Few court decisions have shaped how cookie banners work across Europe as directly as the Court of Justice of the European Union's (CJEU) ruling of 1 October 2019 in the case against Planet49 (Case C-673/17). What initially looked like a footnote from an online sweepstakes became a landmark decision on what actually makes cookie consent valid.
The facts were unremarkable on their face: Planet49 ran an online prize draw and showed participants two checkboxes. One — already pre-ticked — covered consent to advertising partners setting cookies for marketing purposes. The other, which had to be ticked separately, covered sharing personal data with sponsors for marketing by phone or email. Anyone who wanted to enter the draw had to actively tick the second box, but could simply leave the first — pre-ticked — one as it was, without ever consciously noticing it.
Germany's Federal Court of Justice referred the question to the CJEU: is a box that's already ticked enough to count as consent under the ePrivacy Directive? The court's answer was unambiguous: no. Consent requires an active, conscious action by the user — a box the user has to tick themselves to agree, not one they'd have to un-tick in order NOT to agree. The difference between "actively agreeing" and "not objecting" is exactly the difference at stake in the ePrivacy Directive's history since 2009 — and the CJEU confirmed that this tightening was genuinely meant to be taken seriously.
A second, notable point in the ruling: the CJEU clarified that the consent requirement itself doesn't depend on whether the information stored in the cookie constitutes personal data under the GDPR. The ePrivacy Directive already protects access to the end device as such — regardless of what, if anything, ends up stored there. That was an important clarification, since some providers had previously argued that pseudonymous or purely technical identifiers fell outside the consent requirement altogether.
Third, the court required that users be informed, before consenting, about how long the cookies remain active and whether third parties get access to them. A vague, general statement no longer suffices — cookie disclosures have to be concrete enough that a user can actually assess what they're consenting to.
The practical consequences were immediate: pre-ticked boxes disappeared from European cookie banners, "Accept" buttons had to be triggered by a genuine, deliberate click, and categorising cookies with precise purpose and duration information became standard practice. Data protection authorities in several member states revised their own guidance right after the ruling, and it has served since as the reference point in numerous later cases — including on whether a banner that makes "Reject" deliberately harder to reach than "Accept" also violates the requirement of a free, unambiguous decision.
Planet49 is a clear example of how a single court case translates the abstract requirements of a piece of legislation into concrete, technical requirements — and why a cookie banner looks the way it does today, rather than the way it commonly did before 2019.
It's also worth noting how quickly the ruling's effect spread well beyond the original dispute: although it formally only clarified the interpretation of the ePrivacy Directive for one specific German case, data protection authorities across Europe aligned their own guidance with the same reasoning — evidence of how far a single CJEU ruling can shape practice beyond the boundaries of the case that produced it.