Cookies for advertising purposes only with the active consent of the user

The BGH has ruled on the question of the requirements for consent to telephone advertising and the storage of cookies on the user’s end device.

Facts of the case:

The plaintiff is the Federal Association of Consumer Organizations. The defendant organized a competition at its internet address in September 2013. After entering the zip code, the user was taken to a page on which the user’s name and address had to be entered. Below the input fields for the address were two declarations of consent with checkboxes.

By confirming the first text, whose checkbox did not have a preset checkmark, consent was to be given to advertising by the defendant’s sponsors and cooperation partners by post, telephone, email or text message. It was possible to select the advertising sponsors and cooperation partners from a linked list of 57 companies. Otherwise, the defendant was to make this selection.

The second checkbox was provided with a preset checkmark and had the following text:

“I agree that the Remintrex web analysis service may be used on my computer. As a result, the competition organizer, the [defendant], sets cookies after registration for the competition, which enables [the defendant] to evaluate my surfing and usage behavior on websites of advertising partners and thus interest-based advertising by Remintrex. I can delete the cookies at any time. Read more here.”

In the explanation linked with the word “here”, it was pointed out that the cookies would receive a specific, randomly generated number (ID), which would be assigned to the registration data of the user who had entered their name and address in the web form provided. If the user were to visit the website of an advertising partner registered for Remintrex with the stored ID, this visit would be recorded, as well as which product the user was interested in and whether a contract was concluded.

The default check mark could be removed. However, participation in the competition was only possible if at least one of the two fields was ticked.

Insofar as relevant in the appeal proceedings, the plaintiff has demanded that the defendant be prohibited from including or relying on such declarations of consent in competition agreements with consumers. The plaintiff has also demanded compensation for the warning costs.

Process to date:

The Regional Court ordered the defendant to cease and desist with regard to both declarations of consent and to pay warning costs. The defendant’s appeal was successful with regard to the application to cease the use of the declaration of consent to the use of cookies with a pre-set checkbox. Both parties have lodged an appeal on points of law, which was allowed by the Higher Regional Court.

The Federal Court of Justice suspended the proceedings by order of October 5, 2017 and referred various questions to the Court of Justice of the European Union on the interpretation of Directive 2002/58/EC (Directive on privacy and electronic communications), Directive 95/46/EC (Data Protection Directive) and Regulation (EU) 2016/679 (General Data Protection Regulation) with regard to the validity of consent to the setting of cookies by means of a pre-ticked checkbox. The Court of Justice of the European Union answered these questions in its ruling of October 1, 2019.

Decision of the Federal Court of Justice:

The Federal Court of Justice has now dismissed the defendant’s appeal and, on the plaintiff’s appeal, overturned the appeal judgment with regard to the cookie consent and restored the first-instance judgment against the defendant.

With regard to consent to telephone advertising, the defendant is obliged to cease and desist and to pay compensation for warning costs pursuant to Sections 1, 3 (1) no. 1 UKlaG in conjunction with Section 307 (1) sentence 1 and (2) no. 1 BGB and Section 7 (2) no. 2 case 1 UWG, because there is a lack of effective consent to telephone advertising both according to the legal situation applicable at the time of the act complained of and according to the legal situation at the time of the decision. § Section 7 para. 2 no. 2 UWG serves to implement Art. 13 para. 3 and 5 sentence 1 of Directive 2002/58/EC, whose Art. 2 sentence 2 letter f refers to Art. 2 letter h of Directive 95/46/EC for the definition of consent, so that the term “consent” must be defined in accordance with the Directive. For the period from May 25, 2018, the definition provided for in Art. 4 No. 11 of Regulation (EU) 2016/679 must be used, because since then, in accordance with Art. 94 (1) and (2) sentence 1 of this Regulation, references to the repealed Directive 95/46/EC shall be deemed to be references to this Regulation.

Consent is given “in the knowledge of the facts” within the meaning of Art. 2(h) of Directive 95/46/EC if the consumer knows that his declaration constitutes consent and what it relates to. Consent is given “for the specific case” within the meaning of this provision if it is clear which products or services of which companies it specifically covers. This is not the case in the dispute because the contested design of the declaration of consent is designed to confront the consumer with an elaborate process of selecting partner companies from the list in order to induce him to refrain from this selection and instead leave the choice of advertising partners to the defendant. If the consumer is not aware of the content of the list and does not exercise the right to choose which products or services of which companies are covered by the consent, there is no consent for the specific case. For these reasons, there is also a lack of consent “for the specific case” within the meaning of Art. 4 No. 11 of Regulation (EU) 2016/679, which has not brought about any change in the law in this respect.

With regard to the consent to the storage of cookies, the plaintiff is also entitled to injunctive relief pursuant to Section 1 UKlaG in conjunction with Section 307 (1) sentence 1 and (2) no. 1 BGB. The consent of the user provided by the defendant in the form of general terms and conditions, which allows the retrieval of information stored on his terminal device with the help of cookies by means of a preset checkbox, constitutes an unreasonable disadvantage to the user both under the law applicable at the time of the act complained of and under the law applicable at the time of the decision.

Obtaining consent by means of a preset checkbox was incompatible with the fundamental principles of Section 15 (3) sentence 1 TMG within the meaning of Section 307 (2) no. 1 BGB under the legal situation applicable until May 24, 2018 – i.e. before Regulation (EU) 2016/679 came into force. The contested use of cookies by the defendant as a service provider serves to create user profiles for the purpose of advertising, as required by Section 15 (3) sentence 1 TMG, by recording the user’s behavior on the Internet and using it to send advertising tailored to this behavior. The randomly generated number (ID) stored in the cookies in the case in question, which is assigned to the user’s registration data, is a pseudonym within the meaning of this provision. § Section 15 para. 3 sentence 1 TMG must be interpreted in accordance with Art. 5 para. 3 sentence 1 of Directive 2002/58/EC as amended by Art. 2 no. 5 of Directive 2009/136/EC to the effect that the user’s consent is required for the use of cookies to create user profiles for advertising or market research purposes. Upon referral by the Senate, the Court of Justice of the European Union ruled that Article 2(f) and Article 5(3) sentence 1 of Directive 2002/58/EC in conjunction with Article 2(h) of Directive 95/46/EC must be interpreted as meaning that there is no valid consent within the meaning of these provisions if the storage of information or access to information already stored in the user’s terminal equipment of a website is permitted by means of cookies by means of a pre-set checkbox which the user must deselect in order to refuse consent. According to the Court’s ruling, the question of whether the information is personal data is irrelevant in this context. The fact that the German legislator has not yet transposed Section 15 (3) sentence 1 TMG into national law does not prevent it from being interpreted in accordance with the Directive. This is because it can be assumed that the legislator considered the existing legal situation in Germany to be in conformity with the Directive. A corresponding interpretation in line with the Directive is still compatible with the wording of Section 15 (3) sentence 1 TMG. The lack of (effective) consent can be seen as a contradiction to the permissibility of creating user profiles according to this provision in view of the fact that the legislator saw the requirement for consent under EU law implemented in Section 15 (3) sentence 1 TMG.

This legal situation has not changed since May 25, 2018, the first day of validity of Regulation (EU) 2016/679, because this Regulation, according to its Art. 95, does not affect the continued validity of Section 15 (3) sentence 1 TMG as a national regulation implementing Art. 5 (3) sentence 1 of Directive 2002/58/EC. Insofar as the definition of consent can no longer be based on Art. 2(h) of the repealed Directive 95/46/EC, but must instead be based on Art. 4(11) of Regulation (EU) 2016/679, this leads to the same result. Upon referral by the Senate, the Court of Justice of the European Union also ruled with regard to Art. 4 No. 11 of Regulation (EU) 2016/679 that a preset checkbox to be deselected by the user does not constitute effective consent.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.