Court case 6 U 81/23 – Court Ruling (Germany, 2025)
A German court ruled that a company placed cookies on users' devices without getting their permission. This is important because it shows that companies must ask for consent before tracking users online. The court also awarded the user €1,500 for the violation.
What happened
A company placed cookies on users' devices and processed their data for advertising without obtaining consent.
Who was affected
Website visitors whose devices had cookies placed by the company without their consent.
What the authority found
The court decided that the company could not prove it had valid consent to process personal data, violating GDPR requirements.
Why this matters
This ruling emphasizes that companies must ensure they have proper consent for tracking users. It sets a precedent that could affect how businesses handle online tracking and consent.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The controller placed cookies on the data subject’s terminal equipment and processed the resulting data for advertising purposes without obtaining the data subject’s consent. The personal data concerned included, in particular, the data subject’s IP address and a cookie identifier. The data subject brought an action before the Regional Court (LG Frankfurt), seeking an injunction and compensation for non-material damage. The controller argued that the data subject had knowingly triggered the processing and that the data were only processed in aggregated and pseudonymised form. The controller further contended that the data subject could have deleted the cookies from his device at any time. The Court rejected these arguments and granted an injunction and awarded damages of €1,500 to the data subject. The controller subsequently appealed the decision to the OLG Frankfurt. The Court partially upheld the lower court's decision. The court held that the controller could not rely on the fact that the data subject was technically able to delete cookies from his terminal equipment. The lawfulness of processing depends on the existence of valid prior consent, not on the data subject’s ability to mitigate the effects of unlawful processing after the fact. The Court further clarified that the burden of proof for demonstrating valid consent rests with the controller. Accordingly, the controller’s argument that the data subject had failed to show that he did not consent was dismissed as irrelevant. With regard to damages, the court found that the infringement did not result in a significant loss of control over personal data, as the data subject was aware of the processing and the personal data at issue (IP address and cookie ID) were not particularly sensitive. Nevertheless, the court held that the storage and processing of cookies for advertising purposes without consent gave rise to a feeling of being monitored, which amounted to non-material damage. Given that the impairment
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (2)
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
Related Cases (0)
No other cases found for Court case 6 U 81/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case 6 U 81/23 - Germany (2025). Retrieved from cookiefines.eu
Last updated: