On October 1,2019 the European Court of Justice ruled that website operators cannot obtain consent to the setting of cookies for advertising purposes by ticking an already checked box (Judgment of October 1,2019, Rs C-673/17).
Much rather, the user must actively tick a checkbox in order to give his consent. The decision of the ECJ applies regardless of whether the data stored in the cookie constitute personal data or not. Another requirement for legally effective consent is that the user has been informed about the duration of the cookie's function and possible access rights of third parties to the cookie.
In its decision, the ECJ did not deal with the question in which cases consent to the setting of a cookie is required. However, the ECJ has defined concrete guidelines for how consent is to be obtained. The decision therefore has no influence on cookies, which are technically necessary for the functionality of a website (login sessions, shopping cart, language settings).
The German Data Protection Conference ("DSK") published a guideline for providers of telemedia services in March 2019 in which it outlined its position on cookies once again. In the opinion of DSK, cookies, which track user behaviour via various websites, cannot be used on the basis of the legitimate interest of the website operator, but only with an active consent.
Practical tip: Website operators should check whether and which cookies are used on the site. Consent must be adapted to the requirements of the ECJ. Cookies, for which consent is to be obtained, must then be inactive before an active consent is given. In the privacy policies, the storage period of cookies must be specified and it must be clarified whether third parties have access to the cookies.