On Friday, the supervisory authority of Baden-Württemberg published a “FAQ on cookies and tracking” on its website. It is based on the LfDI’s (“Landesbeautragte für Datenschutz und Informationsfreiheit”) position on the DSK’s (German data protection conference) guidance draft of 22nd December 2021.
To summarize shortly:
- The document contains in-depth information on the correct design of cookie banners (question 4). It is considered necessary to show a button for refusing consent already on the first layer of the CMP (question 4.3, section “easily accessible refusal”).
- Consents according to the TCF 2.0 standard are considered ineffective (question 4.5). The LfDI expressly endorses the decision of the Belgian supervisory authority – as the first German supervisory authority to our knowledge.
- The use of US services cannot be “cured” by means of consents according to the “Axel Springer model” (question 2.5).
- The use of analytics services should be possible without consent if it is designed to be cookieless and only the log files are used (“passive” fingerprinting) (question 3.1).
- The question about the use of Google Analytics (“101 Dalmatians”), the LfDI seems to follow the decisions from Austria and France (question 2.5).
- At the very end of the document, there is also an exemplary examination of the “Pur model“.