Websites would need to obtain active and specific consent from users before storing cookies on their device, the ECJ has ruled. The case started with a lottery website checking the consent box on users' behalf.