Module 8, Web cookies, Article 5(3) & the Planet49 ruling
A cookie is a text file on a device; cookie data is personal data (Recital 30) and processing is subject to the GDPR. ePrivacy Article 5(3) requires prior, informed consent to store/access info on terminal equipment; strictly necessary cookies are exempt. Implied consent (continued browsing) is no longer acceptable - consent must be a specific, informed, unambiguous, affirmative act. The Planet49 ruling (CJEU, Oct 2019) confirmed cookie consent needs active behaviour.
A web cookie is a text file stored on a device; cookie data is personal data (Recital 30), so processing is subject to the GDPR. ePrivacy Article 5(3) requires prior, informed consent to store or access information on terminal equipment; strictly necessary cookies (and transmission-only) are exempt.
Post-GDPR, implied consent (continued browsing) is no longer acceptable - consent must be a specific, informed, unambiguous, affirmative act. The Planet49 ruling (CJEU, October 2019) confirmed cookie consent must be active behaviour, applies even to non-personal data, and must inform about cookie duration and third-party access. See also the EDPB Cookie Banner Taskforce and Guidelines 2/2023 on Article 5(3) technical scope.
- First-party cookies - placed by the site operator.
- Third-party cookies - placed by another entity, which (if it determines means/purposes) is a controller and must comply.
Key terms - quick answers
What is “Planet49”?
What is “Strictly necessary cookies”?
What is “Implied consent”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.