Data Protection Law: Tracking, Analysis and Advertising Cookies Only with Active Consent

A website operator cannot obtain effective consent to the storage of cookies for advertising purposes by means of a preset check mark in a checkbox. This was confirmed by the Federal Court of Justice (FCJ) in its decision of May 28, 2020 -File No. I ZR 7/16.

Background

The subject matter of the proceedings was an online lottery of a website operator. Internet users who wanted to take part in the competition were asked to give their consent to the storage of cookies by being presented with a corresponding checkbox with a preset tick. The cookies were used to evaluate the surfing and usage behavior on the websites of advertising partners in order to be able to display advertisements in line with their interests.

In the matter, the FCJ had previously asked the European Court of Justice (ECJ) for an interpretation of EU law on the protection of privacy in electronic communications, which already decided in its ruling of October 1, 2019, Case C-673/17, that the so-called opt-out procedure in connection with the storage of cookies set for advertising purposes is not sufficient.

Decision

Although the reasons for the decision are currently not yet available, the press release of the FCJ clearly states that the consent of the user is required for the use of cookies to create user profiles for the purposes of advertising or market research. Accordingly, no effective consent is given if the storage of this information by means of cookies is to be permitted by means of a preset checkbox which the user must uncheck to refuse his or her consent. It does not matter whether the information is personal data or not.

The FCJ thus follows the ECJ. The FCJ interprets the relevant provision under national law in this context (Sec. 15(3)1 of the German Telemedia Act) in conformity with the directive to the effect that in the absence of valid consent there is automatically an "objection" within the meaning of the standard against the use of cookies that are not absolutely necessary.

Note

Following the preliminary ruling by the ECJ, the result of the FCJ decision is hardly surprising. However, it had been eagerly awaited how the European requirements would be implemented contrary to the wording of national law. With its "interpretation still in conformity with the directive", the FCJ has demonstrated creativity in this respect.

For website operators, the decision means first of all that they must critically examine their internet presence to see whether cookies are not absolutely necessary. Absolutely necessary cookies include those that enable the basic functionality of the website, for example the storage of goods in the virtual shopping cart of a webshop. If, in addition, cookies are used for analysis, tracking or advertising purposes, active, i.e. non-preset, consent must be obtained for this - usually in the context of an upstream cookie banner. This means that cookie banners that want to "imply" that the website visitor has given his or her consent when continuing to surf are now a thing of the past, as are solutions that use cookies and only give the user the opportunity to object. In addition, the data protection information must contain precise details of the function and duration of the cookies and whether third parties may be able to access the cookies.

Now that the decision of the FCJ provides legal certainty in national terms as well, the website operators concerned have no choice but to make the necessary changes to their own internet presence. It remains to be seen whether violations of these requirements can only be punished by the competent authorities or whether they can also be punished by competitors or competition associations. This question was referred to the ECJ for a preliminary ruling on the day of the decision by the FCJ (decision of May 28, 2020 - File No. I ZR 186/17).