Summary

  • Europe’s 2002 ePrivacy rule gave users information and a right to refuse storage on their devices. The 2009 amendment changed the operative word to consent. Websites then had to put that decision somewhere a person could actually encounter it.
  • In 2012 the UK Information Commissioner found ordinary browser settings too blunt for that job and used a site banner as one practical approach. The EU Court of Justice’s 2019 Planet49 judgment later ended the pre-ticked checkbox as a route to valid consent.

The old rule could hide in a setting

The original 2002 ePrivacy Directive treated access to information on a user’s device as an intrusion requiring clear information and an opportunity to refuse. Article 5(3) also kept narrow exceptions for transmission and for a service the user had explicitly requested. Its recital on cookies acknowledged their useful work, including measuring how a site functions. The rule was not a ban on the small file; it was a rule about who could decide when the file was placed or read.

A browser’s general cookie setting made that arrangement look tidy. One control might reject or accept whole classes of files. The site could give notice, the browser could carry a preference, and the user could keep browsing. But the convenience had a structural cost. A browser-wide default was distant from the particular site, purpose and third party asking for access. As the law changed, that distance became the story.

The verb changed in 2009

Directive 2009/136/EC replaced the operative test in Article 5(3). Storage or access was permitted only after the subscriber or user had given consent, having received clear and comprehensive information. The exceptions for communication transmission and a strictly necessary service remained. Recital 66 allowed that consent might be expressed through appropriate browser settings where technically possible and effective. It did not turn every factory default into a personal decision.

This was an EU directive, implemented in national law. The United Kingdom amended its Privacy and Electronic Communications Regulations in May 2011. The new test forced a practical question onto the screen: what action, in which interface, would show that this user had agreed to this access? Legal words had to survive contact with browser software, site design and advertising machinery.

The browser lost the assignment

The UK Information Commissioner’s May 2012 cookie guidance answered with unusually concrete engineering advice. Most browser settings at the time were not sophisticated enough for a website to assume consent. A site that needed consent had to find another way to obtain it. The guidance described several approaches, including message or header bars, and pointed to the Commissioner’s own banner as one working example. It told operators to choose a method suited to their circumstances.

That distinction explains the familiar strip across the bottom or top of a page. It was a site-level implementation of a consent duty, not a widget specified by the directive. The operator now controlled the wording, timing, prominence and buttons at the moment of choice. A duty meant to hand a decision to the visitor also handed site owners the power to design the decision. Some could make refusal as easy as assent; others could make the path through the page do the persuading.

The checked box reached the court

In the Planet49 case, a lottery form contained a checkbox already ticked for cookies. Users had to deselect it to avoid the storage. The Court of Justice’s 1 October 2019 judgment held that this did not amount to valid consent. The result held whether the information stored or accessed was personal data. Clear information also had to tell the user how long the cookies would operate and whether third parties could access them.

The court did not invent the banner. It judged a specific default inside a specific form. The point was sharper: the site could present a choice, but it could not fill in the answer and ask the visitor to undo it. A visible interface did little for consent if its initial state had already cast the vote.

The historical shift was therefore not from invisible cookies to visible notices alone. Decision power moved from a broad browser preference to a site-controlled encounter and, in the checked-box case, back to the user’s actual act. The next fight lived in the geometry of that encounter: which option appeared first, what the visitor learned, and how much work each answer demanded.