Google Ireland Ltd – Court Ruling (Germany, 2025)

The plaintiff is a nationwide umbrella organisation of consumer centres in Germany. It is a qualified organisation to bring collective redress actions according to german law. The contoller is Google Ireland Ltd, the provider of Google services in the EEA. To use some of the services provided by the defendant, a ‘Google account’ is required. At the sign up process, after users have first entered personal data to create an account, they must choose between 2 "personalisation settings”, “express personalisation" or "manual personalisation". “Express personalisation" consists of a 1 step page that permits personalised advertising while the "manual personalisation" consist of 5 steps that allow the user to select the personal data they want to share. When users log in to their Google account, after completing the registration process, they have the possibility to modify the duration of data storage and reduce it to 3 months. In June 2022 the plaintiff sent the controller an unsuccessful warning letter, arguing that with this sign up process for a Google account, the controller violated Article 5(1)(a) and Article 6(1)(a) GDPR since there is a lack of a voluntary, transparent and informed consent for a specific purpose. More specifically; a. The user does not have the option to refuse giving consent in the case of "express personalisation" and that the user is also unaware that they have the option of not giving consent if they return to "manual personalisation". b. In the context of "manual personalisation", the use of personal data in the "personalised advertising" area cannot be completely deselected, as the controller processes the user's "general location" for advertising purposes. c. There is no transparent list of the defendant's services for which consent is given and therefore lack of a specific purpose. d. The design of the consent process is confusing and unclear, in particular the use of "personalisation" instead of "consent" to the use of data. The controller claimed that the design of its personalisation settings constitutes voluntary and informed consent. In January 2023 the plaintiff brought an injunctive relief case before the Regional Court of Berlin II (LG Berlin II). The Hamburg Commissioner for Data Protection and Freedom of Information (Hamburg DPA) was heard in the procedure and stated that the consent in not voluntary or informed, highlighting that the "personalisation" does not make it sufficiently clear that it is a consent to data processing, which is a so-called deceptive design pattern. First, the court established that the plaintiff is authorised to conduct the proceedings under german law, (Section 8(3)(3) of the German Unfair Competition Act (UWG) and Section 3(1) of the German Injunctive Relive Act (UKIaG)) and Article 80(2) GDPR. The court held that it is not necessary to prove a specific violation or damage to an individual person. In this respect, it is sufficient that the rights of identifiable persons are potentially affected by the processing. Contrary to the defendant’s opinion, it stated that the power to bring proceedings pursuant to Article 80(2) GDPR for non-mandated non-profit organisations also extends to cross-border data processing and is not limited to national matters, enabling the organisations to assert the rights of natural persons on their behalf in accordance with Article 77 GDPR et seqq. Second, the court ruled that there is no voluntary and informed consent within the meaning of Article 6(1)(a) GDPR. There is a lack of voluntariness due to the lack of possibility to completely refuse consent to data processing in both "personalisation settings” options. An unlawful consent exists because the "express personalisation" only provides the options "confirm" and "return" and it is not possible to reject the consent directly while in "manual personalisation" the controller still uses the user's location in Germany despite of the lack of consent to personalised advertising. Also, the controller does not give users clear and comprehensible information about the scope and purpose of the data processing, violating the principle of transparency (Article 5(1)(a) GDPR). Third, the court found a violation of Article 25(2) GDPR because the controller set a default setting to store personal data for more than three months. The fact that the user can set the data to be deleted after three months means that the controller indicates that such storage period is generally sufficient for the processing carried out and the storage period of more than three months was not necessary. Therefore the retention period is not limited to the absolute minimum necessary. The fact that the storage period can be shortened after consent has been given is irrelevant since Article 25(2) GDPR requires that users do not have to make any changes to the settings in order to achieve the most "data minimising" processing possible. Lastly, the court ordered the controller to pay the plaintiff €242,99 and to cease and desist from any further offenses, subject to a fine of up to €250,000 for each case of infringement, or imprisonment for up to six months.