Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
Proximus, a provider of telecommunications services provider in Belgium, also provides telephone books and telephone enquiry services for the public (hereinafter "directories"), according to the Law about Electronic Communication. These directories contain the name, addresse and phone number (hereinafter "information") of the different public telephone services providers (hereinafter "operators"). Other directories, published by third parties, exist. The information of these subscribers are communicated regularly to Proximus by the operators, except those of subscribers who expressed their wish not to appear in the directories published by Proximus. In Belgium, the distinction between the subscribers who want to appear in a directory and those who don't, is in practice expressed by assigning a code in the registration of each subscriber, namely "NNNNN" to the subscribers whose information can appear, and "XXXXX" to the subscribers whose information stays confidential. Proximus transmits the information it receives to other providers of directories. The complainant is a subscriber of the telephone service operato Telenet, who is active on the Belgian market. Telenet does not provide directories but transmits the information of its subscribers to providers of directories, among them to Proximus. The 13th January 2019 this subscriber demanded Proximus not to have appear his information in the directories published either by Proximus or by third parties. Following this demand, Proximus modifiier the status of this subscriber in its information system, so that the information of that subscriber should not made public any more. The 31st January 2019, Proximus received from Telenet a periodic update of the data of the subscribers of the latter. This update contained new data of the concerned subscriber, which were not indicated as confidential. This information was handled automatically by Proximus and were registered in a way that they appeared again in the directory of
EU law restricts the ability of Member States to implement broad data retention requirements and access regimes as part of combating market abuse, and requires national courts to exclude improperly obtained evidence in accordance with EU law principles. On 22 May 2014, a judicial investigation was initiated into VD and SR for insider dealing and related offenses. On 23 and 25 September 2015, the Autorité des marchés financiers (the French Financial Markets Authority (hereinafter AMF)) provided the investigating judge with personal data from telephone calls made by VD and SR. The AMF had collected such data under French law, namely Article L. 34-1 CPCE. VD and SR challenged the use of this telephone data, on the grounds that it infringed Article 15(1) e-Privacy Directive. On 20 December 2018 and 07 March 2019, the French courts rejected the claims brought by the parties, relying on Article 23(2) Regulation No. 596/2015 relating to market abuse, which allows competent authorities to access such data where there is suspicion of insider dealing. The Court firstly noted that the wording of the provisions in the Regulation only refer to the authority's power to "require existing" data records, suggesting that the EU legislature did not intend to mandate data retention obligations. The Court also held that the context and objectives of the legislation support the interpretation that it only governs access to existing data, not an obligation to retain data generally and indiscriminately. The Court concluded that a broad interpretation that would allow mandating data retention would deprive the clear wording of the provisions of effectiveness, which the Court cannot do according to its settled case law. The purpose of the EU legislation on insider trading — namely, Directive 2003/6 and Regulation No 596/2014 — is to protect the integrity of EU financial markets and enhance investor confidence by preventing the improper use of inside information. However, the EU legislat
The Belgian 'Gegevensbeschermingsauthoriteit' (DPA) received multiple complaints against IAB, a digital advertising company (alleged controller). The complaints concerned the ‘Transparency and Consent Framework (TCF), which was developed by the alleged controller. TCF is a standard technical framework that enables websites, advertisers and ad-agencies to obtain, record, and update consumer consent, objections and preferences for web pages. TCF was meant to help companies to become more GDPR compliant. Also, TCF makes it overall easier to record preferences of data subject for companies that use the so called ‘consent management platform’ (CMP), which is an interface that appears when a data subject first navigates to a websites or uses an application for the first time. Here, a data subject can give consent for the collecting and/or sharing of personal data or object to the processing of his/her data. These preferences are then saved and encoded in a ‘TC-string,’ which can be shared with other companies. The CMP also places a cookie on the device of the data subject in question. The TC string and this cookie could also be coupled with the IP-address of the data subject. Following the several complaints, the DPA started an investigation into IAB. After the DPA finished its investigation, it fined the alleged controller €250,000. In its decision, the DPA held amongst other things that IAB was the controller with regard to the processing of the registration of consent and objection of data subjects in the TC-string. The DPA also held that the alleged controller had to bring its processing activities in compliance with the GDPR. It had to provide a legal ground for processing in the context of TCF. It also needed to restrict its customers from using an opt-in consent in the CMP-interface, where data subjects would consent to legitimate interest (Article 6(1)(f) GDPR) as a legal basis. In addition, the alleged controller had to implement appropriate technical and organi
The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded this complaint to the Luxembourg DPA under the 'one stop shop' mechanism of Article 56 GDPR. The luxembourg DPA started an investigation regarding Amazon's use of cookies and its compliance with the GDPR and the ePrivacy directive. However, the French DPA started its own investigation into Amazon's compliance with Article 82 of the French Data protection act, a national implementation of Article 5(3) of the ePrivacy directive. (directive 2002/58/EC). This investigation regarding Article 82 had resulted in decision [https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729 SAN-2020-013]. In this decision, the French DPA fined Amazon €35,000,000 for the failure to obtain prior consent and the failure to inform users of their rights with regards to the processing of their data, which was mandatory under Article 82 of the Data Protection Act. The DPA found that when a user visited the "Amazon.fr" site, a large number of cookies with advertising purposes were automatically placed on the data subjects computer. Because this type of cookie was not essential to the service provided by the controller, the DPA considered that the controller had not complied with the obligation to obtain the consent of Internet users before depositing the cookies. Amazon appealed this decision at the Conseil d'Etat, the French Supreme Administrative Court, and requested its annulment. Amazon also asked the Conseil to refer several questions to the CJEU for a preliminary ruling. Among other arguments, Amazon claimed that the French DPA had made an incorrect interpretation of the law regarding its competence and had disregarded its competence by imposing the contested sanction. The controller also stated that the involvement of the French DPA, when the Luxembourg DPA was already involved, constituted a violation of A
The case involved data retention and admissibility of evidence, unrelated to cookie or consent issues.
On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act (which transposes the ePrivacy Directive). Google (1) had not obtained the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) had lacked to provide information, and (3) had not implemented a mechanism to refuse the cookies. Google did not agree with the CNIL’s decision and brought the issue before court. First, it claimed that, since there is cross-border processing, the Irish DPA (DPC) is the lead supervisory authority since Google’s main establishment in the EU is in Ireland, and the CNIL therefore did not have competence to rule on this matter according to the one-stop-shop mechanism. Second, it found the fine to be disproportionate. Hence, it requested the Council of State to annul the decision, and to refer two preliminary questions to the CJEU, asking: (1) whether the one-stop-shop mechanism provided for in Article 56 GDPR is excluded in the context of cross-border processing that falls within the scope of both the ePrivacy Directive and the GDPR, and (2) whether Article 15a ePrivacy Directive violates the right to data protection because does not provide an obligation, but rather an option, “for the competent national regulatory authorities to adopt measures to ensure effective cross-border cooperation in the enforcement of national laws adopted pursuant to the directive and to create harmonised conditions for the provision of services involving cross-border data flows”. The Council of State rejected Google’s appeal. First, according to the Council, the ePrivacy Directive, implemented in the French Data Protection Act, does not provide for the application of the one-stop-shop mechanism as mentioned in Article 56 GDPR. Although the requirements for consent are regulated by the GDPR the deposit of cookies is regulated by the ePrivacy Direct
eprimo, a German electricity supplier, distributed advertisements consisting of displaying banners in the email inboxes of the T-Online free email service. When users opened their inbox, those advertisements were shown to them at random, indistinguishable from the list of emails in the users' inbox except for the fact that the date was replaced by the word ‘Anzeige’ (advertisement), no sender was mentioned and the text appeared against a grey background. When clicking on what looked like an email at first glance, the users were shown that advertisement. This procedure is known as inbox advertising. Städtische Werke Lauf a.d Pegnitz GmbH (‘StWL’) is a competitor of eprimo and considered eprimo's inbox advertising unlawful under the rules of unfair competition because there was no prior consent by the users. StWL, after at first succeeding with an action before the Regional Court of Nuremberg-Fürth, lost the case in the second instance before the Higher Regional Court of Nuremberg. When it appealed at the BGH, it referred the subject to the CJEU. In particular, it asked whether inbox advertising was compatible with the ePrivacy Directive and the Unfair Commercial Practices Directive which require consent for electronic mail that is sent to users for the purposes of direct marketing, prohibiting unsolicited communications. The CJEU decided that inbox advertisements require prior consent. The BGH agreed with the StWL and overturned the Regional Court's decision, taking into consideration the CJEU's ruling. It held that eprimo had violated competition law and had to compensate StWL. According to the court, pursuant to § 7(2)(3) Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb - UWG), any direct marketing using the email inbox of the user requires prior consent. Such consent had not been obtained by eprimo. It assumed that it is irrelevant whether potential users of the free email service had been made aware of the use of parts of the internet pa
Controller is the RhineMain University of Applied Sciences. On its website (https://www.hs-rm.de), it used the consent manager “Cookiebot” to obtain users' consent to the use of cookies, and the "Google Tag Manager". Data subject regularly visits the website to look for specialist literature in their online catalogue, and found that their IP address is automatically transmitted to Google’s server each time they visit the website, without having given consent. In addition to their IP address, all kinds of information on the hardware and software of the user’s terminal device is sent, i.e., the accessed’ website, their operating system and its version, the browser and its version, the screen resolution etc. Moreover, Cookiebot is a service offered by the Danish provider Cybot. Although the company is established in Denmark, the target domain “consent.cookiebot.com” refers to a server with an IP address registered with the US-based cloud company Akamai Technologies Inc. (hereafter: Akamai). Although the server might be located in the EU, the cloud company has access to the data on this server. Therefore, the US Cloud Act applies, which means that US governmental agencies can request access to this data, without a court order or mutual legal assistance agreement. After the data subject had written three warning letters to the controller, the latter responded on 7 June 2021 that it no longer used the Google Tag Manager, but refused to submit the obligation to cease and desist regarding Cookiebot. Hence, on 8 June 2021, the data subject applied for interim relief. The Court upheld the appeal and ordered controller to terminate the integration of Cookiebot for the purpose of obtaining consent on its website, since the transmission of personal data is unlawful. First, it noted that the data subject could invoke the right to effective judicial remedy, pursuant to Article 79 GDPR, and that this provision does not have a blocking effect for further judicial remedies. Sec
Google secretly tracked Apple iPhone users between late 2011 and early 2012 and using their data collected in that way for commercial purposes. Google bypassed privacy settings on Apple iPhones and the default blocking of third party cookies on Safari with its “DoubleClick Ad” cookie by relying on an exception devised by Apple. Google placed this cookie without the user’s knowledge or consent. This cookie was enabled if users visited a website that included DoubleClick Ad content (advertising content). The cookie identified visits by a specific device on websites using this advertising content, including data and time of visit; time spent by the user on the website; what advertisement was viewed for how long; and using IP address, the user’s geographical location. As a result, Google could infer the user’s internet surfing habits, location, as well as interests, race or ethnicity, social class, political or religious beliefs, health, sexual interests, age, gender and financial situation. Google then used this aggregated information to give them labels (eg “football lovers”) and eventually offering these group labels to advertising organisations looking to target specific groups when using Google’s DoubleClick service. This allegation was brought in the US and Google settled a charge of $22.5 million with the US Federal Trade Commission and $17 million to settle consumer based actions in the US. Three individuals in the UK sued Google in 2013 for the same allegation and their claim was settled by Google (Vidal-Hall v Google Inc). Lloyd has filed a claim before the UK courts on behalf of everyone that resides in England and Wales and owned an Apple iPhone at the time of the secret tracking. Lloyd filed this class action with the intention of recovering damages for more than 4 million people affected. He claimed that compensation (£750 suggested) should be awarded under the Data Protection Act 1998 for loss of control of personal data without having to demonstrate
The data subject called the helpline of the Österreichsiche Post AG (Austrian Postal PLC). He gave his phone number to the employee with the request for a callback, thereby stating that he did not want the phone number be given to a third party. Afterwards the data subject was called twice by a market research institute – the processor. The controller and the processor had concluded a processing-contract under Article 28 GDPR. The data subject filed a complaint with the DSB (Austria) arguing that the transmission of his data (name and phone number) to the processor was illegitimate since he had already denied consent to any form of data sharing with a third party. During these proceedings the data subject amended their submission by also tackling the use of cookies by the controller. The DSB dismissed the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court determined that the processor is to be seen as a dependent extension of the controller (“verlängerter Arm”) (cmp. Article 29 GDPR). If the processing of data is in accordance with Article 6 GDPR, the controller is free to deploy a processor. As a result, the transmission of data from the controller to the processor itself does not need to be justified under Article 6 GDPR. In the case at hand, the court came to the conclusion that the processing of data by the controller - and therefore also the transmission to the processor - is justified under Article 6(1)(c) GDPR. The controller in this case - the Österreichsiche Post AG - is obliged under national law (§§ 6(8), 32(3) PMG) to provide for a complaint management system to improve their services. According to § 6(8) PMG a postal service must further develop its service in accordance with the needs of users and to contribute to securing the provision of postal services and to the further development of them by means of appropriate measures and proposals. Pursuant to § 32(3) PMG postal servic
The Regional Government of Åland had appointed Mr A as head of the regional Ålandic DPA for a probationary period of one year. Pursuant to section 10(2) of the Act on Public Officials in the Region of Åland, the Government of Åland stated that they would not propose the appointment of A to a permanent post and that A's term of office would therefore automatically come to and end after the one-year probationary period. At the end of the probationary period, the Government of Åland issued a notice confirming that Mr A's term of office had ended. Mr A however applied to the Supreme Administrative Court of Finland for the annulment of this decision, which he considered contrary to the GDPR. The Supreme Administrative Court considered that the notice issued by the Government of Åland constituted an administrative decision terminating Mr A's mandate. The Supreme Administrative Court found that, in addition to national legislation, A's role as head of the data protection authority is also regulated by EU law, and in particular by the GDPR. Although the GDPR does not contain explicit provisions regarding probationary period, the minimum length of the term of any member of any data protection authority is "no less than four years", as set in Article 54(1)(d) GDPR. As a consequence, the termination of A's mandate at the end of the probationary period could not be considered in line with the GDPR. The Supreme Administrative Court further noted that leaving Mr A without any possibility of appeal against that decision would be contrary to the right to a fair trial as protected under the Finnish Constitution, Article 19 TFEU and Article 47 CFR. As Mr A's mandate and termination had not been assessed in the light of the provisions of the GDPR, the Supreme Administrative Court concluded that the decision to terminate Mr A's mandate had to be annulled and the matter referred back to the Government of Åland for reconsideration.
The case focused on unauthorized marketing emails and lack of consent, unrelated to cookie or consent banner issues.
On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance with the General Data Protection Regulation (GDPR) and ePrivacy Directive 2002/58/EC, for lack of transparency, inadequate information and lack of valid consent regarding for violating the regulation on cookies while operating the website [https://google.fr google.fr]. The sanction was accompanied by an order to comply with [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 article 82 of the French Law on data protection] (Law Informatique et Libertés), under three months on penalty of a €100,000 fine per day of delay. The companies appealed to the Conseil d’État in interim procedure against the CNIL's decision, arguing that the French DPA was not the competent authority because it was not the lead supervisory authority for Google LLC or Google Ireland Limited. Is the CNIL territorially competent to investigate and sanction a company for violating the information principle when depositing cookies if it is not the lead supervisory authority of the company? The CNIL considered that Google does have EU headquarters in Ireland, but that this Irish entity ‘did not have a decision making power’ in relation to the relevant cross-border data processing activities to which the complaints related. For that reason the CNIL decided that the One Stop Shop mechanism did not apply and that the CNIL, like any other European supervisory authority, was therefore competent to make a decision. The Conseil d’État rejected the request made by Google and ruled that the French DPA was territorially competent on this matter even though it is not the lead supervisory authority. The court stated that Article 82 of the Law Informatique et Libertés was a transposition of Article 5(3) ePrivacy Directive 2002/58/EC into French Law when dealing with cookies and that the CNIL is charged with enforcing th
In this case Proximus had failed to grant a woman's right of erasure of her personal data and had passed the data on to other telephone directories and directory enquiry services even after receiving several complaints and correspondence from the data subject. On request of the data subject, Proximus had changed the code linked to the data subject's data from 'visible' to 'confidential'. After adjusting the code regarding publication, Proximus received new contact details of the person concerned from her operator, as a result of which the data in the underlying database was automatically overwritten with the new data from the operator. The Belgian DPA imposed a fine of €20,000 on the defendant defendant for infringement of Articles 6, 7 and 12 of the GDPR. In the contested decision, the Belgian DPA found the infringement of Article 6, 7, 12, 13 and 24 GDPR sufficiently proven. In addition, the DPA ordered the defendant to cease any further disclosure of personal data of subscribers to third parties of telephone directory or inquiry services when Proximus acquired these data only as a provider of telephone directories and directory enquiry services, taking into account a transition period in order to give Proximus (and the telecommunications sector in a broader context) the opportunity to develop a new privacy compliant system. With regard to the question of whether consent is required to be included in telephone directories or not and what scope of this consent is, the Court of Appeal also considered that: 1° In situations where the e-Privacy Directive specifies the rules laid down in the GDPR, these specific provisions of the e-Privacy Directive as lex specialis prevail over the more general provisions of the GDPR. (principle of Lex specialis derogate legi generali) 2° Article 12(1) and recital 38 of the ePrivacy Directive refer to the requirement of informed consent within the meaning of Directive 95/46/EG of subscribers for being included in public directorie
The High Court of England and Wales examined a claim against the news website Forensic News LLC and several journalists contributing to its articles. Both the news website and the journalists are based in the US. The claim concerned different news articles containing allegations on the claimant’s connection with an Israeli intelligence company, which the claimant asserted represented a breach of the GDPR and several other laws. As preliminary point of law, the court considered the question whether GDPR is applicable to the situation at hand. Concretely, the court examined whether the matter could fall under any of the three criteria for the extraterritorial application of the GDPR, as prescribed by Articles 3(1), 3(2) and 79(2) of the GDPR. The criteria considered were – whether Forensic News LLC had an establishment in the EU, whether it offered goods and services to individuals in the EU, and whether it monitored the behavior of individuals in the EU. On the first point, the court found that Forensic News LLC did not have any stable arrangements in the UK, and the “establishment” criteria was therefore not met. For this conclusion, it was decisive that the news website had no employees or representatives in the UK. On the other hand, the fact that Forensic News LLC had a readership in the UK and a “handful” of UK subscriptions was not sufficient to prove establishment. On the second point, the court’s position was that Forensic News LLC did not directly target UK consumers with its goods and services. The fact that the UK is a shipping destination for the website’s merchandise was disregarded due to lack of actual purchases – the court found that, in the UK, only one baseball cap was purchased from the website. Finally, on the third point, the court considered that the monitoring undertaken by Forensic News LLC was not sufficient to justify extraterritorial application of the GDPR. Namely, the news website used cookies for the purpose of behavioral profili
eprimo, a German electricity supplier, distributed advertisements consisting of displaying banners in the email inboxes of the T-Online free email service. When users opened their inbox, those advertisements were shown to them at random, indistinguishable from the list of emails in the users' inbox except for the fact that the date was replaced by the word ‘Anzeige’ (advertisement), no sender was mentioned and the text appeared against a grey background. When clicking on what looked like an email at first glance, the users were shown that advertisement. This procedure is known as inbox advertising. Städtische Werke Lauf a.d Pegnitz GmbH (‘StWL’) is a competitor of eprimo and considered eprimo's inbox advertising unlawful under the rules of unfair competition because there was no prior consent by the users. StWL, after at first succeeding with an action before the Regional Court of Nuremberg-Fürth, lost the case in the second instance before the Higher Regional Court of Nuremberg. When it appealed at the German Supreme Court (Bundesgerichtshof - BGH), the BGH referred the subject to the CJEU. In particular, it asked whether inbox advertising was compatible with the ePrivacy Directive and the Unfair Commercial Practices Directive which require consent for electronic mail that is sent to users for the purposes of direct marketing, prohibiting unsolicited communications. The CJEU held that such inbox advertising is unlawful without prior consent according to the ePrivacy Directive and the Unfair Commercial Practices Directive. First, the CJEU clarified that the process of inbox advertisements constitutes the use of communications for the purposes of direct marketing regardless of the recipients being chosen at random. Then, it stated that the use of e-mails is allowed for the purposes of direct marketing only if the the recipient has given free, specific and informed consent. It emphasized the fact that such advertising messages do not need to reach any threshold
The case focused on security issues and data retention violations, with no mention of cookies or consent banners.
The case involves national regulation on data retention for security purposes, not related to cookies or consent mechanisms.
Privacy international has challenged the lawfulness of the practices of collecting and using the bulk communications data (BCD) by the UK security and intelligence agencies. The Investigatory Powers Tribunal referred to the Court of Justice of the European Union the questions whether the existence of such practices fall within the scope of EU law and of Directive 2002/58 and if yes, does the EU law precludes national legislation enabling State authority to require providers of electronic communications services to carry out the 'general and indiscriminate' transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security. The referring court asked two questions : firstly, having regard to Article 4 TEU (referring to national security) and Article 1(3) of Directive 2002/58, ("Directive shall not apply to activities ..... which fall to the activities concerning public security, defence, State security") does a requirement in a direction by a Secretary of State to a provider of an electronic communications network that it must provide bulk communications data to the security and intelligence agencies of a Member State fall within the scope of Union law and of Directive. The second question reffered to the court was seeking to ascertain whether Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, is to be interpreted as precluding national legislation enabling a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security. The UK and several EU members states highlighted that the activities of security and intelligence agencies are the sole responsibility of Member States as it guaranteed in the treaty (Article 4(2) TEU)
The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.) *Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketin