Online companies in the European Union can no longer present internet users with a pre-checked box telling them cookies will be planted on their smartphone or computer if they don’t deselect the option. A court issued this ruling on Tuesday, 1st October 2019.

The decision by the European Court of Justice means that users need to give “active consent”. They won’t need to opt-out of an automatic default that would otherwise plant cookies in their device’s system.

The EU court responded to a German court’s request for interpretation of an EU law protecting privacy through electronic communications. It arose from a challenge lodged by a German consumer federation against a German company, Planet49. The company presented users wanting to play its promotional lottery with a pre-checked cookie box.

The tracking cookies were to gather information on the users for advertising products from Planet49’s commercial partners. It is a common method by online companies.

But the court determined that “consent must be specific”. Pressing a website button to participate in a lottery “is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies”.

The ruling comes with authorities in Europe, and increasingly in the United States and elsewhere. They grapple with how to protect citizens’ privacy online as internet companies gather and cross-reference information gleaned from web use.

Meanwhile, cookies are small pieces of computer code downloaded into a user’s device to track what sites they visit. They also track how users interact with sites and other bits of information.

The EU court also ruled that online users accepting cookies must be notified of how long those cookies will track them. Furthermore, they should know whether or not third parties have access to the information they gather.