Insights · Legal
Supervisory authorities inspect cookie banners
Data protection supervisory authorities are inspecting cookie banners. Companies should make consent transparent and technically correct.
- Published
- 4 October 2024
- Reading time
- 3 min read
Cookies and similar tracking technologies have become indispensable to the operation of internet and telemedia services. To avoid the risk of potential fines and claims under civil or competition law, however, particular attention should be paid to obtaining the user’s required consent. This consent can conveniently be obtained through the cookie banners that readers will undoubtedly know and that have now become ubiquitous. Comprehensive requirements under the German Telecommunications Digital Services Data Protection Act (TDDDG), the GDPR and case law must nevertheless be observed.
Requirements for user consent
Section 25(1) TDDDG governs the requirement for consent to store data and access information already stored on the end user’s terminal equipment, irrespective of whether it constitutes personal data within the meaning of Article 4 GDPR. Under section 25(1), sentence 1 TTDSG, information may be stored on a user’s terminal equipment or information already stored there may be accessed only if the end user has consented on the basis of clear and comprehensive information. Section 25(2), no. 2 TDDDG provides an exception for cookies that are technically necessary.
Specific requirements for cookie banners
Current case law derives various requirements for the design of cookie banners from these principles. According to the German Federal Court of Justice (judgment of 28 May 2020 – I ZR 7/16), consent given using a preselected checkbox that users can actively deselect (opt-out), for example, is insufficient. The more precise requirements are also assessed on a case-by-case basis in current case law. Merely highlighting one button in colour did not constitute such a preset (most recently Traunstein Regional Court, judgment of 8 July 2024 – 9 O 173/24), although the option to restrict consent to technically necessary cookies must remain identifiable as a clickable button. The Cologne Higher Regional Court (judgment of 19 January 2024 – I-6 U 80/23), in turn, limits this by rejecting consent settings that users can refuse only by clicking through several layers.
Users must also be given an opportunity to make an informed decision that meets the requirements of Article 4(11) GDPR. The information must be provided to users in an intelligible and easily accessible form. The technologies used must therefore be examined in each individual case.
Inspections by supervisory authorities and penalties
Section 28(1), no. 13 TDDDG contains its own provisions on fines specifically for the use of cookies without the corresponding user consent. Infringements may be punished with a fine of up to EUR 300,000. Compliance is reviewed by the competent supervisory authority on its own initiative. Users may also bring civil claims, while competitors may bring claims under the German Unfair Competition Act (UWG).
The legally compliant design of cookie banners should therefore be taken seriously. Given the broad requirements of Article 4(11) GDPR, further developments in case law are difficult to predict. Legislation also remains dynamic following the TDDDG: as at September 2024, the German government is planning further reforms aimed at making cookie banners more user-friendly.
The many factors involved mean that liability and penalty risks can be reliably limited only with specialist assistance. Clarius.Legal will be glad to support you with a range of data protection solutions.
Do you have questions about this topic?
We can assess what the development means for your organisation and advise you directly.
