The EU's Court of Justice has ruled that consumers must actively agree to have cookies installed on their computers.

In a judgment handed down on Tuesday, the court said websites cannot legally obtain permission to install cookies simply by having computer users accept a pre-checked box. Instead, the users must actively consent to the storing or accessing of non-essential cookies, such as tracking cookies for targeted advertising, before any cookies can be installed.

The ruling stems from a case brought by the German Federation of Consumer Associations (BZVZ) against a German company, Planet49, that runs a lottery on its website. The case was referred to the EU court by Germany's Federal Court of Justice. By clicking on a button to take part in the lottery, users are considered to have agreed to share their data with third parties – data that it is used for commercial purposes.

The court found that "the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent".

In its judgment, the court said it was immaterial whether the data shared was personal data or not.

"EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users' terminal equipment without their knowledge," the judgment said. "The fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies."

Heiko Dünkel, legal adviser at the German Federation of Consumer Associations, said in a statement that the judgment sends a clear message that it deems protection of the digital sphere important.

"Tracking cookies allow website operators and third-party providers to make comprehensive use of customers' surfing and usage behaviour." he said. "It is good news for consumers that a pre-checked field is not sufficient for the legal use of [cookies data]."

Germany's federal court will now have to decide how to implement the EU court's decision in national law.