Cookies for advertising purposes only with the active consent of users
The Federal Court of Justice (BGH) has decided on the question of which requirements must be met for consent to telephone advertising and the storage of cookies on the user’s terminal device.
About the case:
The plaintiff is the Federal Association of Consumer Organisations. The defendant organized a lottery in September 2013 at its Internet address. After entering the postal code, the user was taken to a page on which the user’s name and address had to be entered. Two consent forms with checkboxes were located under the address entry fields.
By confirming the first text, the checkbox of which was not provided with a preset tick, the consent to an advertisement by sponsors and cooperation partners of the defendant was to be declared by post, telephone, e-mail or SMS. It was possible to select the advertising sponsors and cooperation partners from a linked list of 57 companies. Otherwise, the Defendant should make this selection.
The second checkbox was provided with a preset tick and had the following text
“I agree that the web analytics service Remintrex may be used on my behalf. As a result, the lottery organiser, the [defendant], sets cookies after registration for the lottery, which [the defendant] can use to evaluate my surfing and usage behaviour on the websites of advertising partners and thus enable Remintrex to provide interest-oriented advertising. I can delete the cookies at any time. Read more here.”
In the explanation linked to the word “here”, it was pointed out that the cookies would receive a specific, randomly generated number (ID), which was assigned to the registration data of the user who entered his name and address in the web form provided. If the User with the stored ID would visit the website of an advertising partner registered for Remintrex, this visit should be recorded as well as the product in which the User is interested and whether a contract is concluded.
The default tick could be removed. However, participation in the competition was only possible if at least one of the two fields was marked with a tick.
As far as relevant in the appeal proceedings, the plaintiff requested that the defendant be prohibited from including corresponding declarations of consent in lottery agreements with consumers or from invoking them. The plaintiff has also demanded reimbursement of the costs of the warning.
Bisheriger Prozessverlauf:
Das Landgericht hat die Beklagte hinsichtlich beider Einverständniserklärungen zur Unterlassung sowie zur Zahlung von Abmahnkosten verurteilt. Die Berufung der Beklagten hatte hinsichtlich des Antrags auf Unterlassung der Verwendung der mit einem voreingestellten Ankreuzfeld versehenen Einwilligungserklärung in die Nutzung von Cookies Erfolg. Beide Parteien haben die vom Oberlandesgericht zugelassene Revision eingelegt.
Der Bundesgerichtshof hat das Verfahren mit Beschluss vom 5. Oktober 2017 ausgesetzt und dem Gerichtshof der Europäischen Union verschiedene Fragen zur Auslegung der Richtlinie 2002/58/EG (Datenschutzrichtlinie für elektronische Kommunikation), der Richtlinie 95/46/EG (Datenschutzrichtlinie) sowie der Verordnung (EU) 2016/679 (Datenschutz-Grundverordnung) hinsichtlich der Wirksamkeit einer Einwilligung in das Setzen von Cookies durch ein voreingestelltes Ankreuzkästchen vorgelegt. Diese Fragen hat der Gerichtshof der Europäischen Union mit Urteil vom 1. Oktober 2019 beantwortet.
Previous course of the process::
The Federal Court of Justice has now rejected the defendants’ appeal and, on the plaintiff’s appeal, overturned the judgment on appeal regarding the cookie consent and restored the first instance conviction of the defendants.
With regard to consent to telephone advertising, the defendant is obliged under §§ 1, 3 (1) no. 1 UKlaG in conjunction with § 307 (1) sentence 1 and (2) no. 1 BGB and § 7 (2) no. 2 case 1 UWG to refrain from taking action and to reimburse warning costs, because both under the legal situation applicable at the time of the offence complained of and under the legal situation at the time of the decision, effective consent to telephone advertising is lacking. § Paragraph 7(2)(2) of the UWG serves to transpose Article 13(3) and the first sentence of Article 13(5) of Directive 2002/58/EC, Article 2(2)(f) of which refers to Article 2(h) of Directive 95/46/EC for the definition of consent, so that the concept of ‘consent’ must be determined in conformity with the directive. For the period from 25 May 2018, the definition provided for in Article 4(11) of Regulation (EU) 2016/679 is to be applied, since since then, pursuant to Article 94(1) and (2), first sentence, of that regulation, references to the repealed Directive 95/46/EC shall be construed as references to this regulation.
Consent is given ‘with full knowledge of the facts’ within the meaning of Article 2(h) of Directive 95/46/EC if the consumer knows that his statement constitutes consent and what it relates to. Consent is given “on a case-by-case basis” within the meaning of this provision if it is clear which products or services of which companies it specifically covers. This is lacking in the case of a dispute, because the contested form of the declaration of consent is designed to confront the consumer with an elaborate procedure of selecting partner companies on the list in order to induce him to refrain from this selection and instead leave the choice of advertising partners to the defendant. If the consumer does not know the products or services of which entrepreneurs the consent is covered due to lack of knowledge of the contents of the list and without exercising the right to choose, no consent is given for the specific case. For these reasons, consent “for the specific case” within the meaning of Art. 4 No. 11 of Regulation (EU) 2016/679 is also lacking, which has not brought about any change in the law in this respect.
With regard to the consent to the storage of cookies, the plaintiff is also entitled to a right to injunction in accordance with § 1 UKlaG in conjunction with § 307 para. 1 sentence 1 and para. 2 no. 1 BGB. The consent of the user provided by the defendant in the form of a General Terms and Conditions of Business, which allows the retrieval of information stored on his terminal device by means of cookies by means of a preset checkbox, constitutes an unreasonable disadvantage for the user both under the law applicable at the time of the action complained of and under the law applicable at the time of the decision.
According to the legal situation as it stood until 24 May 2018 – i.e. before the validity of Regulation (EU) 2016/679 – obtaining consent by means of a pre-selected checkbox was incompatible within the meaning of Section 307 (2) no. 1 of the German Civil Code (Bürgerliches Gesetzbuch – BGB) with essential basic ideas of Section 15 (3) sentence 1 of the German Telemedia Act (Telemediengesetz – TMG). The objectionable use of cookies by the defendant as a service provider serves, as presupposed by Section 15 (3) sentence 1 German Telemedia Act, the creation of user profiles for the purpose of advertising, in that the behaviour of the user on the Internet is to be recorded and used to send advertising tailored to it. In the event of a dispute, the random number (ID) stored in the cookies, which is assigned to the user’s registration data, is a pseudonym within the meaning of this provision. § With regard to Art. 5 (3) sentence 1 of Directive 2002/58/EC in the version amended by Art. 2 No. 5 of Directive 2009/136/EC, Section 15 (3) sentence 1 of the German Telemedia Act must be interpreted in conformity with the Directive to the effect that the use of cookies to create user profiles for the purposes of advertising or market research requires the consent of the user. The Court of Justice of the European Union, acting on a reference from the Senate, ruled that Article 2(f) and the first sentence of Article 5(3) of Directive 2002/58/EC, in conjunction with Article 2(h) of Directive 95/46/EC, must be interpreted as meaning that there is no effective consent within the meaning of those provisions where the storage of information or access to information already stored in the user’s terminal equipment of a website by means of cookies is permitted by means of a pre-selected checkbox which the user must unselect in order to refuse consent. According to the Court’s decision, the question whether the information is personal data is not relevant in this context. The interpretation of Section 15 (3) sentence 1 of the German Telemedia Act in conformity with the Directive does not preclude the fact that the German legislature has not yet adopted an act of transposition. This is because it can be assumed that the legislature considered the existing legal situation in Germany to be in conformity with the Directive. A corresponding interpretation in conformity with the Directive is still compatible with the wording of Section 15 (3) sentence 1 German Telemedia Act. In the absence of (effective) consent, in view of the fact that the legislature saw the Union law requirement for consent implemented in Section 15 (3) sentence 1 German Telemedia Act, the contradiction according to this provision which contradicts the permissibility of the creation of user profiles can be seen.
This legal situation has not changed since 25 May 2018, the first day of application of Regulation (EU) 2016/679, because this Regulation, according to its Article 95, does not affect the continued validity of Section 15 (3) sentence 1 German Telemedia Act as a national provision transposing Article 5 (3) sentence 1 of Directive 2002/58/EC. To the extent that Article 2(h) of the repealed Directive 95/46/EC can no longer be taken as a basis for the definition of consent, but Article 4 No. 11 of Regulation (EU) 2016/679 is to be applied, this leads to the same result. The Court of Justice of the European Union, upon referral by the Senate, has ruled, also with regard to Article 4 No. 11 of Regulation (EU) 2016/679, that a preset checkbox to be selected by the user does not constitute valid consent.
