ECJ ruling: You now have to agree to cookies!

ECJ ruling: You now have to agree to cookies!

On May 31, 2025, the focus will be on numerous important topics that affect both consumers and businesses. Particularly noteworthy is a new decision by the European Court of Justice (ECJ) regarding the use of cookies on websites. This decision has the potential to fundamentally change the way data is handled on the Internet.

The ECJ has stipulated that all cookies that are not technically necessary for the operation of a website require the express consent of the user. This means that website operators must ensure that users actively consent to the use of such cookies before they can be set. The so-called technically unnecessary cookies include, among others, those from tracking and analysis tools, affiliate services, as well as cookies from social media plugins such as Facebook, Instagram or Twitter.

Important categories of cookies

The ECJ decision brings with it a large number of examples of cookies requiring consent. This includes:

• Cookies aus Tracking- und Analysetools
• Cookies aus Affiliate-Diensten
• Cookies aus Remarketing- und Retargeting-Diensten
• Cookies aus Social-Media-Plugins (z.B. Facebook, Instagram, Twitter)
• Cookies aus Video-Embedding-Anwendungen (z.B. Vimeo, YouTube)
• Cookies von Online-Kartendiensten (z.B. Google Maps)

In contrast, technically necessary cookies are not subject to the obligation to consent. Examples of this are:

• Session-Cookies (für Warenkorb oder Spracheinstellungen)
• Flash-Cookies zur Medienwiedergabe
• Cookies von Zahlungsdienstanbietern, die keine Nutzungsanalysen durchführen
• Opt-Out-Cookies zum Widerruf von Cookie-Einwilligungen

Special exceptions and new services

However, there are important exceptions that must be taken into account when requiring consent. For example, Amazon Pay cookies, which have a functional lifespan of 20 years, are subject to consent. The PayPal Express Checkout button also sets cookies that are not technically necessary, which also requires consent.

The requirement for consent does not apply if cookies are only used to transmit a message via an electronic communications network. This also applies to cookies from live chat systems and messenger services.

For companies that now have to adapt to the new legal situation, the IT law firm offers a free cookie consent tool. This tool enables data protection-compliant cookie consent management and supports companies in implementing the new requirements efficiently. Companies are advised to inform themselves fully about the new regulations in order to avoid legal consequences.

Reporting on these changes coincides with the ongoing push for greater privacy online, a concern continually called for by both consumers and data protection authorities worldwide. Further information on current developments can also be found at cvj.ch and IT law firm.