“We use cookies” is the welcoming phrase used on many websites. Although the use of cookies is widespread, the legal framework for this was not clearly defined. It was in particular unclear to date whether consent is required for this and what form such consent has to take.

The German supervisory authorities require providers to ensure that every cookie used is justified under the GDPR. As concrete example they only comment on the analysis service Google Analytics, for which the consent of the user is necessary in any case.

Many providers ask users for their express consent to all or specific cookies. Some are content with just pointing out their use of cookies which they justify with legitimate interests, or assume the users’ tacit consent if they continue to use the website.

Today’s ruling by the Federal Court of Justice (Bundesgerichtshof,‘BGH’) in the “Planet49” case (file ref. I ZR 7/16 –“Cookie Einwilligung II”) makes a significant contribution to clarification. The BGH has ruled that cookies for advertising and market research require consent of the user. This is based directly on the ePrivacy Directive, not the GDPR. To obtain such consent, providers cannot rely on an opt-out procedure, whereby consent is pre-selected so that users must actively deselect the consent to refuse it.