European Court of Justice rules over German Cookie law

• The ECJ will decide on Tuesday what cookie banners must look like in Germany.
• The 2009 EU Cookie Directive states that website users must actively give their consent.
• In Germany, many websites do this differently – referring to an older German law.

In recent years, Internet users have had to get used to the fact that they often reach their destination on the Internet with a little delay. This is due to cookies, small text files that web pages store in a user’s browser in order to track their path on the net for analysis or marketing purposes.

Before users are allowed to interact with the content of an online shop, for example, they are informed whether and how the site intends to use cookies. According to a study by IT lawyer Jens Nebel, not even one percent of users are interested in the exact circumstances of data processing. Soon, however, users who are less interested in data protection could also be expected to click further.

This Tuesday (October 1st 2019), the European Court of Justice will rule on how the European legal requirements for cookie banners are to be interpreted. The reason is a case of the lottery provider “Planet49”. Planet49 had designed the cookie agreement for potential lottery participants in such a way that the declarations of consent for the use of the data had already been prefilled. All users had to do was click to confirm their overall agreement. The action was brought by the ‘Bundesverband der Verbraucherzentralen und Verbraucherverbände’ (vzbv, Federal Association of Consumer Centres and Consumer Associations), and the Federal Supreme Court had asked the European Court, among other things, to clarify whether this type of “consent” was legally appropriate. The responsible Advocate General has his doubts about this.

The EU states should have implemented the regulation by 2011, but not all of them did so.

The General Data Protection Regulation (GDPR) states in comparatively concrete terms that “silence, boxes already ticked or inactivity on the part of the data subject should therefore not constitute consent”.

Planet49 is by no means the only German website that has designed its cookie agreement in this way. With Planet49, the check marks already set for approval were at least still removable. Many portals and online shops, including Check24 and Zalando, merely inform their users inconspicuously that they agree to the cookie agreement by using the site. The companies refer to the German Telemedia Act of 2007 (TMG). It states that companies may use user data unless they explicitly object (opt-out). However, since 2009 there has been an EU directive that says the opposite, namely that the user must give his explicit consent (opt-in). In turn, the GDPR defines “consent” as setting a checkmark.

The member states should have transposed this EU Cookie Directive into national law by 2011. In Germany, however, the legislator decided that the TMG, which contradicts the EU Directive on this point, would suffice as a legal regulation. Many IT lawyers therefore assume that this rather adventurous German interpretation of the directive will be cashed in the European Court of Justice decision this Tuesday. In order to be on the legally safe side, they have been recommending the opt-in solution to their customers for some time.

However, it is unlikely that German websites will change their cookie banners immediately after the ruling. As long as the German Telemedia Act is not amended accordingly, companies can continue to invoke German law for the time being. Users who do not consent to the storage of their data would have to take legal action against the use of their data.

The fact that German lawmakers have tolerated this contradiction between EU law and German law for so long may be due to another planned EU law. The ePrivacy Regulation announced in 2016 will also contain binding regulations on the use of cookies. And unlike the Cookie Directive ignored by Germany, the one regulation would also immediately apply in the member states.