The ruling by the German Federal Court of Justice (Bundesgerichtshof) of 28 May brought to an end the proceedings between the Federal Association of Consumer Organisations and Planet49 GmbH, a provider of online lotteries. The trial focused in particular on the question of the legal validity of the consent of website visitors to the storage of marketing cookies. This question was raised by the fact that the defendant had organized a competition on its website in 2013. For this purpose, the user was directed to a page with a web form on which he had to enter his name and address. Among the input fields for the address there were two consent forms with checkboxes. The first checkbox was not provided with a default check mark. The consent to be given here related to advertising by sponsors and cooperation partners of the defendant by mail, telephone, e-mail or SMS. The users could choose the sponsors and cooperation partners themselves and revoke their consent at any time.
The other checkbox was already provided with a preset check mark. Although this preset check mark could be removed, participation in the competition was only possible if the user checked at least one of the two fields. In the context of this declaration, the user should agree that a cookie provided with a tracking ID should be stored on the end device:
“I agree to use the web analysis service Remintrex in my company. As a result, the lottery organiser, the [defendant], will set cookies after registration for the lottery, which [the defendant] makes it possible for Remintrex to evaluate my surfing and usage behaviour on the websites of advertising partners and thus to provide interest-oriented advertising. I can delete the cookies at any time. Read more here [link to privacy policy]”.
The user was also informed that the stored ID would be used to record each visit to the websites of an advertising partner registered for Remintrex and also to record which products the user is interested in and which he/she buys.
While the Regional Court of Frankfurt am Main ordered the defendant to refrain from both declarations of consent, the plaintiff achieved success on appeal only with the application regarding the use of cookies with preset declarations of consent. After the OLG Frankfurt allowed the appeal to the Federal Court of Justice, the BGH initiated a preliminary ruling procedure before the European Court of Justice, in particular to clarify the question of the effectiveness of consents to the setting of cookies under Union law. The legal focus here was on questions of interpretation of Art. 5 para. 3 and Art. 2 lit. f of the ePrivacy Directive 2002/58/EC (implemented in Germany in § 15 para. 3 Telemediengesetz) in conjunction with Art. 2 lit. h of the Data Protection Directive 95/46/EC and Art. 6 para. 1 lit. On 1 October 2019, the European Court of Justice (ECJ) announced the so-called Planet49 ruling and determined that for consent to be effective, an active act of the consenting party is required, for which pre-selected checkboxes are not sufficient (see our blog post). The ECJ justified this by stating that a pre-activated checkbox does not constitute a user activity. Rather, the user’s action in the case of pre-selected checkboxes would consist merely in deselecting the default setting.
With today’s ruling, the Federal Court of Justice (BGH) adopted this legal interpretation of the ECJ and brought the court proceedings to a close. So far, only the press release is public, the detailed reasons for the decision will only be published in the next few days. The most important sentence in the press release is as follows:
“In the light of Article 5(3), first sentence, of Directive 2002/58/EC, as amended by Article 2(5) of Directive 2009/136/EC, Section 15(3), first sentence, of the German Telemedia Act must be interpreted in conformity with that directive as meaning that the use of cookies to create user profiles for the purposes of advertising or market research requires the consent of the user.
The BGH thus clarifies that in its opinion the consent of the user is thus required for the creation of user profiles.
The other interesting question, which has been discussed for years in the online marketing industry, is whether the processing of pseudonymous user data for advertising purposes can be based on a legitimate interest under Art. 6 (1) (f) GDPR instead of consent (as is also expressly mentioned in Recital 47 of the DSGVO). The BGH merely states that the entry into force of the GDPR does not affect the German implementation of the ePrivacy Directive in the Telemedia Act. The current parallel regulation in the GDPR and TMG will therefore not be dissolved.
Nevertheless, many people understand the interpretation of Section 15 (3) of the German Telemedia Act (TMG), which is now provided by the Federal Court of Justice, as a clear roadmap that online publishers will have to obtain the express consent of their users for the setting of marketing cookies in the future. We can therefore only urgently recommend that in future they switch to consent-based business models. Anyone who wants to continue to rely on the legitimate interest will certainly run the risk of having to pay even more attention than has been the case since the ECJ’s decision.
Already in the last few weeks it could be observed that large online media such as Spiegel Online or DIE ZEIT switched to consent models.
But the problem actually lies elsewhere: The European legislator had originally intended to regulate the question of online marketing anew in the planned ePrivacy Regulation – as the successor to the old ePrivacy Directive and sister law to the Basic Data Protection Regulation. However, because no agreement could be reached in the European Council on how to reconcile the protection of the privacy of the users concerned with the existing business model of advertising-financed online offers, the plan has been on hold for years. Perhaps today’s ruling by the Federal Court of Justice will now give the German Council Presidency the decisive impetus in the second half of 2020. At least on a national level, the German government has already announced an adjustment of the Telemedia Act.
Written on 28 May 2020 by Dr. Lukas Mezger, Dr. Frank Eickmeier, attorneys at law.