Pre-Ticked Boxes and Cookie Consent

What the court decided

Yesterday the Court of Justice of the European Union, the EU's highest court, ruled that a checkbox ticked in advance does not give valid consent to cookies.

The case concerned an online lottery run in Germany by a company called Planet49. Entrants saw two boxes: one, unticked, about marketing from partner companies, and one already ticked, agreeing to cookies that would track their browsing for advertising.

The court said consent requires an active choice. A box the visitor has to notice and untick is not one, and clicking the button to enter the lottery did not count as consent to cookies either.

It added that the rule applies whether or not the cookies hold personal information, and that visitors must be told how long cookies last and whether third parties can read them.

What it means in practice

• Pre-ticked boxes for optional cookies are not consent.
• An unrelated button, such as enter or submit, is not consent either.
• Personal or not, what is stored on the visitor's device is covered.
• Duration and third-party access belong in what visitors are told.
• Cookies the site cannot work without, such as a shopping basket, need no consent.

The last is the one that keeps this manageable: the rule concerns cookies a site could run without, mainly analytics, advertising and social media tracking.

Who it reaches in Canada

The ruling interprets European law. A Canadian business is not bound by it simply because somebody in Europe once visited its website.

It matters for Canadian businesses that offer goods or services to people in Europe or monitor their behaviour there, which is broadly when European data protection law reaches beyond Europe. A privacy lawyer can say where your business sits.

A lodge taking deposits from visitors in Germany, or a store pricing in euros, is in a different position from a contractor whose site gets the odd visit from Europe.

The same rule in Canadian email law

Canadian businesses have lived with a version of this since 2014, for email rather than cookies.

Canada's anti-spam legislation, CASL, requires consent before sending commercial email, and express consent has to come from a positive action by the person.

The CRTC, which enforces the law's consent rules, has said a pre-checked box cannot be used to obtain express consent. Its guidance also says a request for consent to marketing email must be separate from agreeing to terms and conditions.

That is close to the lottery point: agreeing to one thing is not agreeing to another.

So a pre-ticked box saying send me news and offers, at the end of a booking form, does not give express consent under CASL, wherever the customer lives.

What to change in the cookie notice

Open the site in a private window and look at the cookie notice as a first-time visitor would.

If it offers categories such as analytics, advertising or social media with switches already on, switch them off by default. The visitor turns them on.

If the only choice is a button marked OK beside a note that cookies are in use, the optional ones are probably being set before any choice is made.

Most consent tools can hold back analytics and advertising tags until the visitor agrees, and many can apply that only to visitors from Europe. Check what yours is set to do.

Then add the two details the court named: how long each cookie lasts, and whether a third party, such as an analytics or advertising company, can read it. A short table covers both.

A worked example

A guest ranch in the Cariboo takes many of its summer riding holidays from visitors in Germany and Austria, through a booking form on its website.

The form ended with a box, already ticked: yes, send me news and special offers. Everybody who booked was added to the newsletter.

The cookie notice, installed from a plugin, listed analytics and advertising cookies with their switches already on, above a single button marked got it.

Both assumed that doing nothing meant yes: the logic the court rejected yesterday, and the one CASL guidance has rejected for email from the start.

The ranch unticked the newsletter box and moved it below the booking details, with one plain sentence about what the newsletter contains.

For guests already on the list, mostly in Europe, it asked a privacy lawyer before sending anything more.

The cookie switches now start off, the tracking tags wait for a choice, and the policy lists how long each cookie lasts and which companies can read it.

Where the optional cookies come from

On a typical small business site, optional cookies arrive from a handful of places: the analytics tag, an advertising or remarketing tag from Google or Facebook, embedded videos and maps, and share buttons.

Each was added by pasting in a snippet, often by different people over several years, which is why few owners can list them.

Your web company can, from the page code and the browser's storage panel. That list is what the cookie policy has to describe.

Implied consent and keeping proof

CASL also allows implied consent in some situations, such as a customer who bought from you in the last two years, or who made an enquiry in the last six months.

Implied consent expires. Express consent, given by ticking an empty box, lasts until the person withdraws it, which is why it is worth collecting properly.

Keep proof of it: the date, the form and the wording beside the box. If a question ever arises, the business has to show consent was given, not just say so.

The counter-case

For a Canadian business with no European customers, the cookie half of this changes little directly. Canadian privacy law asks for clear notice and meaningful consent, not a European-style consent screen.

None of this is legal advice. A business that actively sells into Europe, or relies on detailed advertising tracking, should have its consent setup reviewed by a privacy lawyer.

But the email half applies to every business with a mailing list. Untick the boxes, record how each person agreed, and where Europe matters, keep cookie switches off until the visitor chooses.

The changes, in order

1. Open your site privately and read the cookie notice.
2. Switch optional categories off by default.
3. Hold back tracking tags until a visitor agrees.
4. Add cookie durations and third parties to the policy.
5. Untick every newsletter box on every form.
6. Separate newsletter consent from bookings and terms.
7. Record the date, form and wording for each sign-up.

Step five is the one that applies to every Canadian business with a mailing list, whether or not anybody from Europe ever visits. It is also the quickest: one setting on each form.

Keeping the notice itself usable on a small screen is covered in a cookie banner nobody can close on a phone.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.