Germany's New Consent Management Ordinance (EinwV): Simplifying Digital Consent
On September 4, 2024, the Federal Government adopted the Consent Management Ordinance (EinwV). This new ordinance is based on Section 26 (2) of the Telecommunications Digital Services Data Protection Act (TDDDG). Its primary goal is to stem the flood of cookie banners and significantly simplify consent handling on the internet for users.
The EinwV regulates the requirements for "recognized consent management services," also known as Personal Information Management Services (PIMS). These services aim to provide a user-friendly alternative to the numerous individual decisions users face when providing consent for processing personal data, in accordance with the General Data Protection Regulation (GDPR).
Key Aspects of the Consent Management Ordinance
The new regulation introduces several important provisions to streamline digital consent processes:
- Centralized Consent Management: Users will be able to store their preferences once and permanently. This eliminates the need to give consent repeatedly with each website visit.
- Requirements for PIMS: The Ordinance mandates that these services must be user-friendly, transparent, and interoperable. Users must always be able to check, change, or revoke their settings.
- Recognition and Monitoring: The Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible for recognizing and overseeing these consent management services.
- Competition-Compliant Design: The regulation stipulates that consent management procedures must be designed to ensure fair competition.
- Technical Compatibility: Specific requirements are placed on the technical implementation to guarantee smooth integration into websites and apps.
Federal Minister Dr. Volker Wissing emphasizes that this reform aims to deliver a more pleasant browsing experience. It also seeks to grant users greater control over their consent. For providers of digital services, this new procedure offers the benefit of obtaining consent in a standardized and legally compliant manner, without disrupting their website design with intrusive cookie banners.
Criticism and Challenges of the Initiative
Despite these positive intentions, the regulation has also faced criticism. Consumer advocates and data protection specialists are concerned that the new rules may not fully achieve their desired effect. They fear that many providers of digital services might not adequately recognize the new consent mechanisms, potentially continuing to request consent repeatedly.
Another significant issue is the legal validity of blanket consent under the GDPR. The Data Protection Conference (DSK) highlights that the processing of personal data under the GDPR is ineffective if data subjects are not sufficiently informed about the specific data processing operations. Therefore, questions arise as to whether the new consent procedure can genuinely meet the legal requirements for valid GDPR consent.
Furthermore, internationally oriented websites face challenges, as country-specific adaptations will likely be necessary. It is improbable that Germany will establish a global standard without broader EU alignment.
The effectiveness of these regulations will be evaluated two years after their implementation. In the meantime, website operators are advised to continue using data protection-friendly measurement methods that do not require visitor consent. They should also closely monitor the evolution of consent management services.
Conclusion
Ultimately, the EinwV underscores that data protection in the digital realm remains a critical and evolving topic, demanding innovative solutions. It remains to be seen whether this regulation can truly curb the proliferation of cookie banners and empower users' digital self-determination, or if further adjustments will be needed to balance data protection with user-friendliness.