Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
IAB Europe (“IAB”, short of Interactive Advertising Bureau) is an association of undertakings active in the field of digital advertising such as publishers, ecommerce and marketing companies and intermediaries, including major international players such as Microsoft and Google. IAB is established in Belgium and operates on a European level. IAB developed the “Transparency & Consent Framework” (“TCF”). The purpose of the TCF is to make the processing of personal data for online advertising compliant with data protection requirements. To this end, the TCF provides a set of technical standards and rules (in the form of contractual obligations) for companies in the sector. In particular, the TCF specifies how publishers, advertisers, and intermediaries should use the OpenRTB protocol, a widely used Real Time Bidding (“RTB”) system. RTB consists in the instant and automated online auction of users profiles for the purpose of selling and purchasing advertising space online. When an internet user visits a webpage where advertising space is available, the server sends the user’s data to a platform where advertisers automatically and instantly place bids. Advertisers place their bids based on some characteristics of individual users visiting the page (such as their location, marketing profiles, and browsing history). The bid winner displays their customer's advertising in that specific advertising space. The whole process involves a mass exchange of personal data. For this operation to be possible, users are (in principle) asked to express their advertising preferences when they first visit a publisher’s website. These preferences are collected by websites (more specifically, by each website's Consent Management Platform) and stored in a string called Transparency and Consent string (‘TC string’). The TC string is subsequently shared with advertisers and data brokers, in order to inform them of the user's preferences. At the same time, the CMP writes a cookie called eucon
In 2021, the Canal+ Group (controller) carried out commercial prospecting by electronic means, targeting approximately 3.9 million people. The controller did not directly seek the consent of the persons concerned. Instead, they contacted people whose personal data and consent for marketing purposes had already been collected by two partner internet service providers (ISPs) through data collection forms. The ISPs' subscribers were invited to check a box to give their consent to the use of their personal data for prospecting purposes by the ISPs’ "partners". The names of these partners were not specified in the form, nor were they accessible via a hyperlink or by any other means. The CNIL (French DPA) conducted multiple inspections. On 12 October 2023, the DPA found that the controller had failed to comply with their obligation to obtain valid consent from the individuals concerned for the purposes of electronic marketing, in violation of Article 7 GDPR. The controller brought an action for annulment of this decision before the Council of State. The Council of State considered that this dispute raised a question as to whether the consent given by the data subject to a first collector, allowing their data to be used by a category of recipients for the purpose of electronic prospecting, can be regarded as informed consent within the meaning of Article 4(11) of the GDPR, read in conjunction with articles 13(1) and 14 of the same Regulation, and article 13 of the Directive of 12 July 2002 on privacy and electronic communications. A further question arises as to whether the degree of specificity of the term « category of recipients » is significant, or whether, as in the present case, it may simply refer to any « partner » of the initial data collector. The Council of State considered that these questions are decisive for the resolution of the dispute and present serious difficulties. The Council of State therefore referred the matter to the Court of Justice of the Eur
In a combined case, two data subjects sought an order from the Amsterdam District Court for preliminary relief prohibiting LinkedIn (controller) from using tracking cookies on their website. The data subjects claimed that LinkedIn deployed two tracking cookies (li-gc cookie & b cookie) on their devices without having first received consent, as required under both the Dutch implementation of the ePrivacy Directive (Telecommunicatiewet (Tw)) and Article 6(1) GDPR. This action was filed on March 12 2025. In support of their claim, the data subjects relied upon a HAR study (a file within which network traffic is recorded) which allegedly showed that the two cookies in question were deployed before the data subject’s had given consent. Alongside this HAR file, the data subjects also submitted a report by an IT and security specialist who confirmed their claims. These cookies, it was claimed, were tracking cookies used by LinkedIn for their Real Time Bidding (RTB) system which allows for the display of targeted advertisements on their platform. LinkedIn denied the data subject’s claims. In their defense, they argued and both cookies were technically necessary, thus not requiring prior collection of consent under the Tw or the GDPR. They submitted that the li-gc cookie is used to store and retrieve website visitor cookie preferences and the B cookie is deployed to prevent fraudulent traffic and detect abuse on their platform. LinkedIn further argued that, in any event, both data subjects had given consent to the use of non-technically necessary cookies. In support of this, they produced screenshotted proof of the fact that the data subjects had consented to the question “Can LinkedIn and third parties use cookies to deliver relevant advertisements (including jobs) to you on and off our services and to measure the display and effectiveness of the advertisements?”. During the proceedings, the data subjects argued that they were not aware that the provision of consent as f
The controller is a publishing house that publishes newspapers and content on the Internet at www.noz.de. The controller uses a consent banner (so-called cookie wall) on its website. The defendant is the DPA of Lower Saxony (LfDI). In 15 November 2022, the DPA carried out a technical test on the controller’s website and found that when it was first accessed, without prior consent, the US service Google Tag Manager was contacted meaning that user data were transmitted to Google’s US server and data were stored on the user's device. Also, a consent banner titled "optimal user experience" appeared with the options to "Accept all", in the middle of the banner, or "Accept & close x", at the top right (the x referring to the symbol used to close a window). In order to refuse consent users had to scroll down, select the "Settings" button and at the window opened on a second level, the user must check whether the opt-in controls are switched off in order to then select the "Save selection" button. On 23 November 2022, the DPA issued a decision ordering the controller; a. To implement the requirements for effective consent in accordance with Article 4(11) and Article 7 GDPR, insofar as this is necessary for the lawfulness of the use of local storage objects, tracking technologies and third-party services; b. To obtain effective consent for the Google Tag Manager service integrated in the website in accordance with Section 25 (1) of the german Telecommunications-Digital Services Data Protection Act (TTDSG) and Art. 6(1) (a) GDPR or to remove the service; and c. To comply with the orders within 1 month. The DPA argued that the consent was not fully informed and voluntary in accordance with Article 4(11) GDPR. At the first level of the banner there was no literal mention that the buttons "Accept all" and "Accept & close x" provide two options for granting consent and also there was no option to refuse consent. On December 2022, the controller filed a case before Adm
LinkedIn and associated companies placed cookies on users' devices without obtaining prior consent, violating a cease and desist order.
= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities
On the 09 August 2022, a data subject, represented by noyb, filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the controller unlawfully processed their personal data without the data subject's valid consent. The data subject alleged that, due to the use of dark patterns by the controller, the principle of transparency was violated and that the withdrawal of consent was not as easy as its issuance. Therefore, the data subject requested the erasure of their personal data. The option to reject cookies was a link, which was only identifiable as a link when hovering over it with the mouse. The accept button on the other hand was strongly highlighted by being placed in the middle of the banner and in a colour with strong contrast to the background. On the 22 September 2023, the DSB issued a decision on the following three points: Point 1: The data subject’s right to erasure had been violated under Article 17 GDPR. Point 2: The data subject’s right to privacy had not been violated under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=04-11-2022 §1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG). Point 3.a: The DSB ordered the controller to alter its cookie banner to make the “reject all cookies” appear in equal format to the “accept all cookies” option. Point 3.b: The controller must implement a function, which makes the revocation of consent just as simple as its declaration. The controller appealed points 1, 3a and 3b of the decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The controller posited that the GDPR does not require the “accept” and “reject” buttons to be displayed in an equal format. Further, it added that the revocation of consent was available through a footer link on the website which lead to the cookie settings. The court rejected the controller’s appeal. Point 1: The data of the data subject, at the
The political party's website used Google reCaptcha and Google Fonts without consent, and continued data transfers after cookies were rejected.
The website's cookie banner initially lacked a reject button on the first layer, used pre-ticked boxes, and did not allow easy withdrawal of consent, violating GDPR requirements.
The data subject visited a website, for which the controller was responsible. Upon accessing the website, the data subject was presented with a 'Consent Management Platform (CMP or cookie banner)' that, according to the data subject, violated Article 6 GDPR. The data subject filed a complaint to the Austrian DPA (DSB) on 10 August 2021. The data subject was represented by noyb. During the proceedings before the DPA: * the controller claimed to have reworked the design of the CMP and to have deleted the contested personal data of the data subject; * the data subject replied to this statement claiming that even though the violations identified in the complaint had been remedied by the new design of the CMP, certain cookies were then classified as 'strictly necessary' (within the meaning of Article 5 (3) ePrivacy Directive) and thus set as 'always active'; * in response, the controller claimed not to have processed any personal data without the data subjects consent. In addition, the controller explained that the note 'always active' for certain cookies was incorrect and had only not been removed by the time of the data subject's statement for technical reasons; * the data subject explained that the cookies had still been incorrectly classified and various non-required cookies were set without interaction with the banner. The controller claimed they had revised the cookie settings and the banner again and the contested cookies that were not deemed strictly necessary were not being set anymore if consent was not given; * the data subject stated their data was indeed processed without their consent upon visiting the website and that the processor had not explained in sufficient detail to what extent certain cookies were considered strictly necessary. The DPA dismissed the complaint. However, it also officially instructed the processor in point 3) of their decision to adapt the website and the banner in such a way to be compliant with Article 4(11) GDPR and Article 4(7
The data subject is a user of a social network platform, which also provides a messaging service. This platform is managed by a company with its headquarter in the USA. The data subject initiated a lawsuit before the Regional Court of Traunstein (Landesgericht Traunstein – LG Traunstein). Firstly, she argued that the controller is constantly monitoring her private messages and that the privacy policy is not transparent and is too complex. Secondly, she argued that, through cookies, the controller is collecting data relating to activities that happen outside the social network without her consent. Thirdly, she claimed that the controller forwarded all her personal data from and in connection with her account to the USA. She argued that this transfer is unlawful since the USA did not guarantee a level of protection equivalent to the GDPR. Therefore, the data subject asked the court to order the controller to pay non-material damages. As for the first argument, the controller pointed out that it conducts scans on the private messages only when to detect child sexual abuse material (CSAM) in compliance with the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32002L0058 ePrivacy Directive 2002/58/EC] (see [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32021R1232 Article 3 Regulation (EU) 2021/1232]). Moreover, the controller argued that it is respecting its transparency obligations and that the transfer of data to the US is legal since there is an adequacy decision and, before that, there were SCCs. First of all, the court ruled that the data subject has not demonstrated that the controller is systematically and automatically monitors the content exchanged via the messenger service. In every case, it found that the controller has proven that it carries out only permissible CSAM scanning. According to the court, this processing is covered by the legal basis provided for by Article 6(1)(f) GDPR. Secondly, it held that, due to the extensive dat
The controller, Microsoft Corporation, provides the service “Microsoft advertising” which enables website operations to place adverts in the search results of the "Microsoft Search Network". It can also collect information about the visitors to a website and to place targeted adverts for these visitors via cookies. The data subject visited third-party websites. She claims that the controller’s cookies were placed on her device without her consent. A forensic analysis of the recorded network traffic revealed that cookies from the controller had been placed on the data subject’s device without their consent. The data subjected sought injunctive relief at the Regional Court of Frankfurt am Main (“Landgericht Frankfurt am Main”) and requested the court to order the controller to refrain from using cookies on her end devices without her consent. The court refused to issue an interim injunction and dismissed the case. The court stated that grounds for an injunction were lacking and that the data subject did not demonstrate that they would otherwise suffer considerable disadvantages and that they cannot reasonably be expected to wait for the main proceedings. The court held that the data subject had the option to block the storage or reading of cookies via the internet browser settings, while the controller would have to change its complete processing, costing enormous effort in terms of time and money. Thus, the balance of interests is therefore in favour of the controller. The data subject appealed this decision at the higher regional court of Frankfurt (“Oberlandesgericht Frankfurt am Main”), arguing that the balance of interests is in their favour as there can be no right to exercise an unlawful business model. Moreover, the data subject had to live with the uncertainty of the whereabouts of its data, the associated loss of control and the fear of disclosure to unauthorised third parties. The data subject requested the court to amend the first judgement, to grant the i
The data subject visited several popular websites and refused all cookies. However, tracking cookies were still placed on the data subject’s device. The controllers are Linkedin Ireland, Linkedin Netherlands, Microsoft Corporation (US), Microsoft Ireland Operations, Microsoft (NL) and Xandr (US). LinkedIn offers an advertising service and allows for companies to place tracking cookies on the browsers of a user after they view or click their ads. Microsoft has an advertising service that sells ad space on various websites. The service also allows advertisers to show their ads on the ad space of 'third-party' website operators and can place tracking cookies on the devices of website visitors. Xandr is an online platform that buys and sells digital ads. To use the services of Xandr, website users need to install a Java-script that places tracking cookies on the devices of website visitors. All of them are part of the Microsoft Group. The data subject hired a third party specialist to make an independent analysis of the controllers’ collection of personal data via the placed cookies. The analysis confirmed that out of the 30 websites the data subject visited, 27 websites placed and/or read cookies without the data subject’s consent. 24 websites did this even after explicit refusal to consent. Thus, the controllers were collecting personal data of the data subject’s browsing habits without their consent. The data subject filed an urgency procedure (“kort geding”) at the Amsterdam District Court (“Rechtbank Amsterdam”), asking the court to forbid the controllers to place tracking cookies without the data subject’s consent. Jurisdiction of the court [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Brussels I bis Regulation] regulates which courts of the EU Member States have jurisdiction in cases with links to more than one Member State in the EU. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bi
In order to protect works covered by copyright against their communication on the Internet without the authorization of the holder of the rights, France adopted Decree n. 2010-236, which introduced in particular, [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000020740267/2009-11-01/ Article L. 331-21 in the French Intellectual Property Code] (‘CPI’). This Article establishes that the High Authority for the dissemination of works and the protection of rights on the Internet (‘Hadopi’) may request the identity, postal address, email address and telephone number of a person who made protected works available to download on the Internet, from internet service providers. The purpose of this access is to enable Hadopi to initiate a procedure against the identified person, combining educational and punitive measures. In particular, the sending of a first and second recommendation and then a letter notifying them that that activity is liable to constitute gross negligence. The matter may be referred to the public prosecution service in the most serious cases. Four associations, including La Quadrature du Net, sought the annulment of this Decree, claiming that [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000020740267/2009-11-01/ Article L. 331-21 CPI] was contrary to EU law, in particular [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15 ePrivacy Directive] and [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7], [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8] and [https://fra.europa.eu/en/eu-charter/article/11-freedom-expression-and-information 11] of the Charter. Regarding the alleged infringement of EU law, La Quadrature du Net submitted that this Article permits access to any connection data in a disproportionate manner for non-serious copyright offences committed on the Internet, without any prior review by a judge or an authority. In par
Two complaints were lodged with the Italian Public Prosecutor's office concerning acts of mobile theft. In order to identify the perpetrators, the Public Prosecutor's office requested an authorisation to obtain the telephone records of the stolen telephones from all the telephone companies. These requests concerned all the data in the possession of the telephone companies, with tracking and localisation methods, in particular the users and International Mobile Equipment Identity (IMEI) codes of the devices called or making the calls, the sites visited and reached, the times and durations of the calls and connections, the details of the cells and/or towers concerned, and the users and IMEI code of senders and receivers of SMS and MMS. These requests were made to the judge responsible for preliminary investigations at the District Court, Bolzano (‘Giudice delle indagini preliminari presso il Tribunale di Bolzano’) on the basis of an Italian National law, [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003]. The referring court was uncertain whether [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003] is compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) of Directive 2002/58] (‘ePrivacy Directive’) as interpreted by CJEU, 2 March 2021, Prokuratuur, C-746/18. First, according to paragraph 45 of that judgement, national provisions that allow public authorities to access telephone records containing a set of traffic or location data are justifiable if those provisions are intended for the prosecution of serious offences such as threats to public security and other serious crimes. Second, [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+p
The controller appealed [https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2022-026 decision SAN-2022-026] of the French DPA ('CNIL') before the French Supreme Administrative Court ('Conseil d'Etat). The CNIL fined the controller €3,000,000 for failing to obtain data subjects' consent for advertising purposes, regarding "Identifiers for Vendors" when using the controller's apps on Apple devices. The DPA also ordered an injunction requiring the controller to bring its data processing into compliance within a period of three months from notification of the deliberation. This was subject to a fine of €20,000 per day of delay. The controller sought to reduce the fine amount. The Conseil d'Etat rejected the controller's request and upheld the DPA's €3,000,000 fine. First, Article 82 of the French Data Protection Act requires that any operation of collection or deposit of information stored in the terminal of a data subject must be subject to prior, clear and complete information relating to the purpose of cookies or other tracers and the means available to data subjects to oppose them, as well as the prior collection of their consent. Two exceptions exist to this requirement: (i) if the activity has the exclusive purpose of allowing or facilitating communication by electronic means and (ii) if it is strictly necessary to the provision of an online communication service at the express request of the user. The Conseil d'Etat considered that the DPA had sufficiently established the facts regarding the breach of [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the French Data Protection Act] (loi 78-17 du 6 janvier 1978, Informatique et Libertés), as the controller did not obtain the necessary consent to collect data subjects' data and its activities did not fall into one of the exceptions to this requirement. Second, the Conseil d'Etat also held that the DPA followed the correct procedures when deciding the fine to be imposed on
Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austr
The controller is Criteo SA, a global technology company operating in media and entertainment that does consultancy, provides software and services in relation to digital marketing, media advertising and real time ads bidding. The controller places tracking cookies for targeted advertising on computers and mobile devices of users visiting certain third party websites. The controller uses the Real Time Bidding (RTB) System to recognise a user within seconds and to show personalised ads. In another case against the controller on 15 June 2023 , the French DPA ("CNIL") fined the controller €40 million for violating various articles of the GDPR, in particular for failing to verify that the persons from whom it processed data had given their consent. On 8 August 2023, the data subject wrote to the controller that the placing of tracking cookies on the data subject’s devices without the data subject’s consent, violates [https://www.google.com/search?client=firefox-b-d&q=telecommunicatiewet+11.7a Article 11.7a(1) Dutch telecommunications law] (“Telecommunicatiewet – TW”) and Articles 5(1)(a), 6(1), 7, 13 and 14 GDPR. The controller responded that it is the responsibility of the third party websites to obtain consent. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The court prohibited the controller from placing tracking cookies on the devices of the data subject and imposed a penalty of €250 for every day they fail to comply with the decision (with a maximum of €25.000). The controller appealed this decision on 30 October 2023. The Court of Amsterdam (“Gerechtshof Amsterdam”) found that tracking cookies were placed by the controller and that the data subject’s personal data was processed in violation of the GDPR. The court therefore prohibited the controller from placing tracking cookies and upheld the imposed penalty of the District Court after the judgem
A journalist (‘data subject’) demanded an apology in relation to himself and to the citizens of the Czech Republic (‘CZ’) from the Ministry of Industry and Trade of the CZ (‘controller’) as a compensation for the non-material damages suffered as a result of the incorrect transposition of Directive 2002/58 of the European Parliament and of the Council /EC of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (‘e-Privacy Directive’ or ‘Directive’). According to the Czech law transposing the Directive, operators of electronic communications and public networks must store a variety of user communication information for six months, primarily to aid in the investigation of criminal and misdemeanor activates. The incorrect transposition of the Directive allegedly led to the widespread collection and processing of operation and location data of users' the electronic communications. In this case, the data subject saw an interference with his rights to privacy and informational self-determination. Before filing the lawsuit, the data subject tried unsuccessfully to obtain the erasure of data stored on him through a mobile operator and later through the Czech DPA. The DPA stated that, in their opinion, it is indisputable that the national legislation issue (§ 97 paragraph 3 of Act No. 127/2005 Coll.) is not in accordance with Article 15 ePrivacy Directive. According to the Directive, Member States may enact laws to limit certain rights outlined in the Directive, including data retention, if it is necessary for national security, defense, public safety, or crime prevention, in line with EU principles. However, the complaint was rejected by the DPA. Nevertheless, the data subject brought the DPA's opinion to the controller's attention who rejected it claiming that this transposition of the Directive cannot be considered as 'improper official procedure' according to Act No. 82/1998 Coll., on liability for da
The case involves the Transparency & Consent Framework for online advertising, focusing on personal data processing compliance with GDPR, not specific cookie violations.