Court case 327 O 38/25 – Court Ruling (Germany, 2025)

A court began investigating an airline company (the controller) for their potential consumer, competition and data protection violations following a dispute between two companies. The controller implemented a pre-selected consent box on their website when searching for flights. While the box was initially not pre-ticked, the website automatically ticked the box if a data subject did not do so. This meant that data subjects automatically consented to the website’s terms of use by clicking the “search” button. Furthermore, the controller required data subjects to create an account when booking flights, and filled out some of the information automatically when creating an account. This was also the case if a data subject wished to only look at flights without booking. The opposing company argued that data subjects were not allowed to give meaningful consent, as the option cannot be de-selected. In addition, the controller processed data subjects’ data without a legal basis by requiring them to create an account and by automatically filling in information. The data subject argued that the controller processed data beyond what is necessary for a flight booking or search, in violation of the principle of data minimisation (Article 5(1)(c) GDPR). The controller also violated Article 7(4) GDPR by making the provision of its services conditional to the data subject’s consent. The controller argued that data subjects could easily access the website’s terms and conditions, and that the automatic ticking of the box did not force data subjects to consent. Furthermore, the controller processed only the necessary data when creating data subjects’ accounts. The court found that the controller violated the GDPR and consumer laws through its pre-ticked boxes. The court highlighted that the website misled data subjects into thinking they have a choice, when in reality the website ticked the box automatically. The court dismissed the controller’s argument that the message next to the box sufficiently informed data subjects. However, the court found the processing of data when creating an account permissible, as it considered it necessary for the performance of the flight services. According to the court, the controller only needed data subjects’ email address to create an account, and any other data had to be voluntarily provided by the data subject. Therefore, the court considered this compliant with Articles 5 and 6 GDPR. In addition, the opposing company had not provided enough evidence of the risk of the controller using the booking data for direct marketing purposes. The court prohibited the controller from obtaining consent from data subjects through pre-ticked boxes.