Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
94 results · Showing 1–20
The media company used a two-layer cookie consent banner where rejecting cookies required more steps than accepting them, violating GDPR and ePrivacy Directive requirements.
Sanoma Media Finland placed cookies and made web requests without obtaining user consent, violating the requirement for prior consent under the ePrivacy Directive.
The court found that the cookie banner allowed users to refuse cookies as easily as accepting them, dismissing the NGO's challenge.
The case involves data processing for copyright enforcement, unrelated to cookies or consent mechanisms.
Third-party tracking tools processed personal data without user consent, violating cookie consent requirements.
The website's cookie banner lacked a rejection option on the first layer, used dark patterns, and set non-essential cookies without valid consent.
The cookie banner did not offer an equally prominent rejection option, making it harder to refuse cookies than to accept them.
The case focused on direct marketing and consent issues rather than specific cookie violations.
In 2023, the French Data Protection Authority (CNIL) fined Criteo, an advertising company (the controller), €40,000,000 for breaches of the GDPR related to the processing of browsing data through cookies for the purpose of placing personalised advertisements. The decision followed complaints lodged by Privacy International and noyb. The DPA found violations of Article 26(1) GDPR and Article 26(2) GDPR based on the lack of a joint controllers' agreement with its partners, Article 7(1) GDPR by processing user data without consent, Article 7(3) GDPR and Article 17 GDPR by failing to erase data subjects’ personal data based on their requests, and Article 12 GDPR, Article 13 GDPR, and Article 15 GDPR by failing to inform data subjects of the processing of their personal data. The controller appealed the decision asking for its annulment or, alternatively, the reduction of the fine. First, the Council of State (the court) held that the controller processed personal data since the identification of individuals would not be technically impossible based on the very large amount of information, sometimes very precise, collected and cross-referenced for a given identifier assigned to each data subject. Secondly, the court noted that the controller did not contest the DPA’s findings regarding the lack of a joint controllers' agreement. Thirdly, it found that the DPA’s conclusion regarding the violation of Article 7(1) GDPR did not disregard the principles of legality of offenses, presumption of innocence and exclusion of liability for others in criminal matters. Fourthly, it dismissed the argument that the contested decision was based on error of fact and assessment regarding the information provided to data subjects on the purposes for which their data were processed. Finally, the court noted that the controller could not rely on legitimate interest for continuing to process the data of data subjects who requested their erasure. Therefore, the court dismissed the cont
The case involves the use of 'M Pixel' to track users without consent, related to third-party tracking cookies.
A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him for the placement of optional cookies onto users’ devices when visiting his website, as well as for failing to inform data subjects of the processing of their personal data via the contact form available on the website. The DPA sanctioned the controller a total of RON 50,286.80 (approximately €10,000) for breaching Article 4(5)(a) & (b) Romanian Law no. 506/2004 transposing e-Privacy Directive 2002/58 and Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The controller claimed in its appeal that, among other things, the DPA failed to include in its decision the complete mandatory information prescribed by administrative law, that the cookies placed on the users’ devices were necessary, and that data subjects were informed of the processing activities on the website. Therefore, the controller requested the annulment of the DPA decision. The court dismissed the controller’s appeal. It found that the website links directing to the privacy policy and information notice were not functional, but that they became functional following communications from the DPA to the controller. Furthermore, the court noted that website users did not have a clear and visible way of providing consent to the use of cookies on the website. Moreover, the court found that the DPA decision contained most of the necessary information required by law. The court noted that the missing information referred only to the objections of the controller. However, the court emphasised that such an omission did not require the annulment of the DPA decision, since the controller was able to raise his objections during the appeal. Finally, the court emphasised the electoral context in which the violations occurred, pointing out that the increased danger for the unlawful processing of the personal data collected via the website at that time. Therefore, the court dismissed the controller’s appeal an
A court began investigating an airline company (the controller) for their potential consumer, competition and data protection violations following a dispute between two companies. The controller implemented a pre-selected consent box on their website when searching for flights. While the box was initially not pre-ticked, the website automatically ticked the box if a data subject did not do so. This meant that data subjects automatically consented to the website’s terms of use by clicking the “search” button. Furthermore, the controller required data subjects to create an account when booking flights, and filled out some of the information automatically when creating an account. This was also the case if a data subject wished to only look at flights without booking. The opposing company argued that data subjects were not allowed to give meaningful consent, as the option cannot be de-selected. In addition, the controller processed data subjects’ data without a legal basis by requiring them to create an account and by automatically filling in information. The data subject argued that the controller processed data beyond what is necessary for a flight booking or search, in violation of the principle of data minimisation (Article 5(1)(c) GDPR). The controller also violated Article 7(4) GDPR by making the provision of its services conditional to the data subject’s consent. The controller argued that data subjects could easily access the website’s terms and conditions, and that the automatic ticking of the box did not force data subjects to consent. Furthermore, the controller processed only the necessary data when creating data subjects’ accounts. The court found that the controller violated the GDPR and consumer laws through its pre-ticked boxes. The court highlighted that the website misled data subjects into thinking they have a choice, when in reality the website ticked the box automatically. The court dismissed the controller’s argument that the message next to
The controller placed cookies on the data subject’s terminal equipment and processed the resulting data for advertising purposes without obtaining the data subject’s consent. The personal data concerned included, in particular, the data subject’s IP address and a cookie identifier. The data subject brought an action before the Regional Court (LG Frankfurt), seeking an injunction and compensation for non-material damage. The controller argued that the data subject had knowingly triggered the processing and that the data were only processed in aggregated and pseudonymised form. The controller further contended that the data subject could have deleted the cookies from his device at any time. The Court rejected these arguments and granted an injunction and awarded damages of €1,500 to the data subject. The controller subsequently appealed the decision to the OLG Frankfurt. The Court partially upheld the lower court's decision. The court held that the controller could not rely on the fact that the data subject was technically able to delete cookies from his terminal equipment. The lawfulness of processing depends on the existence of valid prior consent, not on the data subject’s ability to mitigate the effects of unlawful processing after the fact. The Court further clarified that the burden of proof for demonstrating valid consent rests with the controller. Accordingly, the controller’s argument that the data subject had failed to show that he did not consent was dismissed as irrelevant. With regard to damages, the court found that the infringement did not result in a significant loss of control over personal data, as the data subject was aware of the processing and the personal data at issue (IP address and cookie ID) were not particularly sensitive. Nevertheless, the court held that the storage and processing of cookies for advertising purposes without consent gave rise to a feeling of being monitored, which amounted to non-material damage. Given that the impairment
The case was about unlawful processing of personal data for advertising without a valid legal basis, not specifically about cookie or consent banner violations.
Criteo placed tracking cookies on users' devices through third-party websites without obtaining prior consent.
Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service). On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose. The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court. In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: #In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free
Apple used identifiers for personalized advertising without obtaining prior user consent, violating ePrivacy Directive requirements.
Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked. The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR. In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban. The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a proce
The Federal Press Office operated a fan page on the social network Facebook, provided by Meta Platforms Inc., where it provided information about current political activities of the Federal Government. When users visited the page, cookies could be placed on their end devices. In 2023, the Federal DPA (BfDI) prohibited the Federal Press Office from operating its fan page because the design of the cookie banner used by Meta was not GDPR compliant. It held that the Federal Press Office was regarded a joint controller, together with Meta, responsible for ensuring that the data processing regarding cookies was based on a sufficient legal basis such as consent. Therefore, not only Meta, but also the Federal Press Office, as the operator of the fan page, was legally obliged to obtain the consent of the respective visitor. Both the Federal Government and Meta appealed against the DPA's decision addressed to the Federal Press Office before the court of first instance (Cologne Administrative Court-VG Cologne). The court held that under the GDPR, Meta and the Federal Press Office were not joint controllers for the contested data processing. Meta was solely responsible for obtaining the consent of visitors of the fan page for the placement of cookies. It ruled that the Federal Press Office's contribution to the storage and reading of cookies was limited to the operation of the page. In particular, the Federal Press Office could not specify any parameters for the placement of the cookies and the analysis of the data collected. In the opinion of the court, the mere facilitation of data processing does not constitute the necessary joint determination of the means of data processing. Consequently, the Press and Information Office of the Federal Government was permitted to continue operating its Facebook fan page.
The social media platform was accused of tracking users through embedded Business Tools without consent, violating cookie consent requirements.