Google Ireland Ltd – Court Ruling (Germany, 2025)

The plaintiff is a nationwide umbrella organisation of consumer centres in Germany. It is a qualified organisation to bring collective redress actions according to german law. The contoller is Google Ireland Ltd, the provider of Google services in the EEA. To use some of the services provided by the defendant, a ‘Google account’ is required. At the sign up process, after users have first entered personal data to create an account, they must choose between 2 "personalisation settings”, “express personalisation" or "manual personalisation". “Express personalisation" consists of a 1 step page that permits personalised advertising while the "manual personalisation" consist of 5 steps that allow the user to select the personal data they want to share. When users log in to their Google account, after completing the registration process, they have the possibility to modify the duration of data storage and reduce it to 3 months. In June 2022 the plaintiff sent the controller an unsuccessful warning letter, arguing that with this sign up process for a Google account, the controller violated Article 5(1)(a) and Article 6(1)(a) GDPR since there is a lack of a voluntary, transparent and informed consent for a specific purpose. More specifically; a. The user does not have the option to refuse giving consent in the case of "express personalisation" and that the user is also unaware that they have the option of not giving consent if they return to "manual personalisation". b. In the context of "manual personalisation", the use of personal data in the "personalised advertising" area cannot be completely deselected, as the controller processes the user's "general location" for advertising purposes. c. There is no transparent list of the defendant's services for which consent is given and therefore lack of a specific purpose. d. The design of the consent process is confusing and unclear, in particular the use of "personalisation" instead of "consent" to the use of data. The co