Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH

1.

In order to participate in a lottery organised by Planet49, an internet user was confronted with two checkboxes which had to be clicked or unclicked before he could hit the ‘participation button’. One of the checkboxes required the user to accept being contacted by a range of firms for promotional offers, another checkbox required the user to consent to cookies being installed on his computer. These are, in a nutshell, the facts of the present order for reference from the Bundesgerichtshof (Federal Court of Justice, Germany).

2.

Beneath these seemingly benign facts lie fundamental issues of EU data protection law: what precisely are the requirements of informed consent which is to be freely given? Is there a difference as regards the processing of personal data (only) and the setting of and access to cookies? Which legal instruments are applicable?

3.

In this Opinion I shall argue that, as regards the current case, the requirements for giving consent are the same under Directive 95/46/EC ( 2 ) and Regulation (EU) 2016/679 ( 3 ) and that there is, in the case at issue, no difference whether we are dealing with the general question of processing of personal data or the more particular one of storing of and gaining access to information by way of cookies.

4.

Article 2 of Directive 95/46, headed ‘Definitions’, provides:

‘For the purposes of this Directive:

…

5.

Within Section II of that directive, entitled ‘Criteria for Making Data Processing Legitimate’, Article 7 provides under point (a):

‘Member States shall provide that personal data may be processed only if:

…’

6.

Article 10 of the same directive, headed ‘Information in cases of collection of data from the data subject’, provides as follows:

‘Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:

in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject.’

7.

Recitals 24 and 25 of Directive 2002/58/EC ( 5 ) state the following:

8.

Article 2 of that directive, headed ‘Definitions’, provides, under point (f):

‘Save as otherwise provided, the definitions in Directive 95/46 and in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) [ ( 6 )] shall apply.

The following definitions shall also apply:

…

…’

9.

Article 5(3) of that directive, that article being headed ‘Confidentiality of the communications’, provides:

‘Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.’

10.

Recital 66 of Directive 2009/136/EC ( 8 ) states:

‘Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.’

11.

Recital 32 of Regulation 2016/679 states:

‘Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.’

12.

Article 4, point (11), of that regulation, that article being headed ‘Definitions’, provides:

‘For the purposes of this Regulation:

…

…’

13.

Article 6 of the same regulation, headed ‘Lawfulness of processing’, provides:

‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:

...’

14.

Article 7 of Regulation 2016/679 is headed ‘Conditions for consent’. According to Article 7(4), ‘[w]hen assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract’.

15.

Article 307 ( 9 ) of the Bürgerliches Gesetzbuch (German Civil Code, the ‘BGB’) provides:

‘(1)   Provisions in standard business terms are ineffective if, contrary to the requirement of good faith, they unreasonably disadvantage the other party to the contract with the user. An unreasonable disadvantage may also arise from the provision not being clear and comprehensible.

(2)   An unreasonable disadvantage is, in case of doubt, to be assumed to exist if a provision

(3)   Subsections (1) and (2) above, and articles 308 and 309 apply only to provisions in standard business terms on the basis of which arrangements derogating from legal provisions, or arrangements supplementing those legal provisions, are agreed. Other provisions may be ineffective under subsection (1) sentence 2 above, in conjunction with subsection (1) sentence 1 above.’

16.

The Gesetz gegen den unlauteren Wettbewerb (Law against Unfair Competition, the ‘UWG’) prohibits commercial practices which constitute unacceptable nuisance to a market participant. Article 7(2) of the UWG provides, under point (2), that ‘[a]n unacceptable nuisance shall always be assumed in the case of … advertising by means of a telephone call, made to a consumer without his prior express consent, or made to another market participant without at least the latter’s presumed consent’.

17.

Article 12(1) of the Telemediengesetz (Telemedia Act, the ‘TMG’) transposes Article 7(a) of Directive 95/46 and sets forth the conditions under which a service provider is authorised to collect and use personal data for electronic media purposes. Under that article, a service provider is entitled to collect and use personal data for electronic media purposes only if the TMG or another legal instrument expressly governing electronic media authorises it, or if the user consents.

18.

Article 12(3) of the TMG provides that the legislation in force governing personal data must be applied even if data does not undergo automatic processing.

19.

Article 13(1) of the TMG requires the service provider to inform the user at the beginning of usage, on the nature, extent, and purpose of the processing of personal data as well as the processing of data beyond the scope of Directive 95/46.

20.

Article 15(1) of the TMG provides that service providers can collect and process personal data only if necessary for media use online or for the purposes of issuing an invoice relating to this use (‘user data’). User data is defined as inter alia data allowing for the identification of users.

21.

Article 15(3) of the TMG transposes Article 5(3) of Directive 2002/58 and authorises a service provider to establish user profiles through pseudonyms for purposes of advertising, market analysis, or configuration of electronic media, provided that the user does not object and the service provider has informed the user of his or her right of refusal, in accordance with the obligation to provide information under Article 13(1) of the TMG.

22.

Article 3(1) of the Bundesdatenschutzgesetz (Federal Law on Data Protection, the ‘BDSG’) ( 10 ) transposes Article 2(a) of Directive 95/46 and defines the term ‘personal data’ as data relating to the personal or factual circumstances of an identified or identifiable natural person.

23.

Article 4a of the BDSG transposes into national law Article 2(h) of Directive 95/46, and provides that consent is only valid if it arises from the free choice of concerned persons.

24.

On 24 September 2013, Planet49 GmbH organised a promotional lottery at the web address www.dein-macbook.de. ( 11 ) To participate in the lottery, an internet user was required to enter his postcode, which prompted a page containing input fields for the user’s name and address. Beneath the input fields for the address were two sets of explanatory text accompanied by checkboxes. I shall hereafter refer to them as ‘first checkbox’ and ‘second checkbox’. The first explanatory text, the checkbox for which did not contain a pre-selected tick, read:

‘I agree to certain sponsors and cooperation partners providing me with information by post or by telephone or by email/SMS about offers from their respective commercial sector. I can determine these myself here; otherwise, the selection is made by the organiser. I can revoke this consent at any time. Further information about this can be found here.’

25.

The second explanatory text, which was given a pre-selected tick, read:

‘I agree to the web analytics service Remintrex being used for me. This has the consequence that, following registration for the lottery, the lottery organiser, Planet49 GmbH, sets cookies, which enables Planet49 to evaluate my surfing and use behaviour on websites of advertising partners and thus enables advertising by Remintrex that is based on a user’s interests. I can delete the cookies again at any time. You can read more about this here.’

26.

Participation in the lottery was only possible if at least the first checkbox had been ticked.

27.

The electronic link associated with the words ‘sponsors and cooperation partners’ and ‘here’ in the first explanatory text led to a list which contained 57 companies, their addresses, the commercial sector to be advertised and the method of communication used for the advertising (email, post or telephone), as well as the underlined word ‘Unsubscribe’ after each company. The following statement preceded the list:

‘By clicking on the “Unsubscribe” link, I am deciding that no advertising consent is permitted to be granted to the partner/sponsor in question. If I have not unsubscribed from any or a sufficient number of partners/sponsors, Planet49 will choose partners/sponsors for me at its discretion (maximum number: 30 partners/sponsors).’

28.

When the electronic link associated with the word ‘here’ in the second explanatory text was clicked on, the following information was displayed:

‘The cookies named ceng_cache, ceng_etag, ceng_png and gcr are small files which are stored in an assigned manner on your hard disk by the browser you use and by means of which certain information is supplied which enables more user-friendly and effective advertising. The cookies contain a specific randomly generated number (ID), which is at the same time assigned to your registration data. If you then visit the website of an advertising partner which is registered for Remintrex (to find out whether a registration exists, please consult the advertising partner’s data protection declaration), Remintrex automatically records, by virtue of an iFrame which is integrated there, that you (or the user with the stored ID) have visited the site, which product you have shown interest in and whether a transaction was entered into.

Subsequently, Planet49 GmbH can arrange, on the basis of the advertising consent given during registration for the lottery, for advertising emails to be sent to you which take account of your interests demonstrated on the advertising partner’s website. After revoking the advertising consent, you will of course not receive any more email advertising.

The information communicated by these cookies is used exclusively for the purposes of advertising in which products of the advertising partner are presented. The information is collected, stored and used separately for each advertising partner. User profiles involving multiple advertising partners will not be created under any circumstances. The individual advertising partners do not receive any personal data.

If you have no further interest in using the cookies, you can delete them via your browser at any time. You can find a guide in your browser’s help function.

No programs can be run or viruses transmitted by means of the cookies.

You of course have the option to revoke this consent at any time. You can send the revocation in writing to PLANET49 GmbH [address]. However, an email to our customer services department [email address] will also suffice.’

29.

The applicant in the main proceedings, the Bundesverband der Verbraucherzentralen (Federation of German Consumer Organisations, the ‘Bundesverband’) is registered on the list of qualified entities pursuant to the Gesetz über Unterlassungsklagen bei Verbraucherrechts- und anderen Verstößen (Law relating to injunctions in the case of breaches of consumer law and of other laws, ‘the UKlaG’). According to the Bundesverband, the aforementioned declarations of consent used by Planet49 did not satisfy the requirements set forth in Article 307 of the BGB, Article 7(2), point 2, of the UWG and Article 12 et seq. of the TMG. A warning notice served prior to court proceedings produced no result.

30.

The Bundesverband instituted proceedings before the Landgericht Frankfurt am Main (Regional Court, Frankfurt am Main, Germany) requesting Planet49 to stop using the abovementioned clauses ( 12 ) and to order that company to pay to it the sum of EUR 214 plus interest from 15 March 2014.

31.

The Landgericht Frankfurt am Main (Regional Court, Frankfurt am Main) allowed certain claims to proceed and dismissed the remainder of the application. Further to an appeal on the merits ( 13 ) before the Oberlandesgericht Frankfurt am Main (Higher Regional Court, Frankfurt am Main, Germany), the Bundesgerichtshof (Federal Court of Justice) was seised by way of an appeal on a point of law. ( 14 )

32.

The Bundesgerichtshof (Federal Court of Justice) considers that the success of the appeal on a point of law hinges on the interpretation of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46, and of Article 6(1)(a) of Regulation 2016/679 and has referred the following questions to the Court of Justice for a preliminary ruling:

33.

The order for reference was received by the Court on 30 November 2017. Written observations were lodged by Planet49, the Bundesverband, the Portuguese and Italian Governments and the European Commission. A hearing was held on 13 November 2018, which was attended by Planet49, the Bundesverband, the German Government and the Commission.

34.

Both questions referred by the Bundesgerichtshof (Federal Court of Justice) for a preliminary ruling relate to the giving of consent to the storing of information, and the gaining of access to information already stored in the user’s terminal equipment, that is to say to cookies, in the specific context of the provisions of Directive 2002/58, read in conjunction with those of Directive 95/46 or Regulation 2016/679.

35.

By way of preliminary remarks, I deem it helpful to provide factual clarification on the phenomenon of cookies and related terminology as well as legal clarification on the applicable legal instruments to the case at issue.

36.

A cookie is a way of collecting information generated by a website and saved by an internet user’s browser. ( 15 ) It is a small piece of data or text file, usually less than one Kbyte in size, that a website asks an internet user’s browser to store on the local hard disk of the user’s computer or mobile device. ( 16 )

37.

A cookie allows the website to ‘remember’ the user’s actions or preferences over time. Most web browsers support cookies, but users can set their browsers to decline them. They can also delete them whenever they like. Indeed, many users set their cookie settings in their browsers to automatically delete cookies by default when the browser window is closed. That said, empirical evidence overwhelmingly demonstrates that people rarely change default settings, a phenomenon which has been coined ‘default inertia’. ( 17 )

38.

Websites use cookies for the purposes of identifying users, remembering their custom preferences and allowing users to complete tasks without having to re-enter information when browsing from one page to another or when visiting the site later.

39.

Cookies can also be used to collect information for online behaviour target advertising and marketing. ( 18 ) Companies, for example, use software to track user behaviour and build personal profiles, which allows users to be shown advertisements relevant to a user’s previous searches. ( 19 )

40.

There are different types of cookies, some of which are classified according to the cookie’s lifespan (e.g. session cookies and persistent cookies) and others of which are based on the domain to which the cookie belongs (e.g. first-party and third-party cookies). ( 20 ) When the web server supplying the webpage stores cookies on the user’s computer or mobile device, they are known as ‘http header’ cookies. ( 21 ) Another way of storing cookies is through JavaScript code contained or referenced in that page. ( 22 ) The validity of consent to the placement of cookies and the applicability of any relevant exemptions, however, should be evaluated based on the purpose of the cookie rather than the technical features. ( 23 )

41.

The legislative framework applicable to the main proceedings has evolved over the years, leading up to, most recently, the entry into force of Regulation 2016/679.

42.

Two sets of EU legal instruments are applicable to the case at issue. First, Directive 95/46 and Regulation 2016/679. Secondly, Directive 2002/58, as amended by Directive 2009/136. ( 24 )

43.

I should like to make two observations with respect to these two sets of instruments.

44.

The first observation relates to the applicability of Directive 95/46 and Regulation 2016/679.

45.

Regulation 2016/679, which has been applicable since 25 May 2018, ( 25 ) repealed Directive 95/46 with effect from the same date. ( 26 )

46.

This date of 25 May 2018 post-dates the last hearing before the referring court of 14 July 2017 and indeed also the date of 5 October 2017 when the present case was referred to the Court of Justice for a preliminary ruling.

47.

Ergo, for situations before 25 May 2018, the applicable law is Directive 2002/58 in combination with Directive 95/46, while for situations as from 25 May 2018, it is Directive 2002/58 in combination with Regulation 2016/679.

48.

Insofar as the Bundesverband wishes, with the injunction sought, ( 27 ) to prevent Planet49 from behaving as it has in the future, Regulation 2016/679 is applicable in the present case. In its decision on the injunction claim for the future, the Bundesgerichtshof (Federal Court of Justice) will therefore have to take into account the requirements of Regulation 2016/679. In this connection, the German Government points to consistent national case-law on the relevant legal situation in actions for injunctions. ( 28 )

49.

As a consequence, the question referred must therefore be answered having regard to both Directive 95/46 and Regulation 2016/679. ( 29 )

50.

Moreover, it should be noted that references in Directive 2002/58 to Directive 95/46 are to be construed as references to Regulation 2016/679. ( 30 )

51.

The second observation relates to the evolution of Article 5(3) of Directive 2002/58.

52.

Directive 2002/58 seeks to ensure full respect for the rights set forth in the Charter of Fundamental Rights of the European Union, and in particular, in Articles 7 and 8 thereof. ( 31 ) Article 5 of this directive aims to ensure the ‘confidentiality of communications’. In particular, Article 5(3) regulates the use of cookies and lays down the requirements which must be satisfied before data can be stored or accessed on a user’s computer via the setting of a cookie.

53.

Directive 2009/136 introduced significant changes to the consent requirements under Article 5(3) of Directive 2002/58 in order to enhance user protection. Before the amendments instituted by that directive, Article 5(3) merely required that users be given an informed ‘opt-out’ from data processing via cookies. In other words, according to the original version of Article 5(3), when storing information on the user’s terminal equipment or gaining access to information stored there, the service provider had to provide the user with clear and comprehensive information in particular about the purpose of the processing and offer the user the right to refuse such processing.

54.

Directive 2009/136 replaced this requirement to inform about the right to refuse with the requirement that ‘the subscriber or user concerned has given his or her consent’, meaning that it replaced the easier to satisfy informed opt-out system with an informed opt-in system. Subject to a very limited exception which does not apply to the present case, ( 32 ) the use of cookies under the revised Article 5(3) of Directive 2002/58 is permitted only if the user has given consent after being provided with clear and comprehensive information in accordance with Directive 95/46 about why his or her data is being tracked, that is to say, the purposes of the processing. ( 33 )

55.

As will be seen in more detail below, the scope of the requirement to provide information under Article 5(3) of Directive 2002/58 lies at the heart of the issue in dispute, particularly in the context of default settings for online activities.

56.

By its Question 1(a), the referring court enquires whether it constitutes a valid consent within the meaning of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46 if the storage of information, or the access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent. In this connection, the referring court wonders if it makes a difference whether the information stored or accessed constitutes personal data (Question 1(b)). Finally, the referring court would like to know if in the circumstances described above, a valid consent exists within the meaning of Article 6(1)(a) of Regulation 2016/679 (Question 1(c)).

57.

A feature underlying EU data protection law is that of consent.

58.

Before turning to the specific issue of cookies, I should like to establish general principles deriving from the applicable legal instruments on the giving of consent.

59.

I infer from the provisions of Directive 95/46 that consent needs to be manifested in an active ( 34 ) manner.

60.

Article 2(h) of Directive 95/46 refers to an indication of the data subject’s wishes, which clearly points to active, rather than passive, behaviour. In addition to this, Article 7(a) of Directive 95/46, which deals with the criteria for making (personal) data processing legitimate, stipulates that the data subject has unambiguously given his consent. Again, ambiguity can only be removed with active, as opposed to passive, behaviour.

61.

I infer from this that it is not sufficient in this respect if the user’s declaration of consent is pre-formulated and if the user must actively object when he does not agree with the processing of data.

62.

Indeed, in the latter situation, one does not know whether such a pre-formulated text has been read and digested. The situation is not unambiguous. A user may or may not have read the text. He may have omitted to do so out of pure negligence. In such a situation, it is not possible to establish whether consent has been freely given.

63.

Closely linked to the requirement of active consent is that of separate consent. ( 35 )

64.

One could argue, as does Planet49, that a valid consent is given on the part of the data subject, not when he does not unclick a pre-formulated declaration of consent but when he actively ‘clicks’ on the participation button for the online lottery.

65.

I do not subscribe to such an interpretation.

66.

For consent to be ‘freely given’ and ‘informed’, it must not only be active, but also separate. The activity a user pursues on the internet (reading a webpage, participating in a lottery, watching a video, etc.) and the giving of consent cannot form part of the same act. In particular, from the perspective of the user, the giving of consent cannot appear to be of an ancillary nature to the participation in the lottery. Both actions must, optically in particular, be presented on an equal footing. As a consequence, it appears to me doubtful that a bundle of expressions of intention, which would include the giving of consent, would be in conformity with the notion of consent under Directive 95/46.

67.

In this context, it must be made crystal-clear to a user whether the activity he pursues on the internet is contingent upon the giving of consent. A user must be in a position to assess to what extent he is prepared to give his data in order to pursue his activity on the internet. There must be no room for any ambiguity whatsoever. ( 36 ) A user must know whether and, if so, to what extent his giving of consent has a bearing on the pursuit of his activity on the internet.

68.

The principles established above are equally valid for Regulation 2016/679.

69.

Article 4, point 11, of Regulation 2016/679 defines consent of the data subject as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

70.

It should be noted that this definition is stricter than that of Article 2(h) of Directive 95/46 in that it requires an unambiguous indication of the data subject’s wishes and a clear affirmative action signifying agreement to the processing of personal data.

71.

Furthermore, the recitals of Regulation 2016/679 are particularly illuminating. Because I shall make extensive reference to the recitals, ( 37 ) I feel compelled to recall that they obviously do not have any independent legal value, ( 38 ) but that the Court frequently resorts to them in interpreting provisions of an EU legal act. In the EU legal order they are descriptive and not prescriptive in nature. Indeed, the question of their legal value does not normally arise for the simple reason that, typically, the recitals are reflected in the legal provisions of a directive. Good legislative practice by the political institutions of the EU tends to aim at a situation in which the recitals provide a useful background to the provisions of a legal text. ( 39 )

72.

Pursuant to recital 32 of Regulation 2016/679, consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

73.

Active consent is now, therefore, expressly provided for by Regulation 2016/679.

74.

Moreover, recital 43 of that regulation states that in order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

75.

The need for separate consent is therefore now stressed explicitly in this recital.

76.

Pursuant to Article 5(3) of Directive 2002/58, Member States are to ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46, inter alia, about the purposes of the processing.

77.

This provision does not establish any further criteria as regards the notion of consent.

78.

However, the recitals of Directive 2002/58 and Directive 2009/136 provide guidance on consent with respect to cookies.

79.

Thus, recital 17 of Directive 2002/58 indicates that consent may be given by any appropriate method enabling a freely given specific and informed indication of the user’s wishes, including by ticking a box when visiting an internet website. ( 40 )

80.

Moreover, Recital 66 of Directive 2009/136 explains the paramount importance of users being provided with clear and comprehensive information when engaging in any activity which could result in storage of information on the equipment of a user or gaining of access to information already stored and that the methods of providing information and offering the right to refuse should be as user-friendly as possible.

81.

In this connection, I should also like to point to the non-binding but nevertheless enlightening work of the ‘Article 29’ Data Protection Working Party (‘the “Article 29” Working Party’), ( 41 ) according to which consent implies a prior affirmative action from the users towards accepting the storage of the cookie and the use of the cookie. ( 42 ) That same working party reveals that the notion of ‘indication’ implies the need for action. ( 43 ) Other elements of the definition of consent, and the additional requirement in Article 7(a) of Directive 95/46 for consent to be unambiguous, support this interpretation. ( 44 ) The requirement that the data subject must ‘signify’ his or her consent indicates that simple inaction is insufficient and that some sort of action is required to constitute consent, although different kinds of actions, to be assessed ‘in context’, are possible. ( 45 )

82.

I should now like to apply these criteria to the case at issue. In doing so, I shall first turn to Question 1(a) and (c), that is to say the question whether there has been valid consent concerning the setting of and the access to the cookies. This covers the second checkbox.

83.

Furthermore, given that, as has just been established, the requirements for consent do not greatly differ as regards cookies and, more generally, processing of personal data, for the sake of both completeness and clarity, even though the referring court does not explicitly enquire about this issue, for the correct and uniform interpretation of EU law, I do deem it necessary to briefly analyse whether there has been a valid consent concerning the processing of personal data in the context of the first checkbox. I also understand that in the context of the proceedings before it, the Bundesgerichtshof (Federal Court of Justice) will have to rule on the first checkbox. ( 46 )

84.

The referring court enquires whether it constitutes a valid consent within the meaning of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46 if the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent.

85.

The crucial terms of Article 2(h) of Directive 95/46 and of Article 4, point 11, of Regulation 2016/679 for the purposes of this question are ‘freely given’ and ‘informed’. The question arises whether, in a situation as described by the referring court, consent can be given freely and in an informed manner.

86.

Planet49 thinks this to be the case. All other parties ( 47 ) disagree. In this context, the legal debate of the parties primarily focused on whether the ticking or unticking of a checkbox containing an already pre-selected tick satisfies these requirements. The debate turns around the question of activity and passivity. However, this aspect, important as it is, constitutes only a part of the requirements. For it only addresses the requirement of active, but not that of separate, consent.

87.

In my view, on the basis of the criteria established above, the answer is that there is no valid consent in the case at issue.

88.

First, requiring a user to positively untick a box and therefore become active if he does not consent to the installation of cookies does not satisfy the criterion of active consent. In such a situation, it is virtually impossible to determine objectively whether or not a user has given his consent on the basis of a freely given and informed decision. By contrast, requiring a user to tick a box makes such an assertion far more probable.

89.

Secondly and more importantly, the participation in the online lottery and the giving of consent to the installation of cookies cannot form part of the same act. But this is precisely the case in the present proceedings. In the end, a user only effectuates one click on the participation button in order to participate in the lottery. At the same time he consents to the installation of cookies. Two expressions of intention (participation in the lottery and consent to the installation of cookies) are made at the same time. These two expressions cannot both be subject to the same participation button. Indeed, in the present case, the consenting to the cookies appears ancillary in nature, in the sense that it is in no way clear that it forms part of a separate act. Put differently, (un)ticking the checkbox on the cookies appears like a preparatory act to the final and legally binding act which is ‘hitting’ the participation button.

90.

In such a situation, a user is not in a position to freely give his separate consent to the storing of information or the gaining of access to information already stored, in his terminal equipment.

91.

Moreover, it has been established above that participation in the lottery was only possible if at least the first checkbox had been ticked. As a consequence, participation in the lottery was not conditional ( 48 ) upon giving consent to the installation of and gaining access to cookies. For a user might as well have clicked the first checkbox (only).

92.

But, to the best of my knowledge, at no point was the user informed of this. This does not meet the criteria on fully informing users established above.

93.

In summary, my proposed answer to Question 1(a) and c) is that there is no valid consent within the meaning of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46, in a situation such as that of the main proceedings where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent and where consent is given not separately but at the same time as confirmation in the participation in an online lottery. The same goes for the interpretation of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 4, point 11, of Regulation 2016/679.

94.

Although the questions of the referring court refer to the second checkbox only, I should like to make two specific remarks with respect to the first checkbox, which may assist the referring court in its final decision.

95.

To recall, the first checkbox does not deal with cookies but only with the processing of personal data. Here, a user agrees not to having information stored on his equipment but (merely) to being contacted by a list of firms by post, telephone or email.

96.

First, the criteria on active and separate consent and full information obviously also apply with respect to the first checkbox. Active consent does not appear to pose a problem, since the checkbox is not pre-ticked. By contrast, I have some doubts about separate consent. On the basis of the analysis above, ( 49 ) with respect to the facts to the present case, it would be better if, figuratively speaking, there were a separate button to be clicked, ( 50 ) rather than merely a box to be ticked, in order to consent to the processing of personal data.

97.

Secondly, as regards the first checkbox on the contact by sponsors and cooperation partners, regard should be had to Article 7(4) of Regulation 2016/679. Pursuant to this provision, when assessing whether consent is freely given, utmost account is to be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Article 7(4) of Regulation 2016/679, therefore, now codifies a ‘prohibition on bundling’. ( 51 )

98.

As transpires from the terms ‘utmost account shall be taken of’, the prohibition on bundling is not absolute in nature. ( 52 )

99.

Here, it will be for the competent court to assess whether the consent to the processing of personal data is necessary for the participation in the lottery. In this respect it should be kept in mind that the underlying purpose in the participation in the lottery is the ‘selling’ of personal data (i.e. agreeing to be contacted by so-called ‘sponsors’ for promotional offers). In other words, it is the providing of personal data which constitutes the main obligation of the user in order to participate in the lottery. In such a situation it appears to me that the processing of this personal data is necessary for the participation in the lottery. ( 53 )

100.

I should now like to examine whether, for the purposes of the application of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46, it makes a difference whether the information stored or accessed constitutes personal data.

101.

This question is best understood against the background of German law transposing Article 5(3) of Directive 2002/58. ( 54 ) In fact, German law establishes a difference between the collection and use of personal data and other data.

102.

Pursuant to Article 12(1) of the TMG, a service provider may collect and use personal data only if, among other things, the user has consented to it.

103.

By contrast, according to Article 15(3) of the TMG, a service provider may create user profiles through pseudonyms, inter alia, for the purposes of advertising and market research, provided the user does not object to this. Ergo, in so far as no personal data are involved, the requirement is less strict under German law: not consent, but merely non-objection.

104.

Personal data is legally defined in Article 4, point 1, of Regulation 2016/679 as ‘any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

105.

I think it is beyond doubt that, as far as the case at issue is concerned, the ‘information’ referred to in Article 5(3) of Directive 2002/58 constitutes ‘personal data’. This too appears to be the view of the referring court, which explicitly states in its order for reference that the accessing of data from the cookies used by the defendant is subject to the requirement for consent under Article 12(1) of the TMG because the data in question here are personal data. ( 55 ) Moreover, it does not appear to be disputed between the parties in the main proceedings that we are dealing here with personal data.

106.

One may therefore wonder about the relevance of this question for the case at issue and whether the question is not hypothetical. ( 56 )

107.

Be that as it may, I think the answer to this question is pretty straightforward: it makes no difference whether the information stored or accessed constitutes personal data. Article 5(3) of Directive 2002/58 refers to the ‘storing of information, or the gaining of access to information already stored’. ( 57 ) It is clear that any such information has a privacy aspect to it, regardless of whether it constitutes ‘personal data’ within the meaning of Article 4, point 1, of Regulation 2016/679 or not. As the Commission rightly stresses, Article 5(3) of Directive 2002/58 aims to protect the user from interference with his or her private sphere, regardless of whether that interference involves personal data or other data.

108.

Such an understanding of Article 5(3) of Directive 2002/58 is, moreover corroborated by recitals 24 ( 58 ) and 25 ( 59 ) of that directive as well as Opinions of the ‘Article 29’ Working Party. Indeed, according to this Working Party, ‘Article 5(3) applies to “information” (stored and/or accessed). It does not qualify such information. It is not a prerequisite for the application of this provision that this information is personal data within the meaning of Directive 95/46’. ( 60 )

109.

As a consequence, it does appear as if Article 15(3) of the TMG does not fully transpose the requirements of Article 5(3) of Directive 2002/58 into German law. ( 61 )

110.

I therefore propose to reply to Question 1(b) that for the purposes of the application of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46 it makes no difference whether the information stored or accessed constitutes personal data.

111.

By the second question, the referring court would like to know what information the service provider has to give within the scope of the requirement to provide clear and comprehensive information to the user in accordance with Article 5(3) of Directive 2002/58 and whether this includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies.

112.

Articles 10 and 11 of Directive 95/46 (and Articles 13 and 14 of Regulation 2016/679) set out an obligation to provide information to data subjects. The obligation to inform is linked to consent in that there must always be information before there can be consent.

113.

Given the conceptual proximity of an internet user (and provider) to that of a consumer (and trader), ( 62 ) one can resort at this stage to the concept of the average European consumer who is reasonably well informed and reasonably observant and circumspect ( 63 ) and who is able to take the decision to make an informed commitment. ( 64 )

114.

However, due to the technical complexity of cookies, the asymmetrical information between provider and user and, more generally, the relative lack of knowledge of any average internet user, the average internet user cannot be expected to have a high level of knowledge of the operation of cookies.

115.

Thus, clear and comprehensive information implies that a user is in a position to be able to easily determine the consequences of any consent he might give. To that end he must be able to assess the effects of his actions. The information given must be clearly comprehensible and not be subject to ambiguity or interpretation. It must be sufficiently detailed so as to enable the user to comprehend the functioning of the cookies actually resorted to.

116.

This includes, as the referring court rightly suggests, both the duration of the operation of the cookies and the question of whether third parties are given access to the cookies.

117.

By virtue of recitals 23 and 26 of Directive 2002/58, the duration of the operation of cookies is an element of the requirement for informed consent, meaning that service providers should ‘always keep subscribers informed of the types of data they are processing and the purposes and duration for which it is done’. Even if the cookie is essential, the question of how intrusive it is must be examined against the surrounding circumstances for consent purposes. In addition to asking what data each cookie holds and whether it is linked to any other information held about the user, service providers must consider the lifespan of the cookie and whether this lifespan is appropriate in light of the cookie’s purpose.

118.

The duration of the operation of cookies relates to the explicit informed consent requirements regarding the quality and accessibility of information to users. This information is vital to enable individuals to make informed decisions prior to the processing. ( 65 ) As submitted by the Portuguese and Italian Governments, since data collected by cookies must be eliminated once it is no longer necessary to achieve the original purpose, it follows that the time period for storage of data collected must be clearly communicated to the user.

119.

Here, Planet49 contends that if third parties gain access to a cookie, users must also be informed of this. However, if, as in the case at issue, only a provider who wishes to set the cookie has access to the cookie, it is sufficient to draw attention to this fact. The fact that other third parties have no access does not have to be pointed out separately. Such an obligation would not be compatible with the legislative intention that the data protection texts should remain user-friendly and concise.

120.

I cannot subscribe to such an interpretation. Rather, for information to be clear and comprehensive, a user should be explicitly informed whether third parties have access to the cookies set or not. And if third parties have access, their identity must be disclosed. As the Bundesverband rightly stresses, this is indispensable in order to ensure that informed consent is given.

121.

I therefore propose to reply to the second question that the clear and comprehensive information a service provider has to give to a user, under Article 5(3) of Directive 2002/58, includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies or not.

122.

In the light of the foregoing considerations, I propose that the Court answer the questions referred by the Bundesgerichtshof (Federal Court of Justice, Germany) as follows: