Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
The case involved a failure to respond to a data erasure request, unrelated to cookies or consent mechanisms.
The North Rhine Westphalia Consumer Protection Association ([https://www.verbraucherzentrale.nrw/ Verbraucherzentrale NRW]) claimed for an injunction against the use of cookie banners on [https://www.wetteronline.de/ wetteronline.de], a wesite operated by WetterOnline Meteorologische Services GmbH, the controller. The controller used a cookie banner to collect users' consent to not necessary cookies without providing a reject option on the first layer. The data subject could only refuse to give consent by clicking on the “Settings” button to reach the second layer, where they then had an “Accept all” button or a “Save” button. The cookie banner also had an “Accept & Close X” button in the top-right corner, on both first and second level. In a judgement dated 4 May 2023, the Regional Court of Cologne (Landgericht Köln, LG Köln) dismissed the action as it considered the claim of the Association to be too broad and claimed that it could not impose a specific cookie banner design on the controller. The Association appealed against this judgement to the Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) and specified its claim. Firstly, the OLG Köln considered that the controller designed their cookie banner without an equivalent "reject option" either at the first or second layer. The OLG pointed out that the average user does not realise what the “Save” button represents - namely refusal to provide consent for the use of not necessary cookies. Therefore, the OLG decided that consent could not be regarded as freely given and sufficiently informed under Article 4(11) GDPR. Secondly, regarding the “Accept & Close X” button, the OLG considered that the “X” symbol is known to users as a way to close a window, but not to consent to the use of cookies. The average user would not be aware that this constitutes consent, even if the “Accept & Close” is located directly next to the “X” symbol. The OLG also noted that it was not easy for data subjects to recog
A Pakistani national residing in Germany (the data subject) is suspected of having killed a person together with his brother and other persons in Pakistan, where he is wanted by warrant. This created an alert on the Schengen Information System (SIS) stating that he should be denied entry into the Schengen zone. The data subject upon travelling to Italy was arrested at the border to be extradited to Pakistan. Pakistan however, failed to submit an extradition document despite Italy's requests. Therefore, the arrest was revoked by the Italian Court of Appeal in Brescia. Based on this, the data subject argued that he was now innocent and requested the deletion of the alert on the SIS system under Article 17(1)(d) GDPR.This is because Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system refers to the GDPR and allows data subjects to invoke their rights under it, even if they are not for example an EU national. The reason for the data subject invoking the GDPR is that Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system, refers to the GDPR and allows data subjects to invoke their rights under it when their data is processed by the system. The Federal Police Headquarters of Germany rejected the request for deletion multiple times. The alert was lawful and according to national law, data of foreigners who are the subject of an alert for refusal of entry can be stored on the basis of public safety. The voiding of the arrest warrent in Italy could not be held to override this public safety. The extradition had failed for formal reasons rather than because the data subject was innocent. The arrest warrant issued by Interpol Pakistan had not been withdrawn and therefore, there was still a valid reason to hold the alert in the SIS system. The data subject appealed the decision to the German Court in Potsdam arguing, among other reasons, that his rights had been infringed and that the data should be deleted
The case involves the unlawful transfer of personal data to US-based companies through cookies without proper consent.
The Danish Business Authority was formerly responsible for supervising compliance with the Danish cookie rules. Due to reorganisation, the supervision was transferred to the Danish Agency for Digital Government on 15 December 2022, who is the authority making the decision in this case. On 1 and 16 September 2022, Google LLC was sent consultation letters regarding the use of cookies on their website, which did not allow users to give granular consent. The text on the first layer of the cookie banner stated that by selecting "accept all", users agreed that Google could use cookies to process their data for four purposes. Users would also be given the option of dividing their consent under "More choices" on the second layer of the cookie banner. However, users were only given the option to split their consent over two purposes, different to the ones in the first layer. Secondly, the Agency found that Google did not provide users with adequate information about all cookies used on the website. It also pointed out that the information was not considered to be permanently available through direct and marked access on the website, as it was difficult for users to retrieve information when clicking away the cookie banner. On 13 September and 6 October 2022, Google Denmark ApS, Google LLC and Google Ireland Limited submitted comments to the letters. They argued that the material scope of the Danish Cookie Law is limited to the website operator, which in their cases is Google Ireland Limited. In light of this, they contested the Agency’s territorial competence to supervise Google Ireland Limited. Firstly, the Agency affirmed that the website owner is subject to the obligations regarding the use of cookies under the Danish Cookie Law. Meaning that Google LLC, as the website owner, was subject to its requirements. Henceforth, on the territorial scope, the Agency, citing the [https://edpb.europa.eu/our-work-tools/our-documents/internal-documents/internal-edpb-document-042021-
The Danish Business Authority was formerly responsible for supervising compliance with the Danish cookie rules. Due to reorganisation, the supervision was transferred to the Danish Agency for Digital Government on 15 December 2022, who is the authority making the decision in this case. Meta was sent a consultation letter requesting them to elaborate on the cookies it uses and on the cookie banner displayed on its website as it deemed that it did not provide sufficient information. Meta responded stating that it only uses technically necessary cookies for non-registered users, whereas a cookie banner requiring consent shows up for registered users. In the consent banner for registered users, Meta grouped the categories "Our cookies on other apps and websites" and "Cookies from other entities" under a single consent. Also in the consent banner for unregistered users, it is not possible to give a granular consent for different purposes as the only options were "Allow only necessary cookies" or "Allow necessary and optional cookies". In 2022, Meta changed the banner for unregistered users adding a link to the cookie policy allowing to manage one’s consent, but still only one consent could be given for several purposes. Further, the option to withdraw consent for non-registered users was presented in such a way, that users would have to click several times before finally withdrawing consent. In its letter, the Agency for Digital Government (Agency) also pointed out that Meta did not provide sufficient information on cookies and similar technologies used on its website. Meta responded stating that this corresponded to the [https://www.retsinformation.dk/eli/retsinfo/2013/9187 Guidelines of the Danish Business Authority of 2013] (repealed) which only required general information on the purposes of cookies to be provided. Meta adapted its cookie policy as of September 2023 adding a list of cookies and "The most common purposes of these cookies”. Upon receiving a stateme
Criteo placed tracking cookies without obtaining prior user consent and continued to collect cookies even after users had refused consent.
The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under [https://www.garanteprivacy.it/codice Article 154(1)(d) of the Italian Privacy Code] the mentioned data processing operations due to a breach of [https://www.garanteprivacy.it/codice Articles 2, 3, 11, 23, 24 and 26 of the Code]. The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of [https://www.gazzettaufficiale.it/anteprima/codici/codiceCivile Article 41 of the Civil Code], [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the European Charter for Fundamental Rights], [https://www.garanteprivacy.it/codice Articles 13, 23, 26 of the Italian Privacy Code], as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative. The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked. Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subj
The case focused on billing disputes and data retention obligations, not related to cookies or consent.
On 10 June 2021, the Italian DPA issued a €2,600,000 fine against the defendant, a delivery company, for unlawfully processing personal data of platform workers. The defendant appealed this decision to the Ordinary Court (Court). The Court annulled the decision of the DPA because although the decision was legitimate in terms of the violation found, the DPA's decision of the sanction was not. The Court found that the fine imposed by the DPA amounted to 7.29% of the defendant's turnover - significantly higher than the 4% parameter mentioned in Article 83(5)(a) GDPR and even higher than the average percentage (0.0019%) applied by the DPA to other sanctioned entities. Thus, the Court annulled the decision, without, however, modifying the amount of the sanction as the Court stated to not have this power under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2011-09-01;150~art6 Article 10 of Legislative Decree No 150 of 2011]. The Italian DPA appealed this decision to the Italian Supreme Court. The main issue addressed by the Italian Supreme Court and brought by the DPA is the infringement or misapplication of Article 83 GDPR and [https://garanteprivacy.it/web/guest/codice Article 166 of the Italian Privacy Code], given that the sanction imposed was compliant with the provisions. The Supreme Court reiterated that Article 83 GDPR regulates the general conditions for imposing administrative sanctions, and each supervisory authority shall ensure that the administrative fines imposed are ‘in each individual case’ effective, proportionate and dissuasive. To be determined based on certain elements listed in Article 83(2) GDPR. The Supreme Court further noted that in the case of an intentional or negligent breach of several provisions of the GDPR, Article 83(3) GDPR requires that the maximum penalty shall not exceed ‘the amount specified for the gravest infringement’. In this perspective, the amount is set out in paragraphs 4 and 5 of Article 83 GDPR.
The Lithuanian Prosecutor General´s Office investigated one of its public prosecutors, who was found responsible of misconduct in its office. The research into the public prosecutor´s misconduct was authorised by a court order, allowing for the interception and recording of data transmitted over electronic communication. Following these findings, the Prosecutor General´s Office dismissed the public prosecutor from office. The public prosecutor contested the decision before the [https://administracinis.teismas.lt/ Regional Administrative Court (Vilniaus apygardos administracinis teisma)], which dismissed the claim due to the lawfulness of the criminal intelligence operations and process behind the data gathered. The controller then appealed the case to the [https://www.lvat.lt/ Supreme Administrative Court (Lietuvos vyriausiasis administracinis teisma)], as he alleged that the access by intelligence bodies to traffic data and actual content of electronic communications was such a serious interference with fundamental rights that access could only be granted to combat serious crime. The Supreme Administrative Court considered it apparent that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], together with [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 3]ePrivacy Directive 2002/58/EC thereof, extends the scope of that directive only to legislative measures requiring providers of electronic communications services to grant the competent national authorities access to data (as found in C-623/17 Privacy International). Moreover, it follows from [https://curia.europa.eu/juris/document/document.jsf?text=&docid=238381&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=22564108 C-746/18 Prokuratuur], that only actions to combat serious crime and measures to prevent serious threats to public security are capable of justifying serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7
The plaintiff in this case is a German Consumer Protection Association (Verbraucherzentrale Bundesverband e.V.), while the defendant is LinkedIn Ireland Unlimited Company, an Irish social media company operating throughout the EU and worldwide. The plaintiff found that the website of the defendant makes use of cookies and other technologies like fingerprinting that automatically process personal data and monitor users behavior for analytics and marketing purposes. In its privacy notice of 2018, the defendant clearly stated that it ignores “do not track” (DNT) signals on its users’ browsers. DNTs are a browser setting that users can decide to activate, to request websites not to track their online activities. The defendant claimed it would not react to DNT signals, as there was no established “DNT standard” yet. Firstly, the plaintiff claimed that the use of DNT signals constitutes an expression of the right to objection of users under Article 21(5) GDPR against processing activities carried out for marketing purposes under Article 6(1)(f) GDPR, and that the defendant should stop ignoring such signals as doing so constitutes an unfair commercial practice. Secondly, the plaintiff found that when a user decides to first set up a LinkedIn account, the “off-LinkedIn visibility” option is usually pre-activated, which means that personal data of users is shown on the defendant’s partner websites. This, according to the plaintiff constituted a violation of Article 6(1)(a) GDPR, Article 25(2) GDPR, third sentence and Article 4(11) GDPR as well as provisions of the German Federal Law against deceptive commercial practices ([https://www.gesetze-im-internet.de/uwg_2004/ Bundesgesetz gegen unlauteren Wettbewerb, UWG]). Further, the plaintiff asserted in this respect that the defendant wrongfully relied on Article 6(1)(f) GDPR as a legal basis and acted contrary to Article 5(1)(a) GDPR and Article 5(1)(c) GDPR. After the defendant rejected the plaintiff’s warning letter, the p
This judgement stemmed from an appeal against a decision of the Magdeburg Administrative Court. In the original proceeding, the applicant challenged the procedure for the election of the data protection commissioner for the German state Saxony-Anhalt. According to the applicant - a candidate for the same position - the election procedure was not transparent and thus contravened to the requirements set forth in Article 53(1) GDPR. In particular, the data protection commissioner was appointed under state law by the regional Parliament. Members of the parliamentary groups could make proposals but there was no mandatory public call for applications. Furthermore, the applicant stressed that Article 54(1)(c) GDPR establishes an obligation for all EU Member States to put in place a law to provide more legal clarity about the election procedures of the heads of the DPAs. The applicant asked the court to temporarily block the election procedures and refer the case to the CJEU, in order to check whether the principle of transparency was respected. The court of first instance rejected the claim. Therefore, the applicant appealed the decision before the Higher Administrative Court of Saxony-Anhalt (Oberverwaltungsgericht Sachsen-Anhalt - OVG Sachsen-Anhalt). The court found that the applicant's appeal was inadmissible. The court held that the applicant was not eligible to bring such a claim because there was no subjective rights involved. Article 53(1) GDPR establishes requirements which are in the public interest and they cannot be invoked by an individual. Incidentally and without delving into the merits, the court also noted that offices at state level have staff chosen through democratic elections by voters or indirectly by other electoral bodies. The court stressed how the procedure designed by the state law does not jeopardise transparency, as it is immediately clear which names are proposed and by whom. Moreover, the election by a parliamentary assembly is explicitly e
Plaintiff is the umbrella organization of the consumer advice centers in Germany. Defendant is a media company. The media company integrated about 18 third-party-cookies on its website like Double Click from Google. They relied this on Art. 6 (1) (f) GDPR. The company did not implement any information about that on their start page and linked to the privacy policy not before implementing and analyzing the cookies. These cookies enabled profiling via tracking across different platforms. The plaintiff sent a warning on 20 June 2019 which the defendant declined on 14 August 2019. The defendant implented in August 2019 an opt-in cookie banner and changed their privacy policy. The plaintiff is of the opinion that there is no legitimate interest of the defendant and neither the weighting up would turn out in favor of the defendant. The plaintiff criticizes the insufficient information and continues that the incorrect legal basis leads to the false imagination that it is allowed to implement cookies without consent. The defendant is of the opinion that it is necessary because they otherwise would not be able to implement their offers on their website free of cost and also the cookies were set by third parties. The court is of the opinion that browser settings allowing a transfer of data are no active consent for lack of a deliberate decision of the affected persons. Further the court held that the setting of cookies from third parties is attributable to the defendant as they were payed for that. The court does not follow the opinion of the defendant that the freedom of press includes the advertisement as there is a certain part of jounralistic work needed for Art. 85 GDPR.
This ruling of the Belgian court of appeal (Marktenhof) concerns the Belgian Railway company SNCB/NMBS (controller), a company with the Belgian state as its only shareholder. During the COVID-19 Pandemic, the controller was ordered by the Belgian government to start an initiative to promote train travel. On 13 October 2020, the controller emailed railway pass holders to inform them about the use cases of this travel pass and also provided COVID-19 related information. This e-mail resulted in GDPR related discussions on Twitter, specifically regarding the lack of the possibility to object. The Belgian DPA started an investigation on that matter and found that by not providing the possibility to opt-out of receiving similar emails, the controller violated Articles 12(2), 21(2) and 21(4) GDPR. Moreover, the DPA held that the controller violated Article 5(1)(a), 5(1)(c), 5(2), 6(1), 12(2), 21(2) and 21(4) GDPR. The controller was fined €10,000 (a summary of this decision is available on the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_71/2022 hub]) and decided to appeal the decision with the Appeal Court on the following grounds: First, the controller contested the applicability of the GDPR, considering that the e-privacy directive was applicable as lex specialis. Second, the controller stated Article 6 ECFR had been breached because it had not been able to comment on a piece of evidence. Third, the controller stated that the decision of the DPA was based on an inaccurate and incomplete representation of the facts. Among the others, the controller disputed the DPA’s definition of ‘Direct marketing’. It added that it had sent the e-mail in the first place because it was obligated to do so pursuant to the government's instruction. It had to provide COVID-19 related information and promote its full service as part of its public service obligation. Fourth, the controller argued that the DPA did not properly motivate the GDPR violations in the disputed decision
The North Rhine-Westphalia Consumer Center brought an action against Telekom Deutschland GmbH, a German telecommunication company. The legal dispute before the District Court of Cologne concerned several points. First, the Consumer Center questioned the lawfulness of the controller's disclosure of personal financial data to credit ranking agencies, in particular SCHUFA Holding AG and CRIF Bürgel, in the context of the performance of mobile communication contracts. The controller provided these companies with personal data of its costumers in order to check their creditworthiness and prevent fraudolent behaviours. Second, the Comsumer Center doubted that the controller's privacy policy was GDPR compliant. Furthermore, in the opinion of the Consumer Center, the controller did not validly collect consent for the use of cookies on its website but rather relied on dark patterns in the cookie banners, that inevitably misled users. Finally, the transfers of customers' personal data to third countries - including the US - for analysis and marketing purposes violated GDPR. The Consumer Center claimed that when customers visited the controller's website, personal data like IP address and information about browser and device used by the visitor were transmitted to Google LLC. Therefore, the Consumer Center requested the court to order the controller: a) to refrain from transferring personal data to credit agencies, in particular SCHUFA Holding AG and CRIF Bürgel, when carrying out and/or executing mobile communication contracts. b) To refrain from using the privacy policy with regard to existing mobile communication contracts with consumers and from relying on such clauses for any future contracts. c) To bring the cookie banner design in compliance with the GDPR, especially by embedding an easy option not only to consent to cookies, but also to refuse them. d) To refrain from transferring personal data of consumers to third countries for advertising and marketing analy
This case concerns a class action filed by the Data Privacy Foundation, an organisations which pursues redress on behalf of victims of privacy intrusions in the Netherlands, against social media company Meta. The complaint filed by the foundation was directed at unlawful personal data processing practices by Meta, through their Facebook service. The three defendants in the lawsuit were three companies of the Meta group (Meta Platforms Inc; Meta Platforms Ireland Limited; and Facebook Netherlands BV). The complaint filed by the Foundation consists of four main issues. Firstly, the claim submitted that Meta infringed their transparency obligations in Articles 5, 12, 13 and 14 GDPR by failing to sufficiently inform users of a number of processing operations. Secondly, the Foundation submitted that Meta processed personal data in lack of a legal basis in violation of Article 6 GDPR. Thirdly, it was claimed that Meta unlawfully processed special categories of personal data (Article 9 GDPR). Fourth, and finally, Meta did not obtain valid consent for the use of cookies, tracking of surfing behavior, and app use outside the Facebook service – for advertising purposes – in violation of the Article 11.7a of the Dutch Telecommunications Act. Each of these issues, and the details of the claims made by the Foundation, will be discussed further below. Issue 1 – Transparency obligations The complaint filed by the Foundation detailed a number of ways through which Meta infringed its transparency obligations under the GDPR. Firstly, the controller did not inform data subjects about the disclosure of personal data to external developers who could process personal data for their own purposes. From 2010, Meta (then called "Facebook") introduced an API (Graph API 1.0) to allow other software developers to link their software to the Facebook service. This API makes it possible to exchange data and communicate between different software systems. Prior to the first use, permission was req
This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation on their cookies practices (see [https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-22-februari-2023-van-het-marktenhof-ar-953-beschikbaar-in-het-frans.pdf here] for the DPA decision and here for the GDPRhub summary). The Belgian law empowers the board management of the DPA to issue a referral in order to open an ex officio investigation (Article 63(1) of the Law establishing the Belgian DPA). This referral needs to indicate that there are "serious indications of a practice that could give rise to an infringement of the fundamental principles of personal data protection. In this case, the board management issued a referral on 16 January 2019 without mentioning any reference to serious indications of potential infringements, or any evidence for that matter. The investigation was however considered open on that date. On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) containing several reasons for starting the investigation, among others the high amount of visitors of the controller's websites. On 16 June 2022, the DPA issued decision 103/2022, fining the controller for several GDPR related violations. The controller appealed this decision at the Market Court in Brussels, stating that the DPA's board management referral did not indicate the reasons to investigate. It was thus irregular, and implied that the investigation service was irregularly seized. As a result, the DPA decision was also invalid. The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be considered as (a part of) the referral,
After receiving several complaints, at different times, about unwanted promotional phone calls from ENEL Energia (the controller), one of Italy's most important energy providers, the DPA initiated its investigation. At the end of 2018 and the beginning of 2019, the DPA made two requests for information to the controller. It then submitted a third request on 17 December 2019, which went unanswered. The DPA followed up with a fourth request on 10 July 2020, which the controller replied to on 14 January 2021. Then, on 14 May 2021, the DPA notified the controller of the initiation of the sanctioning procedure. On 16 December 2021, the Italian DPA fined the controller €26,513,977 with its [https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9735672 decision of 9735672]. The controller appealed the decision to the Tribunale ordinario di Roma (Court) arguing that the Italian DPA failed to comply with the 120-day deadline for notification of the beginning of the sanctioning procedure, which the DPA should have complied with. To begin with, the Court noted that the Italian DPA had issued [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9107640 Regulation No 2/2019] concerning the identification of terms and organisational units responsible for the administrative procedures. In accordance with [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=7.0 Article 166(5) of the Italian Privacy Code], the Regulation gives the DPA a time limit of 120 days from the establishment of the violation to notify the controller of the beginning of the sanctioning procedure. Subsequently, the Court addressed the DPA’s claim that the 120-day time limit was not mandatory. The Court stated that the time limit must be regarded as peremptory under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990-08-07;241!vig=
The controller operates several websites. The data subject stated that, as a consumer, he ordered household goods from the controller's online shop in 2020, giving his name and address. According to the data subject, the controller violated data protection law in several ways. He stated that the controller had deliberately integrated malware into its site, which manipulated the data subject's internet browser. Thereby, personal data had been unlawfully processed by the controller itself, as well as being irrevocably forwarded to foreign third party companies in order to track his online behaviour by setting cookies without his consent. Due to the alleged violations, the data subject claimed to be entitled to injunctive relief for infringement of Article 6(1) GDPR. Furthermore, he argued the infringement of Article 26 GDPR (joint responsibility) and Article 44 GDPR (third country transfer). The controller argued that the data subject had not sufficiently substantiated his claim since he had neither specified the processing of his data that allegedly took place nor described it accurately. Moreover, according to the controller, there is no basis for a claim because the GDPR does not provide for injunctive relief under civil law. The Regional Court Wiesbaden found the data subject's action both inadmissible and unfounded. First, the court stated that the data subject's claim was not sufficiently specific as it did not specify what exact behaviour he wanted to prevent with the injunction. Then, the court added that the lack of specification of the exact data processing activity also made the claim unfounded as the data subject had not even given information on what and when he ordered in what specific online shop of the controller. To the court it was clear that the data subject was not concerned with being affected in a specific case where he saw his personal rights violated, but rather a fundamental abstract clarification. There had been no pre-judicial correspon