Google LLC – Order (Denmark, 2023)

The Danish Business Authority was formerly responsible for supervising compliance with the Danish cookie rules. Due to reorganisation, the supervision was transferred to the Danish Agency for Digital Government on 15 December 2022, who is the authority making the decision in this case. On 1 and 16 September 2022, Google LLC was sent consultation letters regarding the use of cookies on their website, which did not allow users to give granular consent. The text on the first layer of the cookie banner stated that by selecting "accept all", users agreed that Google could use cookies to process their data for four purposes. Users would also be given the option of dividing their consent under "More choices" on the second layer of the cookie banner. However, users were only given the option to split their consent over two purposes, different to the ones in the first layer. Secondly, the Agency found that Google did not provide users with adequate information about all cookies used on the website. It also pointed out that the information was not considered to be permanently available through direct and marked access on the website, as it was difficult for users to retrieve information when clicking away the cookie banner. On 13 September and 6 October 2022, Google Denmark ApS, Google LLC and Google Ireland Limited submitted comments to the letters. They argued that the material scope of the Danish Cookie Law is limited to the website operator, which in their cases is Google Ireland Limited. In light of this, they contested the Agency’s territorial competence to supervise Google Ireland Limited. Firstly, the Agency affirmed that the website owner is subject to the obligations regarding the use of cookies under the Danish Cookie Law. Meaning that Google LLC, as the website owner, was subject to its requirements. Henceforth, on the territorial scope, the Agency, citing the [https://edpb.europa.eu/our-work-tools/our-documents/internal-documents/internal-edpb-document-042021-