WetterOnline Meteorologische Services GmbH – Court Ruling (Germany, 2024)

The North Rhine Westphalia Consumer Protection Association ([https://www.verbraucherzentrale.nrw/ Verbraucherzentrale NRW]) claimed for an injunction against the use of cookie banners on [https://www.wetteronline.de/ wetteronline.de], a wesite operated by WetterOnline Meteorologische Services GmbH, the controller. The controller used a cookie banner to collect users' consent to not necessary cookies without providing a reject option on the first layer. The data subject could only refuse to give consent by clicking on the “Settings” button to reach the second layer, where they then had an “Accept all” button or a “Save” button. The cookie banner also had an “Accept & Close X” button in the top-right corner, on both first and second level. In a judgement dated 4 May 2023, the Regional Court of Cologne (Landgericht Köln, LG Köln) dismissed the action as it considered the claim of the Association to be too broad and claimed that it could not impose a specific cookie banner design on the controller. The Association appealed against this judgement to the Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) and specified its claim. Firstly, the OLG Köln considered that the controller designed their cookie banner without an equivalent "reject option" either at the first or second layer. The OLG pointed out that the average user does not realise what the “Save” button represents - namely refusal to provide consent for the use of not necessary cookies. Therefore, the OLG decided that consent could not be regarded as freely given and sufficiently informed under Article 4(11) GDPR. Secondly, regarding the “Accept & Close X” button, the OLG considered that the “X” symbol is known to users as a way to close a window, but not to consent to the use of cookies. The average user would not be aware that this constitutes consent, even if the “Accept & Close” is located directly next to the “X” symbol. The OLG also noted that it was not easy for data subjects to recognize that the “Accept & Close” and the “X” symbol were one and the same button. Therefore, the OLG considered that this could not be regarded as unambiguous under Article 4(11) GDPR. With regard to these infringements, the OLG therefore ordered the controller to refrain from using such a cookie banner design and make sure that the banner includes a reject option equivalent to the accept option.