In the Planet49 Case No I ZR 7/16, the German Federal Court of Justice (“Bundesgerichtshof” - “BGH”) ruled that website operators are obliged to ask users for their permission before cookies are stored or read on their end devices. It is now necessary to obtain the consent of the website user for the setting of non-functional cookies (opt-in).

In the case, Planet49 ran a promotional lottery on its website. As part of entering the lottery users were presented with two tick-boxes. The first was an unchecked tick-box to receive third party advertising. In order to enter the competition, users needed to tick this box. The second was a pre-ticked box allowing Planet49 to set cookies to track the user's behaviour online.

The German Federation of Consumer Organisations (“Federation”) claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice, which in turn referred the case to the Court of Justice of European Union for preliminary ruling.

On 1 October 2019, the European Court of Justice made a decision the German Federal Court follows, that a pre-set checkbox which must be actively deselected by the user to avoid consent does not constitute valid consent.

Hence, active consent is required to constitute valid consent, instead silence, pre-ticked boxes or inactivity consent. Furthermore, for a valid consent, it is necessary that the user is going to be informed about which cookie is set for which specific purpose and, where consent is required for cookies under the e-Privacy Directive, the General Data Protection Regulation (“GDPR”) standard of consent applies.

Lastly, it is ruled that the obligation to obtain cookie consent is independent of whether or not personal data are processed using the cookies.

In this context, the German Federal Court of Justice ruled on 28 May 2020 that an opt-out for setting cookies is inadmissible under German law due to an interpretation of Section 15(3) of the German Telemedia Act (“TMG”) in conformity with the ePrivacy Directive.

To conclude, operators now should;

  1. Check whether they still set cookies relying on the op-out procedure,
  2. Obtain active consent that must be explicit,
  3. Inform the website user sufficiently and transparently.

You can read the text of German Federal Court of Justice Decision (in German) here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

Kind regards,

Zumbul Attorneys-at-Law