| The Microsoft Advertising service allows businesses to display personalised advertising and to measure their audience. It uses cookies and similar technologies, in particular a so-called ‘UET tag’. In a case before the court of Frankfurt (judgment of 27 June 2024, case no. 6 U 192/23), a data subject requested that Microsoft’s Irish subsidiary refrain from placing cookies on her device and using similar technologies without her prior consent. She also demanded that it refrain from reading out information on her device for advertising purposes. Prior to this, the data subject had visited several third-party websites using Microsoft Advertising without giving advertising consent through publishers’ Consent Management Platforms (CMPs). Microsoft provides a toolkit to publishers to integrate Microsoft Advertising into their websites. In addition, it contractually requires them to obtain the necessary consent. However, this was not enough for the court to exonerate Microsoft, granting the data subject injunctive relief. The court held Microsoft itself responsible for ensuring that the necessary consent has been obtained from data subjects before cookies or similar technologies are used or before information is read out from a device, as required under the German implementation of the EU ePrivacy Directive. The law applies to all businesses that store information on devices or that want to read out information on them – ultimately, therefore, also to Microsoft, even if the (correct) implementation of the Microsoft Advertising service is the responsibility of (and can only be done by) the website operator. However, Microsoft cannot simply rely on their compliance. The decision of the Frankfurt court shows similarities to a 2023 French case, in which the ad tech company Criteo was fined €40 million by the French data protection supervisory authority CNIL, among other things for failing to take measures to ensure that the necessary consent was obtained by website operators using the Criteo service (we have covered this case in an earlier newsletter). The fact that this issue has now also reached courts at the national level should be a call to action for all businesses in the online marketing sector. Anyone who offers advertising and tracking technologies should ensure that all their users obtain the necessary consent in a compliant fashion. In particular, data vendors must be able to demonstrate the validity of the consent that their publishers have obtained to the data protection authorities upon request. (Dr. Lukas Mezger, UNVERZAGT Rechtanwälte) |
|---|