Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
Court case W252 2282050-1/12E
On the 09 August 2022, a data subject, represented by noyb, filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the controller unlawfully processed their personal data without the data subject's valid consent. The data subject alleged that, due to the use of dark patterns by the controller, the principle of transparency was violated and that the withdrawal of consent was not as easy as its issuance. Therefore, the data subject requested the erasure of their personal data. The option to reject cookies was a link, which was only identifiable as a link when hovering over it with the mouse. The accept button on the other hand was strongly highlighted by being placed in the middle of the banner and in a colour with strong contrast to the background. On the 22 September 2023, the DSB issued a decision on the following three points: Point 1: The data subject’s right to erasure had been violated under Article 17 GDPR. Point 2: The data subject’s right to privacy had not been violated under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=04-11-2022 §1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG). Point 3.a: The DSB ordered the controller to alter its cookie banner to make the “reject all cookies” appear in equal format to the “accept all cookies” option. Point 3.b: The controller must implement a function, which makes the revocation of consent just as simple as its declaration. The controller appealed points 1, 3a and 3b of the decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The controller posited that the GDPR does not require the “accept” and “reject” buttons to be displayed in an equal format. Further, it added that the revocation of consent was available through a footer link on the website which lead to the cookie settings. The court rejected the controller’s appeal. Point 1: The data of the data subject, at the latest, had to be deleted when the complaint was filed as it clearly showed a revocation of consent to the data processing under Article 17(1)(b) GDPR. Point 3.a: The court acknowledged that the cookie banner impairs users because of its size and they would quickly click on the highlighted accept option. In particular, they will not have understood the implications of the data processing. Furthermore, consent is not unambiguous as users are clearly nudged by the design. This is also contrary to the principle of transparency, as it points users towards the more invasive data processing option. In addition, the cookie banner creates a situation "where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected" (Recital 58 GDPR). The court concluded that the controller could not prove that the data subject gave unambiguous consent as per Article 7 GDPR. Point 3b: The court highlighted that under Article 7(3) GDPR, withdrawing consent should be as easy as giving consent meaning that the action required to revoke consent must be just as simple as the action for agreeing to the data processing. The court agreed with the DSB stating that it is not clear where exactly consent can be withdrawn based on the information provided in the cookie banner. The court considered that a floating icon is not necessary to withdraw consent because otherwise the option to withdraw consent would constantly block a big part of the screen.
Court case W298 2274626-1/8E
The data subject had brought a complaint to the Austrian DPA against the controller, a political party. The data subject detailed that he had visited the controller’s website and noticed that Google reCaptcha was being used on the website even though the data subject had deactivated Google reCaptcha. After the data subject had deactivated all cookies and functions such as Google reCaptcha, he clicked on the “become a member” page on the website, which showed the transfer of 615 packages of information from and to Google. The data subject declared that he had not agreed to the data transfer and that he wasn’t adequately informed that his IP address and the connected data would be transferred to Google. Therefore, Google would have knowledge of which party the data subject wanted to become a member of. The controller told the DPA that the information on the data subject’s membership sign-up remained entirely confidential and could not be accessed by others. The controller saw itself responsible for the content of the website while the design was carried out by an external person. Further, users had the option to reject cookies through the cookie banner. If cookies were rejected then no storage nor data transfer took place. The data subject added on the 20 April 2023, that after the complaint with the DPA, the controller continued the practice. Google Fonts was automatically downloaded and users were only informed of this in the privacy policy after the download had been completed. The DPA found that the data subject’s right to privacy had been infringed upon through implementing Google reCaptcha and processing the data subject’s IP address, certain unique identifiers and browser data. The cookie “_GRECAPTCHA” was held not to be of technological necessity and therefore required the data subject’s explicit consent. Therefore, none of the legal basis under Article 6(1) GDPR applied. The controller appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). It argued that the DPA had not analysed with which browser and operating system the data subject had accessed the website. The BVwG held that the data subject had not given his clear consent to the reCatpcha data processing. Even though the controller had not listed Article 6(1)(f) GDPR as a legal basis for processing, the court analysed whether this could legitimize the data processing. The Google reCaptca service was held to be unnecessary and therefore the controller could not rely on a legitimate interest. Therefore, none of the legal bases under Article 6(1) GDPR applied and the data processing violated the data subject’s right to privacy under §1(1) of the Austrian Data Protection Act. The BVwG therefore upheld the decision of the DPA.
Court case W 108 2284491-1
The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. In the meantime the controller updated the settings of the cookie banner and introduced a reject button on its first layer, next to the accept button. Also, the link to manage the cookie settings was redesigned as a button. Moreover, the controller added a floating icon, allowing the website users to withdraw the consent given at any time. If a website user rejected the cookies or withdrew the consent via the floating icon, the controller would interpret such a conduct to be an objection under Article 21 GDPR. Additionally, the controller informed they deleted the data concerning the data subject. In response, the data subject emphasized that due to new settings of the website, the controller wrongly qualified certain cookies to be strictly necessary. In consequence, the controller installed the cookies before the website’s user interacted with the cookie banner, violating Article 5(3) ePrivacy Directive. Although the controller announced that it would implement a completely new cookie banner, they later retracted from that plan. The controller changed the cookie banner and – after improving it initially – removed the reject button again. Eventually, updated cookie banner didn’t include a reject button on the first layer any longer. The DPA issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”). The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). After hearing the parties and visiting the website itself the court issued its decision. The court dismissed the appeal of the controller as unfounded. == The controller’s processing activities didn’t fall within the scope of journalistic purposes. The court emphasised that the controller placed the cookies and processed the collected data for analytical and advertising purposes. == The court also upheld the interpretation of the DPA that the first layer of the cookie banner needs to contain a visually equivalent option to reject cookies. According to the court Article 7(3) GDPR implies that refusing consent shall be as easy as giving consent. In particular, refusing consent shall not require more interactions than giving consent. In the case at hand consenting required only one click, whereas rejecting consent required two clicks. Therefore no equivalence between the options was given. Furthermore, the different design of the options in the first layer – a button for consent on one hand and a link to access the second layer on the other – equally lead to the conclusion that the options cannot be considered equivalent. A mere explanation in the first layer of the cookie banner on how to reject cookies does not change this assessment. Additionally, the cookie manage link at the bottom of the website is not an equivalent option either, since it is only available after an interaction with the cookie banner. Hence, the DPA order was found to be correct. The court did not find that the controller had complied with this order in the meantime.
Court case W108 2280724-1
The data subject visited a website, for which the controller was responsible. Upon accessing the website, the data subject was presented with a 'Consent Management Platform (CMP or cookie banner)' that, according to the data subject, violated Article 6 GDPR. The data subject filed a complaint to the Austrian DPA (DSB) on 10 August 2021. The data subject was represented by noyb. During the proceedings before the DPA: * the controller claimed to have reworked the design of the CMP and to have deleted the contested personal data of the data subject; * the data subject replied to this statement claiming that even though the violations identified in the complaint had been remedied by the new design of the CMP, certain cookies were then classified as 'strictly necessary' (within the meaning of Article 5 (3) ePrivacy Directive) and thus set as 'always active'; * in response, the controller claimed not to have processed any personal data without the data subjects consent. In addition, the controller explained that the note 'always active' for certain cookies was incorrect and had only not been removed by the time of the data subject's statement for technical reasons; * the data subject explained that the cookies had still been incorrectly classified and various non-required cookies were set without interaction with the banner. The controller claimed they had revised the cookie settings and the banner again and the contested cookies that were not deemed strictly necessary were not being set anymore if consent was not given; * the data subject stated their data was indeed processed without their consent upon visiting the website and that the processor had not explained in sufficient detail to what extent certain cookies were considered strictly necessary. The DPA dismissed the complaint. However, it also officially instructed the processor in point 3) of their decision to adapt the website and the banner in such a way to be compliant with Article 4(11) GDPR and Article 4(7) GDPR and Article 7(3) GDPR, respectively. The controller lodged a timely appeal against point 3) of the decision with Austrian Federal Administrative Court (BVwG). The controller claimed that the design of the cookie banner was in compliance with Article 7(3) GDPR as it already has a sufficiently marked option to revoke consent. Furthermore, the processor claimed not to have set cookies that are not technically necessary and the website is therefore already in compliance with Article 4(11) GDPR and Article 4(7) GDPR. The controller submitted an additional statement on June 6, 2024 that it decided not to operate the website any further and redirect visitors to a different website. The processor claimed that this provided another reason to annul point 3) of the decision of the DPA. The data subject issued multiple statements during the proceedings, claiming that the new website violates Article 4(11) and Article 4(7) GDPR and Article 7(3) GDPR in the same way as the previous website did. The court gave way to the appeal of the controller and annulled the contested point 3) of the DPA decision. After the changes made to the design of the CMP, there were clear textual instructions given as to how to grant or revoke consent. It was then as easy for an averagely informed, attentive and circumspect consumer to grant consent as to revoke it and the CMP was therefore already in compliance with Article 7(3) GDPR. Upon visiting the latest version of the website, there were only strictly necessary cookies in terms of Article 5(3) [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058 ePrivacy Directive] active without consent and there was no processing of personal data that violated Article 4(11) and Article 4(7) GDPR.
Court case 9 O 173/24
The data subject is a user of a social network platform, which also provides a messaging service. This platform is managed by a company with its headquarter in the USA. The data subject initiated a lawsuit before the Regional Court of Traunstein (Landesgericht Traunstein – LG Traunstein). Firstly, she argued that the controller is constantly monitoring her private messages and that the privacy policy is not transparent and is too complex. Secondly, she argued that, through cookies, the controller is collecting data relating to activities that happen outside the social network without her consent. Thirdly, she claimed that the controller forwarded all her personal data from and in connection with her account to the USA. She argued that this transfer is unlawful since the USA did not guarantee a level of protection equivalent to the GDPR. Therefore, the data subject asked the court to order the controller to pay non-material damages. As for the first argument, the controller pointed out that it conducts scans on the private messages only when to detect child sexual abuse material (CSAM) in compliance with the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32002L0058 ePrivacy Directive 2002/58/EC] (see [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32021R1232 Article 3 Regulation (EU) 2021/1232]). Moreover, the controller argued that it is respecting its transparency obligations and that the transfer of data to the US is legal since there is an adequacy decision and, before that, there were SCCs. First of all, the court ruled that the data subject has not demonstrated that the controller is systematically and automatically monitors the content exchanged via the messenger service. In every case, it found that the controller has proven that it carries out only permissible CSAM scanning. According to the court, this processing is covered by the legal basis provided for by Article 6(1)(f) GDPR. Secondly, it held that, due to the extensive data protection requirements that are imposed on the controller, the privacy policy cannot be more concise or simpler. Therefore, it found no violation of Article 13 and 14 GDPR. Thirdly, it did not uphold the data subject’s argument about cookies. It found that the controller could rely on consent under Article 6(1)(a) and 9(2)(a) GDPR to collect this data. Fourthly, the court noted that the social media platform at hand is designed as a global platform whose aim is to allow users to have a worldwide network and allow users to have “friends” from all over the World. Therefore, according to the court, it is obvious – and also the data subject should know this – that data is also transmitted to the USA, especially since the search for users in other jurisdictions can only work if there is a cross-border exchange of data. Moreover, the court believed that the business decision of the controller transfer data to the USA is to be accepted by the data subject since no one is forced to use the platform. Furthermore, it held that the data transfer at hand is necessary for the performance of a contract and, therefore, lawful under Article 6(1)(b) GDPR. Finally, as for Chapter V GDPR, the court pointed out that currently the controller can rely on the [https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj Commission Implementing Decision EU 2023/1795] which allows data transfers to the USA under Article 45(3) GDPR. As for the preceding period, it found that the standard contractual clauses adopted by the European commission in 2010 and 2021 according to Article 46(2)(c) GDPR provide a sufficient legal basis. According to the court, the fact the US government authorities can access the data transferred by the controller does not prevent the guarantee of an essentially equal level of protection since it is also possible for EU authorities to have such an access under Article 6(1)(c) GDPR. Moreover, the court ruled that the data transfer is however lawful since it is necessary for the performance of the contract under Article 49(1)(b) GDPR. On these grounds, the court dismissed the data subject's requests.
The data subject visited several popular websites and refused all cookies. However, tracking cookies were still placed on the data subject’s device. The controllers are Linkedin Ireland, Linkedin Netherlands, Microsoft Corporation (US), Microsoft Ireland Operations, Microsoft (NL) and Xandr (US). LinkedIn offers an advertising service and allows for companies to place tracking cookies on the browsers of a user after they view or click their ads. Microsoft has an advertising service that sells ad space on various websites. The service also allows advertisers to show their ads on the ad space of 'third-party' website operators and can place tracking cookies on the devices of website visitors. Xandr is an online platform that buys and sells digital ads. To use the services of Xandr, website users need to install a Java-script that places tracking cookies on the devices of website visitors. All of them are part of the Microsoft Group. The data subject hired a third party specialist to make an independent analysis of the controllers’ collection of personal data via the placed cookies. The analysis confirmed that out of the 30 websites the data subject visited, 27 websites placed and/or read cookies without the data subject’s consent. 24 websites did this even after explicit refusal to consent. Thus, the controllers were collecting personal data of the data subject’s browsing habits without their consent. The data subject filed an urgency procedure (“kort geding”) at the Amsterdam District Court (“Rechtbank Amsterdam”), asking the court to forbid the controllers to place tracking cookies without the data subject’s consent. Jurisdiction of the court [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Brussels I bis Regulation] regulates which courts of the EU Member States have jurisdiction in cases with links to more than one Member State in the EU. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bis Regulation] states that, in matters relating to tort, delict or quasi-delict, a person domiciled in a Member State may be sued in another Member State if the harmful event occurred or may occur in that Member State. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 8(1) of the Regulation] states that a person can also be sued in another Member State when one of the defendants is domiciled where the court is also located, "provided the claims are so closely connected that it is expedient to hear and determine them together to avoid the risk of irreconcilable judgments resulting from separate proceedings.” Although some of the controllers are established in Ireland, the court held that it had the jurisdiction to rule on this matter: a) under Article 79(2) GDPR, as the data subject had their habitual residence the Netherlands and, b) under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bis Regulation], as Amsterdam is the place where the harmful event occurred and, c) under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 8(1) Brussels I bis Regulation], as two of the controllers are established in the Netherlands and there is a close link between the claims against the controllers. The court rejected the controllers’ argument that the “place where the harmful event occurred” is only applicable when the data subject demands a claim for damages, because it could not be inferred from the legislative history and case-law that jurisdiction on the bases of where the harmful event occurred only applies to compensation claims. The court held that with regards to the controllers established in the US, Brussels I bis Regulation did not apply, but [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Articles 1-14 of the Dutch Civil Procedure Code] did. The court held it had the jurisdiction under [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Article 6 of the Dutch Civil Procedure Code] (in case of unlawful acts, jurisdiction is based on the place of the harmful event) and [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Article 7 of the Dutch Civil Procedure Code] (there is such a connection between the claims against the various defendants that reasons of efficiency justify a joint procedure). Urgency Furthermore, the court held that the data subject had an urgent interest, because if the controllers were acting unlawfully by violating the data subject’s privacy rights, the court must put an end to this as soon as possible. Therefore, the court held that the data subject cannot be asked to wait for a decision through a normal court procedure and allowed for the urgency procedure. Joint controllership The court rejected the controllers’ argument that they were merely processors and that the responsibility lied with the website operators. The court ruled that under Article 4(7) GDPR, LinkedIn, Microsoft and Xandr were controllers as they determined the means and purposes of data processing. This responsibility remains even if the controllers outsourced the obtaining of consent to their partners (the website operators). Under Article 26 GDPR, multiple parties can be jointly responsible for the processing of personal data. Therefore, the court held that LinkedIn, Microsoft and Xandr were considered joint controllers, and thus responsible for complying with the GDPR. Personal data and consent The court rejected the controllers’ argument that they do not process personal data with their tracking cookies under Article 4(2) GDPR. The court stated that the controllers acknowledged that most of the cookies were set for the purpose of capturing personal data, which can be used to build profiles that can be read for advertising purposes. Moreover, the court held that already placing a cookie that automatically collects personal data constitutes a processing of personal data, and not only when personal data collected by the tracking cookie is actually read for the purpose of advertising. The court dismissed the argument of the controllers that some of these cookies were not tracking cookies and thus not processing personal data. The court held that under Article 6 GDPR and [https://privacy-web.nl/wetgeving/telecommunicatiewet/hoofdstuk-11-bescherming-van-persoonsgegevens-en-de-persoonlijke-levenssfeer/%C2%A7-11-1-algemene-bepalingen/artikel-11-7a/ Article 11.7a of the Dutch Telecommunications act], the placing and reading of tracking cookies requires consent of the data subject. Controllers must demonstrate that they have consent under Article 5(2) GDPR. The court took into account the independent analysis that showed that websites placed cookies without the consent of the data subject, even after rejecting consent. The court also found that the controllers failed to prove that their tracking cookies were only placed on the data subject’s devices after his consent. The fact that the findings in the analysis are not representative because hundreds of other websites that have the controllers’ tracking cookies do comply with the GDPR by not placing cookies without consent was deemed irrelevant. Responsibility of the controllers The court stated that controllers were allowed to contractually outsource the obtaining of consent to their partners (the websites placing these tracking cookies), meaning that these websites provide information about and obtains consent for the placement of cookies. The controllers do not necessarily have to provide this information and obtain consent themselves as well. However, the court held that the controllers cannot put the sole responsibility on their partners for obtaining consent. The controllers remain (also) responsible themselves for ensuring consent is obtained in a legally valid and lawful manner for the placement and reading of the tracking cookies. The court thus held that controllers can be held liable for this on the basis of Article 26(3) GDPR, regardless of what the contract with its partners states. The court stated that the controllers could have made tools available to their partners that made it impossible to place tracking cookies without consent. If that would have been the case, there would be no unlawful conduct by the controllers. However, this was not done by the controllers. Therefore, the court held that the controllers could not rely on the fact that they have done everything necessary, or at least everything that can be required of them, to prevent the placement of tracking cookies on the data subject’s devices without his consent. Conclusion The court concluded that the controllers violated the GDPR and the Dutch Telecommunications Act by placing and reading tracking cookies without the consent of the data subject. The court thus prohibited the controllers from placing or reading tracking cookies on the data subject's devices without his consent. The court also imposed a penalty of €500 per violation (or €1000 per day), up to a maximum of €25,000 per company until they complied. Lastly, the court ordered the controllers to pay the data subject’s legal costs.
VOODOO
The controller appealed [https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2022-026 decision SAN-2022-026] of the French DPA ('CNIL') before the French Supreme Administrative Court ('Conseil d'Etat). The CNIL fined the controller €3,000,000 for failing to obtain data subjects' consent for advertising purposes, regarding "Identifiers for Vendors" when using the controller's apps on Apple devices. The DPA also ordered an injunction requiring the controller to bring its data processing into compliance within a period of three months from notification of the deliberation. This was subject to a fine of €20,000 per day of delay. The controller sought to reduce the fine amount. The Conseil d'Etat rejected the controller's request and upheld the DPA's €3,000,000 fine. First, Article 82 of the French Data Protection Act requires that any operation of collection or deposit of information stored in the terminal of a data subject must be subject to prior, clear and complete information relating to the purpose of cookies or other tracers and the means available to data subjects to oppose them, as well as the prior collection of their consent. Two exceptions exist to this requirement: (i) if the activity has the exclusive purpose of allowing or facilitating communication by electronic means and (ii) if it is strictly necessary to the provision of an online communication service at the express request of the user. The Conseil d'Etat considered that the DPA had sufficiently established the facts regarding the breach of [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the French Data Protection Act] (loi 78-17 du 6 janvier 1978, Informatique et Libertés), as the controller did not obtain the necessary consent to collect data subjects' data and its activities did not fall into one of the exceptions to this requirement. Second, the Conseil d'Etat also held that the DPA followed the correct procedures when deciding the fine to be imposed on the controller. In making the decision, the DPA correctly took into account several factors including for example the number of data subjects and the seriousness of the breach (Article 83(2)(a) GDPR), the financial situation of the controller in its economic sector and the fact the controller derived more than 95% of its income from advertising, and thereby gained financial advantage from the breach (Article 83(2)(k) GDPR). Finally, the Council d'Etat further noted that neither the GDPR nor the French Data Protection Act require the DPA to explain the reasoning behind the amount of sanctions imposed, and therefore the DPA had not disregarded the principle of legality and proportionality of penalties when deciding the penalty amount.
Court case W211 2281997-1/5 E
Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austrian Federal Administrative Court (‘Bundesverwaltungsgericht’ or ‘BVwG’). The BVwG does not consider that consent was actually forced and therefore involuntary. As an introduction, the BVwG recalled Article 7(4) GDPR which precludes the so-called ‘tying’. This means that the performance of a contract may not be made dependent upon the consent to process personal data, which is not needed for the performance of that contract. The BVwG referred to the German Data Protection Conference (‘DSK’) which, according to the BVwG, did not consider a provision of ‘free’ service offers ‘payed’ by users with their consent to be contrary to Article 7(4) GDPR.. Such offer should be presented to data subjects as a contractual agreement at the time of its conclusion. As a result, personal data could became the subject of a primary performance obligation of a legal transaction. The BVwG did not state explicitly how these considerations apply in the present case. Further, the BVwG refers to the CJEU judgment in C-252/21. This judgment would not be applicable in the present case. The BVwG emphasized that in the present case the controller is not in a dominant market position comparable to the one of Meta in C 252/21. The users’ freedom of choice is not affected the same way as described in the CJEU judgment C-252/21. The controller’s website cannot be compared to the pressure of a quasi-monopolistic online service that would not be accessible without consent. Additionally, the BVwG acknowledged that while data protection laws can limit private autonomy, in this case the controller had the right to determine the conditions for accessing its content, which includes requiring consent to tracking cookies (‘data as compensation for service’). A different interpretation of Article 6(1)(a) GDPR would not be proportionate. The court emphasized that users had alternative means to access the content, such as through a print edition or a digital subscription, and thus there was no disproportionate infringement on user rights. Consequently, the data subject cannot claim a right to access the website content under its preferred conditions, and the controller is not obliged to provide such access. The BVwG concluded that the controller obtained valid consent and annulled the decision of the DPA. This decision was appealed by the Austrian DPA to the Supreme Administrative Court (‘Verwaltungsgerichtshof’).
Criteo SA
The controller is Criteo SA, a global technology company operating in media and entertainment that does consultancy, provides software and services in relation to digital marketing, media advertising and real time ads bidding. The controller places tracking cookies for targeted advertising on computers and mobile devices of users visiting certain third party websites. The controller uses the Real Time Bidding (RTB) System to recognise a user within seconds and to show personalised ads. In another case against the controller on 15 June 2023 , the French DPA ("CNIL") fined the controller €40 million for violating various articles of the GDPR, in particular for failing to verify that the persons from whom it processed data had given their consent. On 8 August 2023, the data subject wrote to the controller that the placing of tracking cookies on the data subject’s devices without the data subject’s consent, violates [https://www.google.com/search?client=firefox-b-d&q=telecommunicatiewet+11.7a Article 11.7a(1) Dutch telecommunications law] (“Telecommunicatiewet – TW”) and Articles 5(1)(a), 6(1), 7, 13 and 14 GDPR. The controller responded that it is the responsibility of the third party websites to obtain consent. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The court prohibited the controller from placing tracking cookies on the devices of the data subject and imposed a penalty of €250 for every day they fail to comply with the decision (with a maximum of €25.000). The controller appealed this decision on 30 October 2023. The Court of Amsterdam (“Gerechtshof Amsterdam”) found that tracking cookies were placed by the controller and that the data subject’s personal data was processed in violation of the GDPR. The court therefore prohibited the controller from placing tracking cookies and upheld the imposed penalty of the District Court after the judgement came into effect. In January 2024, the controller voluntarily complied with the penalty of €25.000 before the judgement came into effect. On 17 April 2024, the controller initiated proceedings on the merits at the Amsterdam District Court, because it disagreed with the judgement in the urgency procedure. The controller argued that it did not place the cookies themselves, but that they were placed by third party websites. The controller argued that it did not have factual control or power over the way these websites design their websites and how they ask for consent. They can only contractually obligate these websites to obtain consent. If it appears these third party websites do not obtain consent, the controller can give a written warning. The controller also argued it is factually impossible to comply with the prohibition of the court as it cannot single out the devices of the data subject to stop placing tracking cookies. As the unlawful processing continued, the data subject requested the court to impose a penalty of €1.500 per violation or €5.000 per day the controller continues to place tracking cookies. By complying with the maximum amount of the penalty, the data subject argued that it appears that the business model of the controller is that lucrative that the imposed penalty is an insufficient financial incentive to stop the unlawful processing. Also the fine of 40 million by the French DPA did not change the behaviour of the controller. The court held that the controller already complied with the maximum penalty but paying the the penalty does not release the controller from the duty to comply with the prohibition. The court further held that it is the responsibility of the controller to check whether it complies with the prohibition to place tracking cookies on the data subject's devices. Although the controller made steps in the right direction by writing warnings and ending contracts with websites that did not comply, the prohibition is still not complied with. By paying the maximum penalty, the court held that the controller also knew it was not complying with the imposed prohibition. Therefore, the imposed penalty is an insufficient financial incentive to comply with the judgement and there are sufficient arguments to impose a new and higher penalty. The court also dismissed the argument of the controller that it cannot prevent that tracking cookies are placed on the devices of the data subject and can only comply with the prohibition by not placing tracking cookies at all irrespective of the device. The court held that this argument cannot relieve the controller from its obligation to comply with the judgement. Thus, the court imposed an additional penalty of €500 per day (with a maximum of €50.000) against the controller until it complies with the prohibition of placing tracking cookies on the data subject's devices.
Court case 1 A 217/22 MD
The controller runs a web portal that connects operators of holiday homes to potential guests by allowing the operators to place ads on the portal. To acquire new operators to present their holiday homes the controller advertises their service via phone. They were using the services of a call centre in Kosovo for this purpose. Call centre staff members would search for phone numbers of landlords and operators of hotels and holiday homes and called them. They presented the portal to them and tried to close a contract about a cost free test entry or a “premium entry” on the portal. During the call, the call centre staff asked for data related to the customer and their accommodation. Subsequently, the controller provided the new client with information and a confirmation via e-mail. Persons who said they did not want to be contacted anymore were blacklisted. Following 20 data protection complaints, the Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) got to know about the business practices of the controller and, in particular, that a client will receive more calls after opting for the cost-free test ad on the portal. The DPA then conducted an official hearing of the controller. After the hearing, the Saxony-Anhalt DPA ordered the controller under Article 58(2)(f) GDPR to refrain from the processing of phone numbers and other personal data for the purpose of advertisement if these phone numbers are related to an identifiable natural person. This order included an exception for cases in which the person had either consented to the processing of their data or concrete facts indicate that the person had a factual interest in an advertisement entry on the controller’s page and is awaiting the call or at least would react positively to the call. Furthermore, it ordered the controller under Article 58(2)(g) GDPR to delete all personal data that could not be processed anymore under the aforementioned order. In addition, the DPA ordered the controller under Article 58(1)(a) GDPR to demonstrate to the DPA the compliance with the orders by showing which measures were taken. In case of non-compliance the DPA threatened an administrative fine. The controller appealed this order before the Administrative Court Magdeburg (Verwaltungsgericht Magdeburg – VG Magdeburg). The court dismissed the controller’s appeal. The only possible legal ground for the processing of personal data in this case is Article 6(1)(f) GDPR. But in this case the processing cannot be based on Article 6(1)(f) GDPR. The court held that cold calling might fall out of the scope of application of Article 6(1)(f) GDPR because Article 13(3) of the Directive 2002/58/EC (ePrivacy Directive) in conjunction with [https://dejure.org/gesetze/UWG/7.html#Abs2:Nr1 § 7(2)(1) German law against unfair competition (Gesetz gegen den unlauteren Wettbewerb - UWG)] could be lex specialis. § 7(2)(1) UWG states that advertising by means of a telephone call made to a consumer without his or her prior express consent, or made to another market participant without at least the latter’s presumed consent constitutes an unacceptable nuisance to a market participant and is illegal. However, the court’s decision does not depend on this question since the processing of personal data in this case also fails the balancing test under Article 6(1)(f) GDPR. This is due to the fact that the processing of phone numbers for cold calling purposes fails to match the criteria of § 7(2)(1) UWG which can be taken into consideration. The court dismissed the controller’s argument that German competition law and the GDPR had different purposes and therefore, the DPA should not enforce competition law through the application of Data protection law. The court argued that an overall view would lead to the conclusion that it the cold calling was a uniform process in a way that the processing of personal data has the purpose of illegal cold calling. Therefore, the controller cannot argue that the DPA was not competent to enforce competition law.
CJEU case C-604/22 IAB Europe
The case involves the Transparency & Consent Framework for online advertising, focusing on personal data processing compliance with GDPR, not specific cookie violations.
WetterOnline Meteorologische Services GmbH
The North Rhine Westphalia Consumer Protection Association ([https://www.verbraucherzentrale.nrw/ Verbraucherzentrale NRW]) claimed for an injunction against the use of cookie banners on [https://www.wetteronline.de/ wetteronline.de], a wesite operated by WetterOnline Meteorologische Services GmbH, the controller. The controller used a cookie banner to collect users' consent to not necessary cookies without providing a reject option on the first layer. The data subject could only refuse to give consent by clicking on the “Settings” button to reach the second layer, where they then had an “Accept all” button or a “Save” button. The cookie banner also had an “Accept & Close X” button in the top-right corner, on both first and second level. In a judgement dated 4 May 2023, the Regional Court of Cologne (Landgericht Köln, LG Köln) dismissed the action as it considered the claim of the Association to be too broad and claimed that it could not impose a specific cookie banner design on the controller. The Association appealed against this judgement to the Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) and specified its claim. Firstly, the OLG Köln considered that the controller designed their cookie banner without an equivalent "reject option" either at the first or second layer. The OLG pointed out that the average user does not realise what the “Save” button represents - namely refusal to provide consent for the use of not necessary cookies. Therefore, the OLG decided that consent could not be regarded as freely given and sufficiently informed under Article 4(11) GDPR. Secondly, regarding the “Accept & Close X” button, the OLG considered that the “X” symbol is known to users as a way to close a window, but not to consent to the use of cookies. The average user would not be aware that this constitutes consent, even if the “Accept & Close” is located directly next to the “X” symbol. The OLG also noted that it was not easy for data subjects to recognize that the “Accept & Close” and the “X” symbol were one and the same button. Therefore, the OLG considered that this could not be regarded as unambiguous under Article 4(11) GDPR. With regard to these infringements, the OLG therefore ordered the controller to refrain from using such a cookie banner design and make sure that the banner includes a reject option equivalent to the accept option.
A Pakistani national, the plaintiff
A Pakistani national residing in Germany (the data subject) is suspected of having killed a person together with his brother and other persons in Pakistan, where he is wanted by warrant. This created an alert on the Schengen Information System (SIS) stating that he should be denied entry into the Schengen zone. The data subject upon travelling to Italy was arrested at the border to be extradited to Pakistan. Pakistan however, failed to submit an extradition document despite Italy's requests. Therefore, the arrest was revoked by the Italian Court of Appeal in Brescia. Based on this, the data subject argued that he was now innocent and requested the deletion of the alert on the SIS system under Article 17(1)(d) GDPR.This is because Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system refers to the GDPR and allows data subjects to invoke their rights under it, even if they are not for example an EU national. The reason for the data subject invoking the GDPR is that Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system, refers to the GDPR and allows data subjects to invoke their rights under it when their data is processed by the system. The Federal Police Headquarters of Germany rejected the request for deletion multiple times. The alert was lawful and according to national law, data of foreigners who are the subject of an alert for refusal of entry can be stored on the basis of public safety. The voiding of the arrest warrent in Italy could not be held to override this public safety. The extradition had failed for formal reasons rather than because the data subject was innocent. The arrest warrant issued by Interpol Pakistan had not been withdrawn and therefore, there was still a valid reason to hold the alert in the SIS system. The data subject appealed the decision to the German Court in Potsdam arguing, among other reasons, that his rights had been infringed and that the data should be deleted because it had been unlawfully processed. The court held that the data subject's request was unfounded and dismissed it. The requirements of Article 17(1)(d) GDPR are not met as the data was processed lawfully. First, data processing is only unlawful if there is neither the consent of the data subject nor any other legal basis for it. In this case, the Federal Police Headquarters has a legal basis under the Federal Police Act. This Act states that Member States shall keep an alert if the prescence of a third-country national constitutes a threat to public safety. There is a threat to public safety if there are reasonable grounds to suspect that a third-country national has committed a serious criminal offense. Second, the Court on the facts decided that there were reasonable grounds to suspect that the applicant was involved in a murder in Pakistan (a serious criminal offence). The warrant issued by Pakistan sufficiently individualises the data subject, substantiates the accusation with the time of the crime, the place of the crime, the victim and witnesses and therefore, justifies the conclusion that the suspicion in the data subject's case is well-founded. Third, there is no legal obligation on the Federal Police Headquarters to question the facts of the arrest warrant in Pakistan. The assumption of a threat to the public is based on an "individual assessment" by the Member State. When determining whether there is reasonable suspicion and thus a threat to public order, the authority has a broad scope of discretion.
Telekom Deutschland GmbH
The case involves the unlawful transfer of personal data to US-based companies through cookies without proper consent.
Garante per la protezione dei dati personali
The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under [https://www.garanteprivacy.it/codice Article 154(1)(d) of the Italian Privacy Code] the mentioned data processing operations due to a breach of [https://www.garanteprivacy.it/codice Articles 2, 3, 11, 23, 24 and 26 of the Code]. The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of [https://www.gazzettaufficiale.it/anteprima/codici/codiceCivile Article 41 of the Civil Code], [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the European Charter for Fundamental Rights], [https://www.garanteprivacy.it/codice Articles 13, 23, 26 of the Italian Privacy Code], as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative. The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked. Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subjects had to give their consent freely for a specific data processing and that information on the data processing had to be provided on the basis of [https://www.garanteprivacy.it/codice Article 13 of the (now updated) Italian Privacy Code]. Therefore, because the data subjects were able to recognize the algorithm and the data processing, which was described to them by the appellant in an unambiguous and specific way, the Supreme Court repealed the judgment by the Court of Rome. Thus, it also found that it was not necessary to consider the third reason brought by the appellant.
Court case 33 Cdo 347/2023
The case focused on billing disputes and data retention obligations, not related to cookies or consent.
Garante per la Protezione dei Dati Personali
On 10 June 2021, the Italian DPA issued a €2,600,000 fine against the defendant, a delivery company, for unlawfully processing personal data of platform workers. The defendant appealed this decision to the Ordinary Court (Court). The Court annulled the decision of the DPA because although the decision was legitimate in terms of the violation found, the DPA's decision of the sanction was not. The Court found that the fine imposed by the DPA amounted to 7.29% of the defendant's turnover - significantly higher than the 4% parameter mentioned in Article 83(5)(a) GDPR and even higher than the average percentage (0.0019%) applied by the DPA to other sanctioned entities. Thus, the Court annulled the decision, without, however, modifying the amount of the sanction as the Court stated to not have this power under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2011-09-01;150~art6 Article 10 of Legislative Decree No 150 of 2011]. The Italian DPA appealed this decision to the Italian Supreme Court. The main issue addressed by the Italian Supreme Court and brought by the DPA is the infringement or misapplication of Article 83 GDPR and [https://garanteprivacy.it/web/guest/codice Article 166 of the Italian Privacy Code], given that the sanction imposed was compliant with the provisions. The Supreme Court reiterated that Article 83 GDPR regulates the general conditions for imposing administrative sanctions, and each supervisory authority shall ensure that the administrative fines imposed are ‘in each individual case’ effective, proportionate and dissuasive. To be determined based on certain elements listed in Article 83(2) GDPR. The Supreme Court further noted that in the case of an intentional or negligent breach of several provisions of the GDPR, Article 83(3) GDPR requires that the maximum penalty shall not exceed ‘the amount specified for the gravest infringement’. In this perspective, the amount is set out in paragraphs 4 and 5 of Article 83 GDPR. Both present two types of administrative fines as alternative sanctions. Respectively, an ordinary penalty of up to €10,000,000 or a proportional one of up to 2% of the annual turnover and up to €20,000,000 or 4% of the annual turnover. The Supreme Court clarified that the second type of proportional fine (2% and 4%) does not aim to mitigate the amount provided by the ordinary penalty (€10,000,000 and €20,000,000). Instead, the percentage is to be used when it determines a higher penalty than the ordinary one. As can be easily deduced from the final phrase of the provision, "whichever is higher". According to the Supreme Court, this reasoning was completely omitted by the Court. It added that the Court also did not consider that the defendant’s annual turnover worldwide in 2019 amounted to €35,654,375. This means that the sanction did not exceed the maximum permissible penalty under Article 83 GDPR since it was lower than €20,000,000. In addition, regarding the statement by the Court asserting that the sanction was unlawful because it allegedly exceeded the average percentage applied in other cases, the Supreme Court noted that it did so without specifying which other instances it was referring to. The Supreme Court further assessed the Court's statement of not having the power to modify the amount of the sanction under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2011-09-01;150~art6 Article 10 of Legislative Decree No 150 of 2011]. The Supreme Court ruled that the article read with [https://garanteprivacy.it/web/guest/codice Article 166 of the Privacy Code] leads to the assertion that even in disputes concerning personal data, the Court may annul all or part of the decision as long as the amount is not less than the minimum penalty. In light of the above, the Supreme Court approved the Italian DPA’s appeal.
The plaintiff in this case is a German Consumer Protection Association (Verbraucherzentrale Bundesverband e.V.), while the defendant is LinkedIn Ireland Unlimited Company, an Irish social media company operating throughout the EU and worldwide. The plaintiff found that the website of the defendant makes use of cookies and other technologies like fingerprinting that automatically process personal data and monitor users behavior for analytics and marketing purposes. In its privacy notice of 2018, the defendant clearly stated that it ignores “do not track” (DNT) signals on its users’ browsers. DNTs are a browser setting that users can decide to activate, to request websites not to track their online activities. The defendant claimed it would not react to DNT signals, as there was no established “DNT standard” yet. Firstly, the plaintiff claimed that the use of DNT signals constitutes an expression of the right to objection of users under Article 21(5) GDPR against processing activities carried out for marketing purposes under Article 6(1)(f) GDPR, and that the defendant should stop ignoring such signals as doing so constitutes an unfair commercial practice. Secondly, the plaintiff found that when a user decides to first set up a LinkedIn account, the “off-LinkedIn visibility” option is usually pre-activated, which means that personal data of users is shown on the defendant’s partner websites. This, according to the plaintiff constituted a violation of Article 6(1)(a) GDPR, Article 25(2) GDPR, third sentence and Article 4(11) GDPR as well as provisions of the German Federal Law against deceptive commercial practices ([https://www.gesetze-im-internet.de/uwg_2004/ Bundesgesetz gegen unlauteren Wettbewerb, UWG]). Further, the plaintiff asserted in this respect that the defendant wrongfully relied on Article 6(1)(f) GDPR as a legal basis and acted contrary to Article 5(1)(a) GDPR and Article 5(1)(c) GDPR. After the defendant rejected the plaintiff’s warning letter, the plaintiff brought an action before the LG Berlin under Article 79(2) GDPR. The LG held the action to be partially inadmissible, as the court considered the first claim to be too broad, since it lacked the description of a concrete infringement, which could then not be established. However, the court held that the initially unclear first claim of the plaintiff that the defendant should stop communicating to its users that it ignores DNT signals and does not consider it as an objection under Article 21(5) GDPR, was substantiated by an attached screenshot and thus concerned a concrete violation. The court held that this behaviour constituted an unfair commercial practice under the UWG. Further, the court agreed with the plaintiff that the use of a DNT signal constitutes an objection by automated means using technical specifications for the purposes of Article 21(5) GDPR. As regards the submission of the defendant that it does not consider DNTs as objections because there is no established standard about them yet, the court held that this is irrelevant to the question whether an objection is valid or not. As a consequence, the court found that the decision of the defendant to ignore DNTs constitutes a deceptive practice. As regards the second claim, the court held that the plaintiff was right in asking the defendant to refrain from automatically activating the “off-LinkedIn visibility” setting. By leaving the option pre-ticked, the defendant deceives the users as to their consumer right to decide whether or not they want their data to be accessible to the public, in particular to third party websites. In this way, the average users are deceived as they may think they gave consent to have the option activated, even though it is likely that users would not activate this option themselves if it wasn’t pre-ticked. The court further held, making reference to CJEU case C-673/17 - Planet49, that the pre-ticked option offered by the defendant cannot constitute a valid consent. The LG hence ordered the defendant to refrain from communicating to its users that it does not consider DNTs as an objection to processing and to deactivate the automatic “off-LinkedIn visibility” setting when users first set up an account.
Magdeburg Administrative Court
This judgement stemmed from an appeal against a decision of the Magdeburg Administrative Court. In the original proceeding, the applicant challenged the procedure for the election of the data protection commissioner for the German state Saxony-Anhalt. According to the applicant - a candidate for the same position - the election procedure was not transparent and thus contravened to the requirements set forth in Article 53(1) GDPR. In particular, the data protection commissioner was appointed under state law by the regional Parliament. Members of the parliamentary groups could make proposals but there was no mandatory public call for applications. Furthermore, the applicant stressed that Article 54(1)(c) GDPR establishes an obligation for all EU Member States to put in place a law to provide more legal clarity about the election procedures of the heads of the DPAs. The applicant asked the court to temporarily block the election procedures and refer the case to the CJEU, in order to check whether the principle of transparency was respected. The court of first instance rejected the claim. Therefore, the applicant appealed the decision before the Higher Administrative Court of Saxony-Anhalt (Oberverwaltungsgericht Sachsen-Anhalt - OVG Sachsen-Anhalt). The court found that the applicant's appeal was inadmissible. The court held that the applicant was not eligible to bring such a claim because there was no subjective rights involved. Article 53(1) GDPR establishes requirements which are in the public interest and they cannot be invoked by an individual. Incidentally and without delving into the merits, the court also noted that offices at state level have staff chosen through democratic elections by voters or indirectly by other electoral bodies. The court stressed how the procedure designed by the state law does not jeopardise transparency, as it is immediately clear which names are proposed and by whom. Moreover, the election by a parliamentary assembly is explicitly envisaged by the GDPR in Recital 121.
Court case 93 O 167/20
Plaintiff is the umbrella organization of the consumer advice centers in Germany. Defendant is a media company. The media company integrated about 18 third-party-cookies on its website like Double Click from Google. They relied this on Art. 6 (1) (f) GDPR. The company did not implement any information about that on their start page and linked to the privacy policy not before implementing and analyzing the cookies. These cookies enabled profiling via tracking across different platforms. The plaintiff sent a warning on 20 June 2019 which the defendant declined on 14 August 2019. The defendant implented in August 2019 an opt-in cookie banner and changed their privacy policy. The plaintiff is of the opinion that there is no legitimate interest of the defendant and neither the weighting up would turn out in favor of the defendant. The plaintiff criticizes the insufficient information and continues that the incorrect legal basis leads to the false imagination that it is allowed to implement cookies without consent. The defendant is of the opinion that it is necessary because they otherwise would not be able to implement their offers on their website free of cost and also the cookies were set by third parties. The court is of the opinion that browser settings allowing a transfer of data are no active consent for lack of a deliberate decision of the affected persons. Further the court held that the setting of cookies from third parties is attributable to the defendant as they were payed for that. The court does not follow the opinion of the defendant that the freedom of press includes the advertisement as there is a certain part of jounralistic work needed for Art. 85 GDPR.