LinkedIn – Court Ruling (Germany, 2023)

The plaintiff in this case is a German Consumer Protection Association (Verbraucherzentrale Bundesverband e.V.), while the defendant is LinkedIn Ireland Unlimited Company, an Irish social media company operating throughout the EU and worldwide. The plaintiff found that the website of the defendant makes use of cookies and other technologies like fingerprinting that automatically process personal data and monitor users behavior for analytics and marketing purposes. In its privacy notice of 2018, the defendant clearly stated that it ignores “do not track” (DNT) signals on its users’ browsers. DNTs are a browser setting that users can decide to activate, to request websites not to track their online activities. The defendant claimed it would not react to DNT signals, as there was no established “DNT standard” yet. Firstly, the plaintiff claimed that the use of DNT signals constitutes an expression of the right to objection of users under Article 21(5) GDPR against processing activities carried out for marketing purposes under Article 6(1)(f) GDPR, and that the defendant should stop ignoring such signals as doing so constitutes an unfair commercial practice. Secondly, the plaintiff found that when a user decides to first set up a LinkedIn account, the “off-LinkedIn visibility” option is usually pre-activated, which means that personal data of users is shown on the defendant’s partner websites. This, according to the plaintiff constituted a violation of Article 6(1)(a) GDPR, Article 25(2) GDPR, third sentence and Article 4(11) GDPR as well as provisions of the German Federal Law against deceptive commercial practices ([https://www.gesetze-im-internet.de/uwg_2004/ Bundesgesetz gegen unlauteren Wettbewerb, UWG]). Further, the plaintiff asserted in this respect that the defendant wrongfully relied on Article 6(1)(f) GDPR as a legal basis and acted contrary to Article 5(1)(a) GDPR and Article 5(1)(c) GDPR. After the defendant rejected the plaintiff’s warning letter, the plaintiff brought an action before the LG Berlin under Article 79(2) GDPR. The LG held the action to be partially inadmissible, as the court considered the first claim to be too broad, since it lacked the description of a concrete infringement, which could then not be established. However, the court held that the initially unclear first claim of the plaintiff that the defendant should stop communicating to its users that it ignores DNT signals and does not consider it as an objection under Article 21(5) GDPR, was substantiated by an attached screenshot and thus concerned a concrete violation. The court held that this behaviour constituted an unfair commercial practice under the UWG. Further, the court agreed with the plaintiff that the use of a DNT signal constitutes an objection by automated means using technical specifications for the purposes of Article 21(5) GDPR. As regards the submission of the defendant that it does not consider DNTs as objections because there is no established standard about them yet, the court held that this is irrelevant to the question whether an objection is valid or not. As a consequence, the court found that the decision of the defendant to ignore DNTs constitutes a deceptive practice. As regards the second claim, the court held that the plaintiff was right in asking the defendant to refrain from automatically activating the “off-LinkedIn visibility” setting. By leaving the option pre-ticked, the defendant deceives the users as to their consumer right to decide whether or not they want their data to be accessible to the public, in particular to third party websites. In this way, the average users are deceived as they may think they gave consent to have the option activated, even though it is likely that users would not activate this option themselves if it wasn’t pre-ticked. The court further held, making reference to CJEU case C-673/17 - Planet49, that the pre-ticked option offered by the defendant cannot constitute a valid consent. The LG hence ordered the defendant to refrain from communicating to its users that it does not consider DNTs as an objection to processing and to deactivate the automatic “off-LinkedIn visibility” setting when users first set up an account.