The European Union’s top court has ruled that website operators must secure internet users’ “active consent” to their storage of so-called cookies.

The European Court of Justice’s ruling Tuesday was prompted by a dispute between German firm Planet49 and a German consumer organization over the company’s use of a pre-ticked checkbox for participants in online promotional games to secure consent to cookie storage.

Judges found that EU law’s requirement for users to consent to storage of and access to cookies on their devices isn’t covered by a pre-checked box that the user “must deselect to refuse his or her consent.”

They said specific consent must be obtained. They also said the service provider must tell users how long the information about them will operate and whether third parties may access them.