Wird diese Nachricht nicht richtig dargestellt, klicken Sie bitte hier.

Heuking Kühn Lüer Wojtek

Update Data Protection
IP, Media & Technology

No. 56 | 2019-04-09


Consent for the use of cookies
Astrid Luedtke


Even before the General Data Protection Regulation (GDPR) came into force, there were discussions as to whether the use of tracking cookies, which make it possible to analyze the usage and browsing behavior of a user on the Internet and use it for interest-based advertising, requires prior consent (opt-in) of the user or whether a dissent solution (opt-out) is sufficient. The German data protection authorities are of the opinion that users must give their consent. In a case pending before the European Court of Justice (Case C-673/17), the Advocate General now confirms this view in his Opinion, published on March 21, 2019. Although the Advocate General's Opinion is not binding on the ECJ, the latter often agrees with the Advocate General. In this respect, his Opinion is of considerable importance.

Previous situation

In Germany, Sec. 15 (3) German Telemedia Act (TMG) so far stipulates that service providers may create usage profiles using pseudonyms for the purpose of advertising, market research or to customize their offer if the user does not object. Even before the GDPR entered into force, this regulation was criticized on the grounds that it did not comply with the European requirements of the ePrivacy Directive (2002/58/EC) and the Cookie Directive (2009/136/EC). The European ePrivacy Regulation which was originally intended to apply in conjunction with the GDPR as of May 25, 2018, should provide clarity but has not yet entered into force.

In April 2018, the German data protection authorities in a joint statement with reference to the European understanding of law pointed out that as of the applicability of the GDPR on May 25, 2018, the special provision of Sec. 15 TMG is no longer applicable and the use of tracking mechanisms on the Internet and the creation of user profiles requires the prior consent of the user.

The ECJ will decide on the issue in the near future and there is much to be said for following the Advocate General's and the German data protection authorities’ opinion and rejecting the opt-out solution.

Opt-out solution before the ECJ

The proceedings before the European Court of Justice are based on a submission by the Federal Court of Justice (BGH). In the underlying case, the operator of a sweepstakes website was granted the right to place cookies in the user's browser through an already pre-ticked checkbox, which enabled an evaluation of the user's surfing and usage behavior and thus interest-based advertising. To prevent this, the user had to deselect the pre-ticked checkbox.

In his Opinion, the Advocate General considers that this opt-out solution is inadmissible. It does neither meet the requirements of the ePrivacy and Cookie Directive, which is applicable until the ePrivacy Regulation comes into force, nor the requirements of the GDPR, which has been applicable since May 25, 2018. Rather, the use of tracking cookies requires explicit consent, which must comply with the requirements of the GDPR.

Thus, the Advocate General does not just declare a rejection of the previous German regulation of Sec. 15 (3) TMG. It also confirms that the GDPR requirements for consent also apply to the use of cookies.

Requirements for effective consent (opt-in)

An active action by checking a box or clicking a button is required for effective consent under the GDPR. Furthermore, the consent must be issued separately. According to the Advocate General, this can only be achieved if it is not given together with other declarations. Consent must be voluntary and not subject to inadmissible coupling. Furthermore the user has to be informed in advance. The information must be clear and comprehensive and should, inter alia, also provide information about the operational period of the cookie and the question of whether third parties can access the cookie.

Conclusion

If the European Court of Justice agrees with the Advocate General, the German courts will follow this case-law in the future. However, it is already now advisable for website operators - also with regard to the corresponding opinion of the German data protection authorities - to check their cookie consents to see whether the requirements of the GDPR are met or whether a revision is required.



Author
Heuking Kühn Lüer Wojtek

Astrid Luedtke is a Salaried Partner and a lawyer at Heuking Kühn Lüer Wojtek and member of the practice group IP, Media & Technology.

Contact

T +49 211 600 55-168
F +49 211 600 55-160
E datenschutz@heuking.de

Visit our Website with focus on Data Protection Law:
Microsite Data Protection

Task Force Data Protection
Heuking Kühn Lüer Wojtek
Dr. Christian Appelbaum
Heuking Kühn Lüer Wojtek
Dr. Ubbo Aßmus
Heuking Kühn Lüer Wojtek
Dr. Felix Drefs
Heuking Kühn Lüer Wojtek
Alexa Finke
Heuking Kühn Lüer Wojtek
Regina Glaser, LL.M.
Heuking Kühn Lüer Wojtek
Torsten Groß, LL.M.
Heuking Kühn Lüer Wojtek
Anne Heisig
Heuking Kühn Lüer Wojtek
Maike Katharina Hinz
Heuking Kühn Lüer Wojtek
Britta Hinzpeter, LL.M.
Heuking Kühn Lüer Wojtek
Dr. Thomas Jansen
Heuking Kühn Lüer Wojtek
Dr. Philip Kempermann, LL.M.
Heuking Kühn Lüer Wojtek
Dr. Lutz Martin Keppeler
Heuking Kühn Lüer Wojtek
Dr. Markus Klinger
Heuking Kühn Lüer Wojtek
Michael Kuska, LL.M., LL.M.
Heuking Kühn Lüer Wojtek
Astrid Luedtke
Heuking Kühn Lüer Wojtek
Marcel Maybaum
Heuking Kühn Lüer Wojtek
Antje Münch, LL.M.
Heuking Kühn Lüer Wojtek
Dr. Søren Pietzcker, LL.M.
Heuking Kühn Lüer Wojtek
Dr. Wolfgang G. Renner, LL.M.
Heuking Kühn Lüer Wojtek
Dr. Dirk Stolz
Heuking Kühn Lüer Wojtek
Dr. Frederik Wiemer
Heuking Kühn Lüer Wojtek
Dr. Florian Winzer
Heuking Kühn Lüer Wojtek
Dr. Hans Markus Wulf




I want to
unsubscribe

subscribe









Heuking Kühn Lüer Wojtek
© 2019 Heuking Kühn Lüer Wojtek

PartGmbB von Rechtsanwälten und Steuerberatern*
Georg-Glock-Str. 4, 40474 Düsseldorf

* Data protection information / register details / list of partners: www.heuking.de

Information on how Heuking Kühn Lüer Wojtek handles your personal data,
the purposes for processing your data, the legal basis for processing,
and on your rights can be found at www.heuking.de.

datenschutz@heuking.de