Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
55 results · Showing 1–20
KFC Restaurants Spain, S.L.U.
In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website. The data subject claimed that the privacy information applicable to users in the EEA was not easily accessible, as the main privacy link led to a global policy. The data subject also alleged that users could not create an account without apparently accepting promotional communications, that the registration form did not correctly link to the privacy policy and that the controller had not appointed a data protection officer. The complaint further identified deficiencies in the privacy information, including insufficient details about the identity of the controller, recipients, international transfers and retention periods. During the investigation, the controller acknowledged that certain links and checkbox descriptions had been incorrectly configured and undertook to correct them. It maintained, however, that its privacy information was provided through several interconnected documents and that it was not required to appoint a DPO. According to the controller, it did not engage in profiling, its marketing communications were based on opt-in consent and the processing of personal data was ancillary to its restaurant business. The DPA found that the information provided on the website was excessively generic and did not comply with Article 13 GDPR. It imposed a €5,000 fine and ordered the controller to bring its website into compliance. The DPA also concluded that the controller’s processing activities required the appointment of a DPO under Article 37(1)(b) GDPR. It imposed a further €20,000 fine and ordered the controller to appoint a DPO. The controller appealed both the sanctioning decision and a subsequent resolution requiring it to demonstrate that it had implemented corrective measures. The Court dismissed the appeal and upheld the total fine of €25,000. Regarding Article 13 GDPR, the Court found that the controller’s privacy information was excessively generic and did not clearly explain the purposes, legal bases and relevant circumstances of the processing. It also held that the DPA was not limited to investigating only the exact issues identified in the initial complaint. The €5,000 fine was proportionate despite the controller’s subsequent corrective action. Regarding Article 37(1)(b) GDPR, the Court held that the controller was required to appoint a DPO. Although its primary business was the provision of restaurant services, the processing of customer data was inseparable from its online ordering, marketing, loyalty and customer-management activities. The processing also involved regular and systematic monitoring, as the controller continuously collected data such as customer preferences, browsing history, IP addresses, cookies and geolocation for commercial and operational purposes. Considering the number of data subjects, the volume and variety of data, the duration of the processing and its nationwide scope, the Court concluded that the processing was carried out on a large scale.
Court case 4 U 353/24
The controller is a company that operates several social media platforms, as well as software products grouped under the term “Business Tools“. Third parties can integrate the Business Tools into their websites and apps (subject to the controller’s Terms of Use) to track data subjects and display personalised advertising on data subjects’ social media platforms. Third parties process data subjects’ personal data (such as their IP address, operating system or time zone) and transfer this data to the controller. The data is processed regardless of whether the data subject is logged into one of the controller’s platforms. The business tools are used on a wide range of high-traffic websites and related apps. A data subject (who uses the controller’s platform for personal purposes) filed a claim with the Regional Court of Stuttgart. The data subject requesting the court to order the controller to stop processing their data through third party websites and apps, provide them with full access to their data, erase said data after providing complete access and pay the data subject a minimum of €5,000 in non-material damages. The Regional Court dismissed the claim, on the grounds that the data subject had not provided sufficient evidence to substantiate their claims. In addition, the court considered that the data subject actions were contradictory, as it demanded the controller to cease processing personal data while not accepting cookies. The court stated that the request for the erasure (Article 17 GDPR) and restriction (Article 18 GDPR) of the data subject’s data were not compatible with the injunction sought by the data subject. Finally, the court considered that the controller had provided the data subject with access in accordance with Article 15(1) GDPR. The data subject appealed the decision to the court. The data subject argued that the injunction against future data processing was justified, because the data is automatically transferred to the controller by third parties. Furthermore, the lower court interpreted the erasure and restriction requests too narrowly. Finally, the data subject argued that the “self help tool” of the controller did not fulfil their request for access. On the other hand, the controller argued that the data subject had not provided evidence on how third parties processed their data. The claim was also too vague and unfounded, as the data subject had not yet decided whether to consent to their data being processed for advertising purposes or pay an ad-free subscription (this is also known as “Pay or Okay”). According to the court, it must be assumed that the data subject visited websites that implemented the controller’s business tools, and therefore the data subjects’ data was collected and transferred to the controller. The data subject claimed this in general terms and specified it in relation to individual websites in the second instance; the court considered that the general claim in the first instance was sufficient to substantiate the data subject’s claims, including demonstrating that their personal data was unlawfully processed. The court also stated that the individual websites were responsible for obtaining data subject’s consent to process their data and transfer it to the controller. The court considered the controller and website operators as joint controllers, in accordance with CJEU case law.See C-40/17 (Fashion ID), margins 79, 81, 85, 102 However, as a joint controller, the company operating the social media platforms bore the burden of proof in demonstrating that the data subject consented to the processing. The court partially upheld the data subject’s claims. == The court dismissed three of the data subject’s claims on procedural grounds. First, the court dismissed the data subject’s request to declare that the user agreement did not allow the controller to process the data subject’s data through third parties. The court stated that it could bring an injunction and not a request for declaratory judgment. The court also dismissed the data subject’s request to order the controller to cease processing personal data on third party websites and apps without a legal basis (consent or legal bases under Articles 6(1)(b) to (e) GDPR). The court dismissed the data subject’s injunction claim for data erasure (Article 17 GDPR). According to the court, Article 17 GDPR does not grant a right to injunctive relief. However, the GDPR does not preclude national law from allowing these claims (e.g. Sections 823 and 1004 of the German Civil Code). In this case, however, the court considered that the controller lacked the conditions under national law to be liable for injunctive relief; specifically, the court considered the fact that the controller developed the business tools insufficient to consider that it had directly violated its obligations as a joint controller under Article 26 GDPR.This reasoning was the opposite to OLG Dresden, judgment of March 12, 2026, 17 U 625/25, p. 56 == The court first upheld the data subject’s request to order the defendant to not delete the processed data (Article 18 GDPR), but did not order the controller to leave the data at the location it is stored. Under Article 18(1)(b) GDPR, the data subject may request to restrict the processing if the processing is unlawful and they oppose the erasure of the data. The court considered that the data processing was unlawful, as the controller stored the data on security and integrity grounds without proving it had a legal basis under Article 6(1)(f) GDPR to do so. Specifically, the controller had not specified why it processed the data for security purposes, why it was necessary, or the storage periods. The court also upheld the data subject’s claim for access to information under Article 15(1) GDPR. The court stated that the controller had deliberately restricted the information provided through its “self help tools”, and had therefore not complied with its information obligations. The court considered these tools as particularly unsuitable to provide information on the processing of data outside the social network. Once this information obligation is fulfilled, the court stated that the controller had the obligation to fulfil the data subject’s request for erasure under Article 17(1)(d) GDPR (if the personal data is unlawfully processed). Finally, the court upheld the data subject’s claim for damages, but reduced it to €500. The claim for damages were well founded, as the controller violated the GDPR, and caused the data subject to suffer damage (loss of control over their data), and there was a causal link between the two.
Court case W171 2305420-1
The data subject visited a news website operated by the controller on 20 January 2021. During the visit, the website set cookies after the data subject interacted with the cookie banner and processed the data subject's personal data. On 11 August 2021, the data subject filed a complaint with the Austrian DPA. The complaint alleged that the controller's cookie banner used dark patterns, did not provide a rejection option on the first layer, and enabled the placement of non-essential cookies without valid consent. The data subject requested that the DPA order the deletion of the collected data, stop the processing and impose a fine. The controller argued that it had deleted the relevant data during the proceedings and that no ongoing infringement existed. It also maintained that the data subject had never submitted an erasure request directly to the controller under Article 17 GDPR. On 28 October 2024, the DPA dismissed the data subject's complaint but, acting on its own initiative, ordered the controller to redesign its cookie banner and stop setting certain non-essential cookies before obtaining consent. The data subject appealed. They argued that the controller had not sufficiently proven the deletion of the data, that tracking activities likely continued, and that the DPA should have ordered the deletion of all data collected after the complaint had been filed. First, the court held that the data subject could not rely on Article 17 GDPR because no erasure request had been submitted to the controller before the complaint was filed. It found that a valid request to the controller is a prerequisite for a complaint concerning the right to erasure. The draft complaint previously sent to the controller did not constitute an Article 17 GDPR request because it primarily challenged the cookie banner and sought intervention by the DPA rather than erasure from the controller. Second, the court accepted that the controller had deleted the personal data collected through the cookies during the administrative proceedings. The court considered the controller's submissions credible and noted that the data subject had effectively acknowledged the deletion. Third, the court rejected the argument that Article 17 GDPR entitled the data subject to an order preventing future processing. The court relied on the judgment of the Court of Justice of the European Union in Quirin Privatbank AG (Case [https://infocuria.curia.europa.eu/tabs/document?source=document&text&docid=303866&pageIndex=0&doclang=DE&mode=req&dir&occ=first&part=1 C-655/23]) and held that neither Article 17 GDPR nor any other GDPR provision grants data subjects a standalone right to obtain a preventive injunction against future processing. Consequently, the controller could not be ordered to refrain from future cookie-based processing under the data subject's erasure claim. Finally, the court held that the request to stop the unlawful processing had become moot because the personal data collected on 20 January 2021 had already been deleted. The court also noted that data subjects do not have a subjective right to require a DPA to adopt a specific corrective measure under Article 58 GDPR. The court therefore confirmed the dismissal of the complaint.
Österreichischer Rundfunk - ORF
On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject, represented by noyb, against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of Article 17 GDPR by the ORF (the controller) as the DPA considered that the controller had deleted the data already. The data subject had also argued that the cookie banner did not offer an equally prominent rejection option on the first layer and that refusing consent was more difficult than accepting it. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of Article 4(11) GDPR. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equally prominent (gleichwertig) choice between "Accept all cookies" and "Only necessary cookies", so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting. The controller appealed this decision on 25 November 2024. It claimed that the DPA’s order regarding the redesign of its cookie banner was unlawful. The controller argued that the authority had exceeded its jurisdiction by making an ex officio decision without informing it first of its intention. Furthermore, the controller argued that the GDPR does not lay down binding rules on the visual design of cookie banners and that the DPA had relied on non-binding guidance and literature rather than legally binding provisions. Regarding the DPA’s jurisdiction in issuing the ex officio order for the modification of the controller’s cookie banner, the court held that this was permissible, both under Article 58(2)(d) GDPR and relevant CJEU case law, irrespective of whether the proceeding was initiated by a data subject’s complaint. The court maintained the position that when a DPA notices GDPR violations during its investigation, it is in its powers to adopt on its own initiative the appropriate measures to remedy the identified infringements. The court rejected the controller’s argument that its procedural rights were violated. It further stated that the controller was given the opportunity to comment on the ex officio matter and found that a lack of impartiality on the part of the DPA could not be established. Regarding the DPA’s order of redesign of the controller’s cookie banner, the court first noted that it had to assess whether the cookie banner allowed users to give valid consent within the meaning of Article 4(11) GDPR. It emphasised that consent requires a freely given, specific, informed and unambiguous indication of the user’s wishes and that, under Article 7(1) GDPR, the controller must be able to demonstrate that such consent was obtained. The court examined its latest version which had not changed since the DPA’s decision. It found that the controller’s website was designed is such a way that, when the site was accessed, a pop-up window opened and on this, there were three buttons: “Cookie Preferences”, “Only Necessary Cookies” and “Accept All Cookies” and users could not navigate through the website without selecting one of these options. The court noted that the buttons had the same size but different colour scheme. While the first two buttons displayed blue text on a white background and appeared less prominent against the light grey pop-up background, the “Accept All Cookies” button displayed white text on a blue background and was therefore visually highlighted through stronger contrast The court confirmed the DPA’s decision that the controller’s cookie banner, including the consent request, had been designed in a such a way that the "Accept all cookies" button would stand out due to its colour scheme, especially compared with the other buttons that were visually less prominent. The court agreed that the visual emphasis placed on the “Accept All Cookies” button nudged users towards consent. Furthermore, it pointed out that a design steering users towards the more invasive option was in violation of the principle of transparency. The court rejected the controller’s argument that the absence of detailed binding provisions on cookie banner design made the DPA’s order unlawful. The issue was not whether the GDPR prescribed a specific design, but whether the design of the banner allowed users to make a free and genuine choice. Consequently, the court upheld the DPA’s order and dismissed the controller’s appeal as unfounded.
Criteo
In 2023, the French Data Protection Authority (CNIL) fined Criteo, an advertising company (the controller), €40,000,000 for breaches of the GDPR related to the processing of browsing data through cookies for the purpose of placing personalised advertisements. The decision followed complaints lodged by Privacy International and noyb. The DPA found violations of Article 26(1) GDPR and Article 26(2) GDPR based on the lack of a joint controllers' agreement with its partners, Article 7(1) GDPR by processing user data without consent, Article 7(3) GDPR and Article 17 GDPR by failing to erase data subjects’ personal data based on their requests, and Article 12 GDPR, Article 13 GDPR, and Article 15 GDPR by failing to inform data subjects of the processing of their personal data. The controller appealed the decision asking for its annulment or, alternatively, the reduction of the fine. First, the Council of State (the court) held that the controller processed personal data since the identification of individuals would not be technically impossible based on the very large amount of information, sometimes very precise, collected and cross-referenced for a given identifier assigned to each data subject. Secondly, the court noted that the controller did not contest the DPA’s findings regarding the lack of a joint controllers' agreement. Thirdly, it found that the DPA’s conclusion regarding the violation of Article 7(1) GDPR did not disregard the principles of legality of offenses, presumption of innocence and exclusion of liability for others in criminal matters. Fourthly, it dismissed the argument that the contested decision was based on error of fact and assessment regarding the information provided to data subjects on the purposes for which their data were processed. Finally, the court noted that the controller could not rely on legitimate interest for continuing to process the data of data subjects who requested their erasure. Therefore, the court dismissed the controller’s appeal.
ANSPDCP
A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him for the placement of optional cookies onto users’ devices when visiting his website, as well as for failing to inform data subjects of the processing of their personal data via the contact form available on the website. The DPA sanctioned the controller a total of RON 50,286.80 (approximately €10,000) for breaching Article 4(5)(a) & (b) Romanian Law no. 506/2004 transposing e-Privacy Directive 2002/58 and Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The controller claimed in its appeal that, among other things, the DPA failed to include in its decision the complete mandatory information prescribed by administrative law, that the cookies placed on the users’ devices were necessary, and that data subjects were informed of the processing activities on the website. Therefore, the controller requested the annulment of the DPA decision. The court dismissed the controller’s appeal. It found that the website links directing to the privacy policy and information notice were not functional, but that they became functional following communications from the DPA to the controller. Furthermore, the court noted that website users did not have a clear and visible way of providing consent to the use of cookies on the website. Moreover, the court found that the DPA decision contained most of the necessary information required by law. The court noted that the missing information referred only to the objections of the controller. However, the court emphasised that such an omission did not require the annulment of the DPA decision, since the controller was able to raise his objections during the appeal. Finally, the court emphasised the electoral context in which the violations occurred, pointing out that the increased danger for the unlawful processing of the personal data collected via the website at that time. Therefore, the court dismissed the controller’s appeal and maintained the DPA’s decision in the case.
Court case 6 U 81/23
The controller placed cookies on the data subject’s terminal equipment and processed the resulting data for advertising purposes without obtaining the data subject’s consent. The personal data concerned included, in particular, the data subject’s IP address and a cookie identifier. The data subject brought an action before the Regional Court (LG Frankfurt), seeking an injunction and compensation for non-material damage. The controller argued that the data subject had knowingly triggered the processing and that the data were only processed in aggregated and pseudonymised form. The controller further contended that the data subject could have deleted the cookies from his device at any time. The Court rejected these arguments and granted an injunction and awarded damages of €1,500 to the data subject. The controller subsequently appealed the decision to the OLG Frankfurt. The Court partially upheld the lower court's decision. The court held that the controller could not rely on the fact that the data subject was technically able to delete cookies from his terminal equipment. The lawfulness of processing depends on the existence of valid prior consent, not on the data subject’s ability to mitigate the effects of unlawful processing after the fact. The Court further clarified that the burden of proof for demonstrating valid consent rests with the controller. Accordingly, the controller’s argument that the data subject had failed to show that he did not consent was dismissed as irrelevant. With regard to damages, the court found that the infringement did not result in a significant loss of control over personal data, as the data subject was aware of the processing and the personal data at issue (IP address and cookie ID) were not particularly sensitive. Nevertheless, the court held that the storage and processing of cookies for advertising purposes without consent gave rise to a feeling of being monitored, which amounted to non-material damage. Given that the impairment suffered by the data subject was minor, the Court considered an award of €100 in non-material damages under Article 82 GDPR to be appropriate.
Meta Platforms Ireland Limited
The case was about unlawful processing of personal data for advertising without a valid legal basis, not specifically about cookie or consent banner violations.
Court case C/10/677340 / HA ZA 24-317
Criteo placed tracking cookies on users' devices through third-party websites without obtaining prior consent.
Inteligo Media SA
Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service). On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose. The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court. In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: #In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free daily newsletter: ##(a) is that email address obtained by the publisher of the online news publication “in the context of the sale of a product or a service” within the meaning of Article 13(2) of Directive 2002/58 ('e-privacy Directive')? ##(b) is the transmission by the news publisher of a newsletter such as that described in the abovementioned point (ii) carried out “for direct marketing of its own similar products or services” within the meaning of Article 13(2) of [Directive 2002/58]? #If the answers to Question 1(a) and (b) is "yes", which of the conditions laid down in Article 6(1)(a) to (f) of [the GDPR] apply when the publisher uses the user’s email address for the purpose of sending a daily newsletter [...], in accordance with the requirements of Article 13(2) 'e-privacy Directive'? #Does Article 13(1) and (2) 'e-privacy Directive' preclude national legislation which uses the concept of “commercial communication” laid down in Article 2(f) of [Directive 2000/31/EC] instead of the concept of “direct marketing” laid down in the 'e-privacy Directive'? If not, does a newsletter [...] constitute a “commercial communication” within the meaning of Article 2(f) of [Directive 2000/31]? #If the answers to Question 1(a) and (b) are in the negative: ##(a) does the transmission via email of a daily newsletter[...] constitute “use … of electronic mail for the purposes of direct marketing” within the meaning of Article 13(1) 'e-privacy Directive'? ##(b) must Article 95 GDPR, in conjunction with Article 15(2) 'e-privacy Directive', be interpreted as meaning that failure to comply with the conditions for obtaining valid consent from the user pursuant to Article 13(1) 'e-privacy Directive' will be penalised in accordance with Article 83 GDPR or in accordance with the provisions of national law contained in the act transposing the 'e-privacy Directive', which contains specific penalties? #Must Article 83(2) GDPR be interpreted as meaning that a DPA which decides whether to impose an administrative fine and decides on the amount of the administrative fine in each individual case is obliged to analyse and explain in the administrative act imposing the fine the effect of each of the criteria laid down in points (a) to (k) on the decision to impose a fine and, respectively, on the decision regarding the amount of the fine imposed? = # The newsletter constitutes direct marketing # Article 13(2) 'e-privacy Directive' is lex specialis to Article 6(1) GDPR # The DPA must not necessarily explain all criteria in Article 83(2) GDPR when imposing fines = The AG summarized that the referring court seeks to ascertain, in essence, whether it can be considered that a user’s email address obtained when he or she creates an online account entitling them to free access to a number of articles/resources and to receive, by email, a daily newsletter, is obtained ‘in connection with the sale of a product or a service’ and whether the transmission of the daily newsletter constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of Article 13(2) 'e-privacy Directive'. The AG considered CJEU, C-484/14, McFadden, opining that the Personal update pursued an advertising purpose which in turn constitutes an indirect form of remuneration which satisfies the CJEU’s definition of a ‘sale’. Thus, the AG opined that Article 13(2) 'e-privacy Directive' must be interpreted as meaning that a user’s email address obtained when he or she creates an online account entitling him or her to a 'Personal Update' such as the one in question constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of that provision. = The AG opined, that Article 95 GDPR establishes the principle lex specialis derogat legi generali for the relationship between that directive and the GDPR: whenever there is a specific provision in Directive 2002/58 entailing obligations with the same objective as corresponding provisions in the GDPR, it is the provision 'e-privacy Directive' which must be applied. The AG held, that Article 13(2) 'e-privacy Directive' comprehensively governs the conditions and purposes of the processing as well as the rights of the data subject and imposes ‘specific obligations’ on the controller, within the meaning of Article 95 GDPR including specifically the question of consent. As a consequence, the AG found, that recourse to the GDPR, in particular Article 6(1)(a) to (f) GDPR, is neither possible nor necessary. = The AG considered the question, if Article 13(1) and (2) 'e-privacy Directive' precludes transposing national legislation which replaces the term ‘direct marketing’ with the term ‘commercial communication’, as defined in Article (2)(f) of Directive 2000/31 to be hypothetical with respect to the case at issue and therefore inadmissible. The AG opined that, commercial communication has a wider scope that encompasses the concept of direct marketing; thus all direct marketing constitutes commercial communication, but not all commercial communication constitutes direct marketing. = The AG summarised the question as to whether, when a DPA imposes an administrative fine, it is required to analyse and explain in the administrative act concerned the impact of each of the criteria provided for in Article 83(2)(a) to (k) GDPR. Since that question refers to the eventuality that the GDPR is applicable to the present case, the AG responded only in case that the CJEU should decide contrary to his Opinion above. The AG concluded, that as long as an individual can understand the grounds of the individual measure adversely affecting them, the obligation springing from the principle of respect for the rights of the defence) of the administration to state reasons for a decision which are sufficiently specific and concrete is complied with, without it being necessary to go into detail regarding each of the criteria listed in Article 83(2) GDPR. = == The Court referred to its existing case-law when explaining the concept of communications ‘for the purpose of direct marketing’. It highlighted that the concept covers communications which pursue a commercial purpose and are addressed directly and individually to a customer (Case C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz, para 47, available here), such as advertising messages promoting services in the form of emails sent to the user’s inbox. The Court held that the communication was intended to entice users to access the paid content provided by the published, thus promoting the sale of that content and pursuing a commercial purpose. Lastly, the Court emphasised that, by being ‘directly displayed in the inbox’ of the recipient, the newsletter qualifies as direct marketing. Therefore, the Court held that a newsletter containing a summary of articles on new legislation, hyperlinks to those articles and to content available for a fee, sent directly to the email inbox of a user constitutes a use of electronic mail ‘for the purposes of direct marketing’ within the meaning of Article 13(1) and (2) Directive 2002/58/EC (e-Privacy Directive). == The Court referred to the Advocate General’s Opinion when discussing the definition of a ‘sale’. It noted that the term covers only transactions involving payment. At the same time, it emphasised that Article 13(2) e-Privacy Directive does not distinguish between the type of services provided. Therefore, the Court applied the reasoning for the concept of services under Directive 2000/31 to the interpretation of Article 13(2) e-Privacy Directive. Specifically, the Court reiterated that remuneration of a service does not require that payment is made by those for whom the service is performed. Thus, the Court held that the cost of advertising paid content through the newsletter is included in the price of that content, meeting the requirement of payment and falling within the concept of ‘a sale of … a service’ under Article 13(2) e-Privacy Directive. = The Court noted that Article 13(2) e-Privacy Directive imposes specific obligations on the controller for the processing activities carried out on personal data in the context of a communication falling within its scope. At the same time, Article 95 GDPR and recital 173 exclude the application of the Regulation to matters which are already subject to specific obligations under the e-Privacy Directive. Therefore, the Court held that the lawfulness of the processing of personal data in relation to a communication within the scope of Article 13(2) e-Privacy Directive can be established based on that provision without applying the conditions in Article 6(1) GDPR as well. = The Court held that there was no need to give an interpretation to the concept of ‘commercial communication’ since the newsletter falls within the concept of ‘direct marketing’. = The Court held that there was no need to answer point (b) of the fourth question and the fifth question.
Der Standard
Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked. The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR. In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban. The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a processing ban. The Court first stated that personal data was processed when the data subject visited the controller’s website, in agreement with the reasoning of the DPA. Recording the preferences of the data subject’s consent through a TC stringA TC string is a "combination of letters and characters which encodes and records user preferences through consent management platforms (CMPs), when they visit a website or app. The TC String is then shared with ad platforms and other participants of the ad-tech ecosystem". For more information, see https://privacymatters.dlapiper.com/2024/03/cjeu-ruling-clarifies-data-protection-and-e-privacy-issues-in-the-ad-tech-space/ falls under the definition of personal data according to Article 4(1) GDPR and CJEU case law.C-673/17, para. 45, 67; ECJ 07.03.2024, C-604/22 para. 50 The Court then stated that the data processing under the “Pay or Okay” model does not fall under the definition of media privilege. The GDPR allows for derogations in its provisions in cases where it is necessary to reconcile the right to data protection and the right to freedom of expression and information. However, processing personal data through cookies could not be considered processing for journalistic purposes, as it does not in itself contribute to a debate of general interest. According to the Court, this was the case even if the processing finances the working framework for journalists. Finally, the Court agreed with the reasoning of the DPA that the controller could not argue that the processing was exclusively for journalistic purposes, as it was also not fully aware of the data transferred to social media platforms or its use. In terms of the granularity of consent and the “Pay or Okay” model, the Court first noted that the DPA is not bound by previous legal opinions. The Court found a violation of Article 6(1)(a) GDPR, as consent was not granular; the data subject did not have the option of consenting to a specific processing purpose, but instead could only give a blanket consent to the controller’s processing. This is supported by EDPB Guidelines,See EDPB, 'Guidelines 05/2020 on consent under Regulation 2016/679', 4 May 2020 (Version 1.1) (available https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) and EDPB, 'Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms', 17 April 2024 (available https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf). which state that in consent or pay models data subject should be able to choose which individual purposes they wish to consent to, rather than only having the option to consent to a bundle of all processing purposes. The Court dismissed the controller’s argument that the purposes of optimising the website and advertising were closely connected. Therefore, the data subject’s consent was not valid. The Court saw no need to consider the other legal bases under Article 6(1) GDPR, as the controller cannot retroactively invoke another legal basis when consent is not valid. Finally, the Court upheld the decision of the DPA in rejecting a processing ban. The Court noted that the data subject does not have the subjective right to a specific remedy, and that the DPA had correctly rejected the request to issue a processing ban.
Meta Platforms Inc.
The Federal Press Office operated a fan page on the social network Facebook, provided by Meta Platforms Inc., where it provided information about current political activities of the Federal Government. When users visited the page, cookies could be placed on their end devices. In 2023, the Federal DPA (BfDI) prohibited the Federal Press Office from operating its fan page because the design of the cookie banner used by Meta was not GDPR compliant. It held that the Federal Press Office was regarded a joint controller, together with Meta, responsible for ensuring that the data processing regarding cookies was based on a sufficient legal basis such as consent. Therefore, not only Meta, but also the Federal Press Office, as the operator of the fan page, was legally obliged to obtain the consent of the respective visitor. Both the Federal Government and Meta appealed against the DPA's decision addressed to the Federal Press Office before the court of first instance (Cologne Administrative Court-VG Cologne). The court held that under the GDPR, Meta and the Federal Press Office were not joint controllers for the contested data processing. Meta was solely responsible for obtaining the consent of visitors of the fan page for the placement of cookies. It ruled that the Federal Press Office's contribution to the storage and reading of cookies was limited to the operation of the page. In particular, the Federal Press Office could not specify any parameters for the placement of the cookies and the analysis of the data collected. In the opinion of the court, the mere facilitation of data processing does not constitute the necessary joint determination of the means of data processing. Consequently, the Press and Information Office of the Federal Government was permitted to continue operating its Facebook fan page.
Data Subject versus Social Media Platform Operator
The social media platform was accused of tracking users through embedded Business Tools without consent, violating cookie consent requirements.
IAB Europe
IAB Europe (“IAB”, short of Interactive Advertising Bureau) is an association of undertakings active in the field of digital advertising such as publishers, ecommerce and marketing companies and intermediaries, including major international players such as Microsoft and Google. IAB is established in Belgium and operates on a European level. IAB developed the “Transparency & Consent Framework” (“TCF”). The purpose of the TCF is to make the processing of personal data for online advertising compliant with data protection requirements. To this end, the TCF provides a set of technical standards and rules (in the form of contractual obligations) for companies in the sector. In particular, the TCF specifies how publishers, advertisers, and intermediaries should use the OpenRTB protocol, a widely used Real Time Bidding (“RTB”) system. RTB consists in the instant and automated online auction of users profiles for the purpose of selling and purchasing advertising space online. When an internet user visits a webpage where advertising space is available, the server sends the user’s data to a platform where advertisers automatically and instantly place bids. Advertisers place their bids based on some characteristics of individual users visiting the page (such as their location, marketing profiles, and browsing history). The bid winner displays their customer's advertising in that specific advertising space. The whole process involves a mass exchange of personal data. For this operation to be possible, users are (in principle) asked to express their advertising preferences when they first visit a publisher’s website. These preferences are collected by websites (more specifically, by each website's Consent Management Platform) and stored in a string called Transparency and Consent string (‘TC string’). The TC string is subsequently shared with advertisers and data brokers, in order to inform them of the user's preferences. At the same time, the CMP writes a cookie called euconsent-v2 on the user’s device. In combination with the TC string, the euconsent-v2 cookie can reveal the user’s IP address. In 2019 a number of complainants, including several non-profits, filed complaints with different DPAs against the TCF. The DPA decision [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_21/2022 The Belgian DPA, as lead supervisory authority, ruled] that IAB was acting as a joint controller (along with the TCF participants) in relation to the TC string. The DPA also considered that this processing influenced the OpenRTB protocol and that IAB was therefore a joint controller in relation to the OpenRTB as well. It also found several breaches of the GDPR. As a result, the DPA fined IAB €250,000. The decision was adopted pursuant to the cooperation procedure under Article 60 GDPR, in the context of which 21 supervisory authorities agreed with the DPA’s draft decision during the procedure. IAB challenged the DPA decision IAB challenged the decision before the Court of Appeal of Brussels (hereafter the Court). In particular, IAB claimed that the TC string did not constitute personal data, and that even if it did, IAB was not a controller for the processing in relation to the TC strings. In particular, it claimed that by creating the TCF, it merely set a standard for processing personal data across the organizations handling TC strings. In IAB's view, this did not amount to actually processing data. Request for preliminary ruling The Court of Appeal referred several questions to the CJEU. In 2024 the CJEU issued a preliminary ruling in which it confirmed (i) that TC strings were personal dataCJEU, Case C-604/22, IAB Europe, 7 March 2024, margin 51 (available [https://curia.europa.eu/juris/document/document.jsf?docid=283529&doclang=en here]). and (ii) that IAB was a joint controller for the processing in relation to the TC stringsCJEU, Case C-604/22, IAB Europe, 7 March 2024, margin 77 (available [https://curia.europa.eu/juris/document/document.jsf?docid=283529&doclang=en here])., along with the other recipients of the string. The CJEU specified that its findings about IAB’s qualification as a controller, did not extend to the entire data processing happening through the OpenRTB protocol. In other words, IAB was a controller for the TC string processing, but it did not necessarily follow that it was a controller for the broader processing of personal data in the OpenRTB protocol for the purpose of targeted advertising. The Court resumed the proceedings after the preliminary ruling of the CJEU. On the nature of the TC string Further to the preliminary ruling, the Court observed that IAB members - who were recipients of the TC strings - held data that could identify the data subject when combined with the TC string. This implied that the TC string qualified as personal data, irrespective of the possibility for IAB to actually identify users. The Court then examined if IAB could actually identify users. It held that under IAB's internal policies, which are binding for the other participants in the TCF, IAB could require to access data which, in combination with the TC string, could identify users. The Court concluded that as IAB could require such information, it had reasonable means to identify the users. For these reasons, the Court held that TC strings were personal data in the meaning of Article 4(1) GDPR. On the processing of personal data The Court then confirmed that once created, the TS strings are then structured and organized by IAB, which qualifies as a processing operation within the meaning of the GDPR. On IAB’s controllership The Court then examined if IAB qualified as a controller under Article 4(7) GDPR. The Court noted that IAB shares a purpose with other participants in the TCF: that users preferences are captured in a structured way and the shared with other participants. Given its overriding control over the TCF, the Court found that IAB held clear decision making power both over the purposes and means of the processing. Regarding the joint controllership, the Court distinguished between the processing in relation to the TC String and the processing in the context of the OpenRTB protocol. For what concerns the TC Strings, the Court confirmed that IAB was jointly responsible, with the TCF participants, for storing data subject's consent preferences in the TC string. It therefore qualified as a joint controller. For the processing in relation to the OpenRTB, the Court however refused to follow the DPA's reasoning. It considered that the scope of the litigation was limited to the processing within the TCF and that the DPA did not sufficiently prove that IAB was a joint controller in the context of the OpenRTB protocol. The Court therefore found that IAB's claim was founded only to the extent that the DPA decision considered that IAB acted as a joint controller in the context of the OpenRTB protocol. On other violations The Court mostly upheld the DPA’s findings and confirmed that IAB violated Articles 5(1)(a), 5(1)(f), 6, 13, 14, 24, 25, 30, 32, 35, and 37 GDPR. In particular, the Court confirmed that: * IAB had no legal basis under the GDPR to process TC strings. In particular, the Court confirmed the DPA's findings on the legal basis of legitimate interest: IAB failed to correctly balance its legitimate interest with that of the end users and, therefore, could not invoke legitimate interest as a legal basis for processing the TC string. * IAB failed to inform website visitors about the processing of personal data, in violation of the controller's transparency obligations; * the TCF did not meet GDPR standards for data protection by design and default; * IAB failed to appoint a data protection officer and carry out a data protection impact assessment. Conclusion In conclusion, the Court upheld most of the DPA reasoning and confirmed the €250,000 fine imposed. The only part of the DPA decision that was not confirmed was the extension of IAB's controller quality to the full OpenRTB protocol. The Court did not specifically decide on the matter but considered that it was out of scope of the present proceeding and that the DPA did not sufficiently justify its reasoning. The Court also specified that the case would not be sent back to the DPA.
Court case 490202
In 2021, the Canal+ Group (controller) carried out commercial prospecting by electronic means, targeting approximately 3.9 million people. The controller did not directly seek the consent of the persons concerned. Instead, they contacted people whose personal data and consent for marketing purposes had already been collected by two partner internet service providers (ISPs) through data collection forms. The ISPs' subscribers were invited to check a box to give their consent to the use of their personal data for prospecting purposes by the ISPs’ "partners". The names of these partners were not specified in the form, nor were they accessible via a hyperlink or by any other means. The CNIL (French DPA) conducted multiple inspections. On 12 October 2023, the DPA found that the controller had failed to comply with their obligation to obtain valid consent from the individuals concerned for the purposes of electronic marketing, in violation of Article 7 GDPR. The controller brought an action for annulment of this decision before the Council of State. The Council of State considered that this dispute raised a question as to whether the consent given by the data subject to a first collector, allowing their data to be used by a category of recipients for the purpose of electronic prospecting, can be regarded as informed consent within the meaning of Article 4(11) of the GDPR, read in conjunction with articles 13(1) and 14 of the same Regulation, and article 13 of the Directive of 12 July 2002 on privacy and electronic communications. A further question arises as to whether the degree of specificity of the term « category of recipients » is significant, or whether, as in the present case, it may simply refer to any « partner » of the initial data collector. The Council of State considered that these questions are decisive for the resolution of the dispute and present serious difficulties. The Council of State therefore referred the matter to the Court of Justice of the European Union in accordance with the article 267 of the Treaty on the Functioning of the European Union, and stayed the proceeding on the application filed by Groupe Canal+ until the Court has ruled.
In a combined case, two data subjects sought an order from the Amsterdam District Court for preliminary relief prohibiting LinkedIn (controller) from using tracking cookies on their website. The data subjects claimed that LinkedIn deployed two tracking cookies (li-gc cookie & b cookie) on their devices without having first received consent, as required under both the Dutch implementation of the ePrivacy Directive (Telecommunicatiewet (Tw)) and Article 6(1) GDPR. This action was filed on March 12 2025. In support of their claim, the data subjects relied upon a HAR study (a file within which network traffic is recorded) which allegedly showed that the two cookies in question were deployed before the data subject’s had given consent. Alongside this HAR file, the data subjects also submitted a report by an IT and security specialist who confirmed their claims. These cookies, it was claimed, were tracking cookies used by LinkedIn for their Real Time Bidding (RTB) system which allows for the display of targeted advertisements on their platform. LinkedIn denied the data subject’s claims. In their defense, they argued and both cookies were technically necessary, thus not requiring prior collection of consent under the Tw or the GDPR. They submitted that the li-gc cookie is used to store and retrieve website visitor cookie preferences and the B cookie is deployed to prevent fraudulent traffic and detect abuse on their platform. LinkedIn further argued that, in any event, both data subjects had given consent to the use of non-technically necessary cookies. In support of this, they produced screenshotted proof of the fact that the data subjects had consented to the question “Can LinkedIn and third parties use cookies to deliver relevant advertisements (including jobs) to you on and off our services and to measure the display and effectiveness of the advertisements?”. During the proceedings, the data subjects argued that they were not aware that the provision of consent as formulated above extended to the provision of targeted advertisements. The Court refused the relief sought. The Court found that LinkedIn had convincingly demonstrated that the two data subjects had given their consent to non-technically necessary cookies for the period in question. The Court noted that the data subject’s claims that they were unclear as to the extent of this permission could not be sustained as the consent formulation clearly extended beyond LinkedIn’s own use. In light of this finding, the Court did not deem it necessary to consider whether the cookies in question were technically necessary or not. This decision was thus made without prejudice to that allegation. The data subjects were ordered to pay LinkedIn’s costs.
Court case 10 A 5385/22
The controller is a publishing house that publishes newspapers and content on the Internet at www.noz.de. The controller uses a consent banner (so-called cookie wall) on its website. The defendant is the DPA of Lower Saxony (LfDI). In 15 November 2022, the DPA carried out a technical test on the controller’s website and found that when it was first accessed, without prior consent, the US service Google Tag Manager was contacted meaning that user data were transmitted to Google’s US server and data were stored on the user's device. Also, a consent banner titled "optimal user experience" appeared with the options to "Accept all", in the middle of the banner, or "Accept & close x", at the top right (the x referring to the symbol used to close a window). In order to refuse consent users had to scroll down, select the "Settings" button and at the window opened on a second level, the user must check whether the opt-in controls are switched off in order to then select the "Save selection" button. On 23 November 2022, the DPA issued a decision ordering the controller; a. To implement the requirements for effective consent in accordance with Article 4(11) and Article 7 GDPR, insofar as this is necessary for the lawfulness of the use of local storage objects, tracking technologies and third-party services; b. To obtain effective consent for the Google Tag Manager service integrated in the website in accordance with Section 25 (1) of the german Telecommunications-Digital Services Data Protection Act (TTDSG) and Art. 6(1) (a) GDPR or to remove the service; and c. To comply with the orders within 1 month. The DPA argued that the consent was not fully informed and voluntary in accordance with Article 4(11) GDPR. At the first level of the banner there was no literal mention that the buttons "Accept all" and "Accept & close x" provide two options for granting consent and also there was no option to refuse consent. On December 2022, the controller filed a case before Administrative Court of Hanover (Verwaltungsgericht Hannover - VG Hannover) requesting the annulment of the DPA’s order. They argued that the DPA is not responsible for issuing such order, that the controller does not process any personal data, that user’s consent was obtained lawfully and that they process the data to fulfill a legal obligation pursuant to Article 6(1)(c) GDPR. The DPA responded that the legal basis for the order can be found in Article 58(2)(d) GDPR and § 20 para. 1 of the Lower Saxony Data Protection Act (NDSG). First, the court held that the controller processes personal data within the meaning of Article 4(1) GDPR. Cookies stored on end devices that contain IP addresses and individual user’s IDs, as online identifiers, are considered personal data. Second, the court found that the order under point (a) is materially lawful. The use of cookies and other technologies on the controller's website violates Section 25(1) TTDSG and Article 6(1) GDPR. The setting of these cookies to user’s devices requires effective consent that meets the requirements of Article 4(11) GDPR. The controller’s cookie banner does not meet these requirements because; 1. At the first level the number of the third-party service providers is missing. 2. At the first level the user must scroll down in order to reach the Settings button that gives the possibility to withdraw consent. 3. The overall view of the design of the various levels of the consent banner shows that users are to be specifically directed towards a declaration of consent and their right to choose is to be influenced. 4. The "Accept & close x" button at the top right, is considered non-transparent and surprising design and cannot be assumed that a legally relevant, conscious consent is given. 5. There was no literal mention of “consent”. Furthermore, the processing of personal data by the controller is not carried out to fulfill a legal obligation. Third, it held that the order under point (b) is also lawful. The controller is in breach of Section 25 (1) TTDSG and Article 6(1) GDPR for using the Google Tag Manager service itself without obtaining prior consent from users and that this data processing is also not justified under any legal basis Article 6(1) GDPR. c. Fourth, the order under point (c) is also lawful under Article 58(2)(d) GDPR. Lastly, the court decided that the case is unfounded.
LinkedIn and associated companies placed cookies on users' devices without obtaining prior consent, violating a cease and desist order.
Court case 6 C 3.23
The controller purchases dental gold from dental practices. To do so, it collects the practice owner's first and last name, as well as the practice address and telephone number, from publicly accessible directories, such as the Yellow Pages. The controller uses the contact details stored in a database to contact the dental practices by telephone with the aim of determining whether the parties contacted are interested in selling precious metals to the controller. Following a dentist's report, the DPA ordered the controller to cease the collection, processing, and use of personal data of dental practice owners for the purpose of telephone advertising unless the data subject has given their consent or a business relationship with the data subject already exists. Furthermore, the DPA ordered the deletion of the data collected and stored for this purpose and instructed the controller to implement the ordered measures within two weeks of the order becoming final and to notify the DPA thereof. The controller applied to the DPA for annulment of the decision. As grounds, it essentially argued that her conduct was lawful under the GDPR, which had since entered into force, so that a new issuance of the order would not be possible. The DPA rejected the application, essentially stating that the legal situation had not changed in the controller's favor. The Administrative Court dismissed the controller's action seeking an order requiring the DPA to annul its decision. The Higher Administrative Court held that in the absence of consent under Article 6(1)(a) GDPR, the admissibility of the controller's data processing for direct marketing purposes now depends on the applicability of Article 6(1)(f) GDPR, which requires a comprehensive proportionality assessment and a balancing of the conflicting interests of the advertiser, on the one hand, and the recipient of the advertising, on the other. However, the requirements of Article 6(1)(f) GDPR are not met because the telephone advertising practiced by the controller does not meet the requirements of the Unfair Competition Act. With the appeal, the controller is pursuing its request further claiming that it can rely on Article 6(1)(f) GDPR as the legal basis for its data collection and processing. = The court held, that the controller's conduct violated the GDPR because the controller processed personal data of the dentists concerned without their consent. The court held, that contrary to the opinion of the lower court Article 95 GDPR does not render Article 6(1)(f) GDPR inapplicable in this case, because [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] does not constitute a provision in relation to which the GDPR imposes "additional obligations" on natural or legal persons. The court found that rather Article 13(3) of the e-privacy directive contains stricter requirements with regard to unsolicited direct marketing communications than the GDPR. Therefore, the court held that Article 6(1)(f) GDPR and [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] are, in principle, applicable concurrently. == However, the court held, that when assessing whether the data processing is carried out to safeguard a "legitimate interest", the assessments of [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG] must be taken into account. The court found that the fundamental question of whether standards and valuations of national law may generally be applied when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR can remain open since the German legislator implemented [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] with [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG]. It would, the court held, be in any event contrary to the principle of the unity of the Union legal order, if this implementation of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML rticle 13(3) of the e-privacy directive], which is applicable in accordance with Article 95 GDPR alongside the GDPR, had to be disregarded when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR. Additionally, the court considered, the CJEU had held that the coexistence of remedies under data protection law and competition law does not pose a threat to the uniform enforcement of the GDPR. == The court found, that the controller lacks a legitimate interest within the meaning of Article 6(1)(f) GDPR because the purpose of its data processing violates [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG]. According to [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG], a commercial practice that unreasonably harasses a market participant is impermissible. According to [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(1) UWG], this applies in particular to advertising, even though it is evident that the market participant addressed does not want this advertising. Following on from this, [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG] stipulates that unreasonable harassment is always to be presumed when advertising is carried out by telephone to a consumer without their prior express consent or to another market participant without their at least presumed consent. Presumed consent requires that, based on specific factual circumstances, the dentist can be presumed to have a justified interest in the telephone advertising. The court held that such an objectively justified interest of dentists in the sale of dental gold to the controller could not be established, because * an interest could not be inferred simply from the fact that the dentists called published their telephone numbers in publicly accessible directories, as this served solely to ensure accessibility for patients. * The sale of dental gold for profit is neither typical nor essential to the work of a dentist = The court held that the discretion generally granted to the DPA under the GDPR is limited in the present case to the extent that the DPA must intervene and impose a ban on the processing of the personal data of dental practice owners without their consent for the purpose of telephone advertising pursuant to Article 58(2)(f) GDPR. The court found that since the controller already lacked a legitimate interest within the meaning of Article 6(1)(f) GDPR, a design of the processing that complies with data protection law is not possible thus establishing an enforceable legal obligation for the controller to cease the processing is necessary.
Court case Ra 2024/04/0424
= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities didn’t fall within the scope of journalistic purposes. The court emphasised that the controller placed the cookies and processed the collected data for analytical and advertising purposes. Regarding the need for an equivalent reject option in cookie banners the court upheld the interpretation of the DPA that the first layer of the cookie banner needs to contain a visually equivalent option to reject cookies. = The controller appealed the BVwG's decision. In this appeal, the controller stated, that there is a lack of case law on the media privilege and on the design of cookie banners. The controller argued, that the Supreme Administrative Court (Verwaltungsgerichtshof - VwGH) had not yet dealt with this in substance and that thus clarification by it was required. Regarding the design of the cookie banner the court found that Article 7(3) GDPR requires an individual case-by-case examination whether refusing consent is as simple as granting it. The court held that an appeal can only be justified in cases of a blatant misassessment of the individual case-related circumstances by the first instance court. The court did not find this in the present case, stating that the reasoning of the first instance court was detailed and comprehensible. Regarding the media privilege the court held, that the appeal did not indicate which specific legal question the court would have to answer in this context.