The German Federal Court of Justice (BGH) ruled on May 28 that an opt-out for cookies settings is inadmissible under German law under Section 15(3) of the German Telemedia Act (TMG) in conformity with the ePrivacy Directive (press release of the BGH; available only in German). As a result, website operators can no longer rely on the fact that it would be possible to set cookies in Germany solely based on their legitimate interests. Previously, operators had justified the opt-out process based on earlier statements of the German supervisory authorities and the wording of TMG regulations.
This decision is consistent with decisions by the German association of Data Protection Authorities (DSK), the European Data Protection Board (EDPB), and the European Court of Justice (ECJ) that it is necessary to obtain the consent of the website user for the setting of nonfunctional cookies (opt-in).
Failing to comply with these new requirements bears the risk that competitors or consumer associations may issue warnings to website operators if they continue to use the (now) illegal opt-out procedure. Furthermore, supervisory authorities are likely to take a closer look at nonconforming websites, whether unsolicited or following a complaint by a data subject. As the implementation of these new requirements are easily visible (and technically identifiable) on the website, noncompliance bears a high risk of cease-and-desist and supervisory procedures.
Background of the Judgment
The BGH judgement follows the decision of the ECJ in this case. On October 1, 2019, the ECJ ruled that a preset checkbox which must be actively deselected by the user to avoid consent does not constitute valid consent (within the meaning of Art. 2(f) and 5(3) of the ePrivacy Directive as well as Art. 4(11) and 6(1)(a) of the GDPR) for setting nonfunctional cookies.
Prior to this decision, German authorities had come to different conclusions regarding this issue.
Initially, the Frankfurt Regional Court granted the motions of the Federation of German Consumer Organisations (Bundesverbands der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V., vzbv) and decided that consent as an opt-in is necessary when cookies are set. This decision was overturned by the Higher Regional Court in Frankfurt to the effect that, due to the wording of the German Telemedia Act, consent to cookie use can also be granted as an opt-out.
With this most recent ruling, the BGH has clarified that Section 15(3) of the TMG, despite its contradictory wording, must be interpreted in conformity with the directive, resulting in a requirement that the user expressly consent to the storage of nonfunctional cookies (opt-in).
We will provide further updates on this developing area of the law in future posts in Tech & Sourcing @ Morgan Lewis.