Freitag, 10.03.2023
Last change: Donnerstag, 07.11.2024
Cookie banners need equivalent alternatives on the first page
from
Dr. jur. Dirk LindloffLawyer
Specialist lawyer for intellectual property law
Specialist lawyer for information technology law
Give me a call: 0261 - 404 99 45
E-Mail:
Cookie banners and the consent they contain are a perennial issue in the data protection debate. The topic is of interest to both website operators and users. The main question here is how to obtain effective consent for the processing of personal data via cookies.
Most websites today use cookies to collect information about the usage behavior of visitors. These are small files that are stored on the visitor's computer and can store information such as user preferences, surfing behavior or settings. However, the use of cookies is subject to legal requirements with regard to telecommunications services and data protection.
As long as the cookie banner only requests consent to the use of cookies, Section 25 of the German Teleservices Data Protection Act (TTDSG) is the relevant standard in Germany. However, if, as is often the case, consent is also to be given to entire data processing operations at the same time, Art. 7 GDPR is the benchmark. Ultimately, the courts and authorities come to the same conclusion when applying both standards and ultimately apply the standards of the General Data Protection Regulation.
According to the General Data Protection Regulation (GDPR), consent to the processing of personal data must be given voluntarily and based on informed decision. This also includes that the user is informed clearly and comprehensibly about the purpose of the processing and about their rights. A cookie banner is designed to provide the user with this information and give them the option to give or withhold their consent.
In the last four months, there have been two significant rulings on the subject. The Munich Regional Court and the French data protection supervisory authority CNIL stated that consent to the processing of cookies is not valid if refusing cookies is not made as easy as accepting them. This means that a cookie banner that only offers an "Accept all" and "Settings" button is not sufficient to obtain effective consent.
In the case of the Focus Online portal, the Munich District Court ruled that the consent declaration presented for the use of cookies was invalid. The "Accept all" button was placed too prominently and rejecting the cookies was not made as easy as accepting them. The court emphasized that effective consent could only be given if the user had the choice to reject cookies without this being associated with any disadvantages.
The French data protection authority CNIL also expressed this view to the social media platform TikTok. TikTok's declaration of consent was not effective because refusing cookies was not as easy as accepting them. TikTok had only offered an "Accept All" button and refusing cookies was scattered throughout the settings. TikTok changed its behavior while the proceedings were still ongoing and now offers equivalent alternatives.
Both decisions make it clear that a cookie banner must be designed in such a way that the user has the choice to reject cookies without this being associated with any disadvantages. A simple "Accept All" button without an equivalent alternative is not sufficient to obtain effective consent.
The statements represent initial information that was current for the law applicable in Germany at the time of initial publication. The legal situation may have changed since then. Furthermore, the information provided cannot replace individual advice on a specific matter. Please contact us for this purpose.