The Data Protection Commissioner of Lower Saxony (LfD), together with the data protection authorities of eleven other German federal states, has completed a coordinated audit on the use of cookies and user tracking services in July of this year. (see press release from 10 July 2023)
Over the last few years, a total of 49 media websites were audited across Germany, including five businesses from Lower Saxony, which initially did not meet the legal requirements for cookie use and tracking technology. Up to 760 third-party services were being used. Cookies were sometimes stored before consent was given, and the consent banners themselves did not contain effective consent prompts under data protection law. They were not sufficiently differentiated and were found misleading in their design. All businesses were informed accordingly and given the opportunity to rectify the situation.
Before the audits were finalised, the German Telecommunications Telemedia Data Protection Act (“TTDSG”) went into effect on 1 December 2021, and media businesses began increasingly using so-called ”Cookie Walls” in their consent banners.
”Cookie Walls” are consent banners with two choices:
- first, the option to book a paid “subscription” (without user tracking, individual profiling, and personalised advertising) or
- alternatively, consent to use the website with tracking, but free of charge.
The new regulations, including sec. 25 TTDSG, as well as the examination of the data protection-compliant design of the ”Cookie Walls” became part of a comprehensive legal evaluation. The results have now been published in a resolution of the German Data Protection Conference with the following conclusion:
”Cookie Walls” are generally allowed, taking into account the remaining requirements of data protection law.
These requirements were recognised by the affected media businesses and have also already been largely implemented. Some remaining deficits were summarised by the authority in a final report, with the possibility of a subsequentadditional review.