not always about personal data, the info reqs in DP don’t always fit— Michael Veale (@mikarv) October 1, 2019What’s more interesting: sites must inform about the duration of cookie validity. This is interesting insight, and was not generally followed. Should be identical to ‘Expires’ or ‘Max-Age’ setting when cookies are set. Does it also apply to SameSite configuration? #GDPR #ePrivacy pic.twitter.com/f55AtbqArb— Lukasz Olejnik (@lukOlejnik) October 1, 2019“Extending information requirement to include cookie configuration details is an interesting twist that will provide more information to users,” Dr. Lukasz Olejnik, an independent cybersecurity advisor and  associate at the Center for Technology and Global Affairs at  University, told us.“Sites will need to be wary to be sure that the user-facing text matches the actually used values of max-age or expires attributes. It is also interesting to wonder if sites will want to provide similar information about other cookie attributes.”Safe to say, there will be some long faces in the ad industry today.“The Court has made clear that consent should always be manifested in an active manner, and may not be presumed. Therefore, online operators should ensure that they do not collect consent by asking users to unclick a pre-formulated declaration of consent,” said Luca Tosoni, a research fellow in computers and law at the University of Oslo, also commenting on the court ruling.ePrivacy reformAs we’ve reported before very many sites and services in Europe have, at best, been playing lip-service to EU cookie consent requirements — despite the advent of tighter rules coming into force last year under the General Data Protection Regulation (GDPR), which says that consent must be specific, informed and freely given to be a valid legal basis. And despite — more recently — further guidance from DPAs clarifying the rules around cookie consent.So the CJEU ruling should lift a fair few heads out of the sand.“Before the entry into force of the GDPR, the conditions for consent were interpreted differently across Europe. Today’s judgment is important as it brings some clarity on what should be considered valid consent under EU data protection law,” Tosoni also told us, saying he expects the ruling to result in changes to many cookie notifications.“National courts and data protection authorities across the EU will need to follow the Court’s interpretation when assessing whether controllers have validly obtained consent. In turn, this should lead to more harmonization in enforcement across Europe, in particular with regard to cookie notices. Thus, I would expect many operators to change their non-compliant consents to conform with the ruling.”EU law on cookie consent dates back much earlier than the GDPR — to the prior Data Protection Directive and the still in force ePrivacy Directive — Article 5(3) of which specifies that for cookies to be used users must give opt-in consent after being provided with clear and comprehensive information (with only a limited exception for ‘strictly necessary’ cookies).Although European legislators have been trying for years to agree on an update to the ePrivacy Directive.A draft proposal for an ePrivacy Regulation was introduced by the Commission at the start of 2017. But negotiations have been anything but smooth — with a blitz of lobbying from the adtech and telecoms industries pushing against a firm requirement for opt-in consent to tracking.The CJEU’s clarity that consent is required to store and access cookies pushes in the opposite direction. And that firm legal line protecting individual privacy from background tracking technologies should be harder for legislators to ignore.“Today’s ruling is likely to have a significant impact on the ongoing negotiations on the ePrivacy Regulation which is set to regulate cookie usage, an issue on which European legislators are struggling to find an agreement,” Tosoni said, adding: “In the past, the Court’s rulings have had an important impact on the development of the GDPR.”In the meanwhile, the judgement should at least force some of the more cynical and/or stupid cookie banners to be quietly replaced with something that at least asks for consent.Cookie wallsThat said, the ruling does not resolve all the problems around cookie consent.Specifically the court has not waded into the contentious forced consent/cookie wall issue. This is where a site requires consent to advertising cookies as the ‘price’ for accessing the sought for service, with the only other option being to leave.Earlier this year the Dutch DPA deemed cookie walls to be illegal. But the agency’s interpretation is open to legal challenge. Only the CJEU can have the final word.In the Planet49 case the court sidestepped the issue — saying the referring court did not ask it to rule on the question of “whether it is compatible with the requirement that consent be ‘freely given’, within the meaning of Article 2(h) of Directive 95/46 and of Article 4(11) and Article 7(4) of Regulation 2016/679, for a user’s consent to the processing of his personal data for advertising purposes to be a prerequisite to that user’s participation in a promotional lottery, as appears to be the case in the main proceedings”.“In those circumstances, it is not appropriate for the Court to consider that question,” it wrote.Likely it’s doing so because another case is already set to consider that question. Tosoni says he expects the Orange Romania case — which is pending before the court — to further clarify the requirements of valid consent in the context of it being ‘freely given’.“Today’s judgment does not provide an answer on the legality of cookie walls, which require consent to access the underlying service.  The Court found that it was unable to address this point, as the referring German court had not asked the ECJ to assess the legality of making participation in a lottery — the service at issue in the case — subject to giving advertising cookie consent.  Further clarity on this issue may come from the Orange Romania case, which is currently pending before the ECJ.”IAB Europe responseResponding to the ruling the Interactive Advertising Bureau (IAB) Europe’s CEO Townsend Feehan told us: “It’s interesting that the court are taking the view that the ePrivacy Directive provision appear to require users to be told how long a cookie will be functioning. That’s something that’s qualitatively a little bit new.”She also agreed the CJEU ruling will likely require some changes to some existing cookie consent notices, saying: “If now the court is taking the view that users have to have precise information about the persistence of a cookie that would definitely require changes to UIs.”“The idea that you couldn’t have preticked boxes/don’t constitute active consent is not really a surprise to anyone, and the idea that the ePrivacy Directive requirement applies to non-personal data as well as personal data is also not surprising,” she also said, further claiming the IAB’s Transparency and Consent Framework (TCF) discourages the use of pre-ticked boxes.The TCF was introduced last year by ahead of GDPR, when the IAB made a big push to encourage publishers to use its framework to gather consents for processing visitors’ personal data in Europe.However there are examples of this TCF including pre-ticked consents — such as in a widely used implementation developed by Quantcast. An adtech veteran whose business is, as it happens, currently under investigationAsked whether the IAB will be advising its members to make changes to how they gather consents in light of the CJEU ruling, Feehan said: “The recommendation until now has just been to comply with Article 13; the disclosure requirements in the GDPR. Now that the court has taken a different view from the letter of the law that is something indeed we could make a recommendation. We have a working group that needs to look at whether the policies ought to be amended in light of the ruling — and so that process will play out in the next few weeks.”She also said the IAB’s wider position on the ePrivacy Regulation remains unchanged for now — which is to say it doesn’t believe updated tracking rules are necessary.“I don’t think this ruling will affect our general approach or position on the proposed ePrivacy Regulation,” she said. “Our view on ePrivacy Regulation is basically that it’s probably not necessary. That all one needs is the GDPR. If you look at the substantive scope of the ePrivacy Regulation in relation to the cookie provisions… they’re completely redundant with what was adopted in the GDPR.”Asked to respond to wider criticism of the adtech industry’s business model being based on consent-less tracking of Internet users Feehan rejected the critique as “complete nonsense”, adding there’s nothing in the CJEU judgement to support such a view.Today’s decision of the EU Court of Justice in the case #Planet49 is a message to the #adtech industry: your business model based on unlawful profiling, forced tracking and unconsented targeted ads is not valid under EU law #ePrivacy t.co/BDgRpB0hK2— Access Now (@accessnow) October 1, 2019“The judgement doesn’t tell us anything new about the content of the law. The advertising industry needs to obey the law, the overwhelming majority of players in the digital advertising industry obey the law. And this ruling doesn’t tell us anything new as far as I’m concerned about the law… It does introduce this perhaps more precise requirement with respect to the obligation to disclose the duration of persistence of cookies. But I don’t understand on what basis anyone would read today’s ruling and decide that based on that reading one discovers that the business model is illegal. I don’t understand the logic of that.”This report was updated with comment from the IAB EuropeDisrupt SF 2019Just 2 days until the event kicks offOct 2 – 4Save $600 NowSign up for NewslettersSee all newslettersThe Daily CrunchWeek in ReviewStartups WeeklyThe StationExtra Crunch RoundupEvent UpdatesSponsorship InsiderCrunchbase DailyEmail(opens in a new window)(opens in a new window)CopyTagsAdvertising TechEuropead trackingCJEUcookie consentcookiesdata protection lawdutch dpaEurope’s top court says active consent is needed for tracking cookies1:42 pm CEST • October 1, 2019Europe’s top court has ruled that pre-checked consent boxes for dropping cookies are not legally valid. Consent must be obtained prior to storing or accessing non-essential cookies, such as t…Tesla delivers a record 97,000 electric vehicles in third quarter11:13 pm CEST • October 2, 2019Tesla said Wednesday it delivered a record 97,000 electric vehicles in the third quarter, a nearly 2% increase from the previous period, but still short of analysts’ expectations. Tesla share…Mutiny creates personalized plans for B2B marketing11:00 pm CEST • October 2, 2019Mutiny, a personalized marketing startup for businesses that sell to other businesses, is taking the stage today at TechCrunch’s Startup Battlefield, where it’s announcing new funding a…Render challenges the cloud’s biggest vendors with cheaper, managed infrastructure10:48 pm CEST • October 2, 2019Render, a participant in the TechCrunch Disrupt SF Startup Battlefield, has a big idea. It wants to take on the world’s biggest cloud vendors by offering developers a cheaper alternative that…Lookout, Robinhood. E*Trade, Schwab, Ameritrade go zero-fee10:48 pm CEST • October 2, 2019The biggest players in online stock trading all just copied Robinhood by removing their fees for stock and ETF trading. Charles Schwab announced yesterday it would drop its $4.95 fee, leading to pl…Sendmi lets you allocate part of your paycheck for remittance10:36 pm CEST • October 2, 2019Meet Sendmi, a fintech startup that is launching today in the Startup Battlefield at TechCrunch Disrupt SF. Sendmi works pretty much like a 401k or a Flexible Spending Account. But instead of savin…Delos uses satellite imagery and AI to help homeowners in wildfire areas get insurance10:30 pm CEST • October 2, 2019If your home is in a wildfire area, insurance companies tend to not want to go anywhere near it. But “wildfire areas” tend to be pretty broad. What if companies could evaluate the risk …Traptic uses 3D vision and robotic arms to harvest ripe strawberries10:11 pm CEST • October 2, 2019At some unspecified time, somewhere down the road, Traptic would love to expand its robots to pick a wide variety of crops. For now, however, the South Bay-based team is focused solely on strawberr…Extra CrunchHow Bongo, the ‘Netflix of Bangladesh’, won the local video streaming market with just $10MThousands of miles away from the U.S., where technology giants, cable networks, and studios are l…9:48 pm CEST • October 2, 2019The first details about Volvo’s upcoming electric XC40 SUV9:44 pm CEST • October 2, 2019Volvo is teasing its upcoming, and first, all-electric car, with some initial sketches and a few details of the XC40 SUV. The upshot: Volvo is emphasizing a simpler design that discards some of the…Kong acquires Insomnia, launches Kong Studio for API development9:23 pm CEST • October 2, 2019API and microservices platform Kong today announced that it has acquired Insomnia, a popular open-source tool for debugging APIs. The company, which also recently announced that it had raised a $43…YouTube’s Neal Mohan describes the company’s efforts on safety and trust9:18 pm CEST • October 2, 2019YouTube Chief Product Officer Neal Mohan gave an update on all things YouTube at TechCrunch Disrupt SF. He touched on many different subjects, from YouTube Music updates to advertiser-friendly guid…Foursquare’s location-aware Pilgrim SDK gets a free tier9:17 pm CEST • October 2, 2019Ten years later, Foursquare is far past its scrappy consumer days as it builds out its B2B services, but its latest announcement is thrusting it back into the scrappy consumer business. Onstage at …Demand for Porsche Taycan prompts automaker to add 500 more jobs8:38 pm CEST • October 2, 2019Demand for the all-electric Porsche Taycan sports car has prompted the German automaker to add 500 more jobs at its headquarters in Stuttgart-Zuffenhausen. The move, which will boost jobs dedicated…Blue Origin’s passengers will pay hundreds of thousands of dollars for a ticket on New Shepard8:29 pm CEST • October 2, 2019After committing to having a first crewed launch of its rocket ship in 2019, Blue Origin, the rocket manufacturer and launch services company backed by Jeff Bezos, is likely going to have to push t…YouTube Music is launching three new personalized playlists8:23 pm CEST • October 2, 2019YouTube Music is preparing to better challenge Spotify and others with the launch of three new personalized playlists — Discover Mix, New Release Mix and Your Mix — said YouTube Chief P…Actor and HitRecord founder Joseph Gordon-Levitt says we should all get off YouTube8:16 pm CEST • October 2, 2019The multi-hyphenate actor-director-entrepreneur, Joseph Gordon-Levitt (best known for roles in “3rd Rock from the Sun,” “Inception,” “Snowden” and “10 Things I Hate About You,”) came to TechCrunch …Extra CrunchHow Lime, Scoot, JUMP and Spin plan to deploy adaptive scooters8:05 pm CEST • October 2, 2019As part of San Francisco’s program to operate shared electric scooters in the city, it’s requiring providers to pilot adaptive scooters to ensure people with disabilities are not left o…Flir purchases IP and assets from defunct drone company, Aria7:59 pm CEST • October 2, 2019Back in March, Aria Insights suddenly went dark. The news was a bit of a surprise from a startup that had just announced a name change and pivot in tech focus. Today, thermal imaging company Flir a…Snaplogic raises $72M more for its enterprise data integration platform7:43 pm CEST • October 2, 2019Cloud services and the adoption of apps that rely on them are continue to grow in popularity, but a persistent theme in enterprise technology has been that a lot of organizations still continue to …India’s Udaan raises $585M to expand its B2B e-commerce platform7:16 pm CEST • October 2, 2019Udaan, a three-year-old business-to-business e-commerce platform in India, has raised more than half a billion dollars in a new financing round as it looks to bring more kirana stores, chemists and…TechCrunchPrivacy PolicyAbout Our AdsCode of ConductTerms of ServicePowered by WordPress VIP. Fonts by TypeKit(opens in a new window).

If you like this post, please consider sharing it.

Leave a Comment

Your email address will not be published. Required fields are marked *