Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 13 October 2026 · Updated daily
94 results · Showing 81–94
The parties were involved in social initiatives aimed at supporting or questioning the need for certain investments in the vicinity of the housing estate where they live. The defendants accused the claimant that, as a result of her interventions in the housing estate, the city carried out no investments. The defendants publicly criticised the claimant's attitude and they also expressed their opinions in social media. The applicant claimed that the defendants had thereby infringed her personal rights. The Regional Court held that there was no infringement, as the defendants exercised their right to freedom of expression. In the Regional Court's opinion the defendants cannot be held responsible for the form of statements made by other people, including Internet users. The claimant has appealed against the judgment. The claimant complained that the court omitted her request for evidence to oblige the domain registrar and the Internet access service provider to disclose the names and addresses of subscribers to the service using pseudonyms (nicknames), who published entries about the claimant on an Internet forum. The Court of Appeal identified the subscriber of the domain and obtained from him information about e-mail addresses to the accounts with logins indicated by the claimant and lists of posts written from those addresses. Next, it called the Internet provider for the established IP addresses to indicate the subscribers of the Internet access service. The Internet provider refused to provide information, citing telecommunication secrecy. Additionally, it indicated that the deadline within which it is obliged to store, among others, the data requested by the Court, has already passed. The Court of Appeal has addressed the Supreme Court with a legal issue. Is an entity providing Internet access services, i.e. an entity bound by telecommunication secrecy, entitled to refuse to provide personal data of the subscriber of this service in a case of infringement of per
L’association des agences de communication and others contested the legality of several recommendations and principles enshrined in the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ 4th of July 2019 CNIL deliberation] on Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés. Could the CNIL decide a prohibition of “cookie walls” based on the EDPB 'soft law'? The Conseil d’Etat considered that the CNIL outpaced its powers when considering cookie walls as illegal in a soft law measure (Article 2 of its 4th of July 2019 deliberation). Cookie walls are "the practice of blocking access to a website or mobile application for those who do not consent to be tracked ("cookie walls")" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). The CNIL based its position on the EDPB (European Data Protection Board), stating that cookie walls should be forbidden because the cost of consent refusal is too high and thus the consent is not freely given ([https://edpb.europa.eu/our-work-tools/our-documents/otros/statement-edpb-revision-eprivacy-regulation-and-its-impact_en 25 May 2018, on ePrivacy]): "The EDPB considers that, in such a case, users are not in a position to refuse the use of tracers without suffering negative consequences (in this case, the ban from accessing the website)" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). CNIL concluded "that consent can only be valid if the person concerned is able to validly exercise his or her choice and does not suffer major inconvenience in the event of the absence or withdrawal of consent" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). Nonetheless, the Court still considered the CNIL had overpassed its power: "By deducting such a general and absolute prohibition from the sole requirement of a free consent, laid down by the regula
Several private companies challenges the guidelines of the CNIL on cookies on several grounds, including excess of powers. The Council of State validated most of the interpretations or recommendations provided in the guidelines: - Individuals should be able to decline to give consent as easily as to give consent; Individuals must be able to withdraw their consent as easily as they gave it; - User consent should be given for each purpose, which implies specific information; - Individuals must be informed of the identity of the controllers depositing cookies; the list containing the identity of the controllers must be made available to them at the time consent is obtained and must be regularly updated; - Data controllers must be able to demonstrate that they have obtained valid consent to the CNIL. However, in its decision of 19 June 2020, the Council of State suppressed a paragraph in which the CNIL considered that the Internet user should not suffer major inconvenience in the event of the absence or withdrawal of consent. The CNIL considered in particular that access to a website could never be subject to the acceptance of cookies ("cookie walls"). The Council of State considered that by deducting this general prohibition from the GDPR, the CNIL had gone beyond what is legally possible with guidelines, which are an instrument of "soft law".
See facts at the GDPRhub entry to the "Planet 49 case" (C-637/1/). The second checkbox containing a preselected tick used by the defendant (Planet 49) read as follows: {| class="wikitable" !English translation !German original |- |‘I agree to the web analytics service Remintrex being used for me. This has the consequence that, following registration for the lottery, the lottery organiser, [Planet49], sets cookies, which enables Planet49 to evaluate my surfing and use behaviour on websites of advertising partners and thus enables advertising by Remintrex that is based on my interests. I can delete the cookies at any time. You can read more about this here.’ |"Ich bin einverstanden, dass der Webanalysedienst Remintrex bei mir eingesetzt wird. Das hat zur Folge, dass der Gewinnspielveranstalter, [Planet49], nach Registrierung für das Gewinnspiel Cookies setzt, welches Planet49 eine Auswertung meines Surf- und Nutzungsverhaltens auf Websites von Werbepartnern und damit interessengerichtete Werbung durch Remintrex ermöglicht. Die Cookies kann ich jederzeit wieder löschen. Lesen Sie Näheres hier." |} In the explanation linked to the word "here", it was pointed out that the cookies would receive a specific, randomly generated number (ID) associated with the registration data of the user who entered his/her name and address in the web form provided. If the user with the stored ID would visit the website of an advertising partner registered for Remintrex, this visit should be recorded, as well as which product the user is interested in and whether a contract is concluded. Following the CJEU's reasoning in its preliminary ruling, the BGH dismissed the defendants' appeal and, on the plaintiff's appeal, overturned the appellate judgment regarding cookie consent and restored the first instance conviction of the defendant: *The declaration of consent by the preselected tick box does not constitute an "informed indication of the data subject's wishes" within the meaning of Arti
The plaintiff asked to the State to grant him access to procedural files in which he was involved against the State of the Netherlands concerning forgeries offence. The applicant claimed that the procedural files contained his personal data and evidences which could help him to prove his innocence in the aforementioned case and all the cases in which he would have been involved as party against the State. The State refused to grant him the access. The Court clarified the interplay between the right to inspection under the ePrivacy Directive and the right to access under the GDPR. First, the Court examines the basis of the applicant's request pursuant to Article 12 of the Code of Civil Procedure which requires to state fully and truthfully the relevant facts, and to submit all the document relevant to the application. In this regard, the Court considered that the applicant did not comply with this obligation. Indeed, the Court pointed out there is no docuiment showing that the applicant submitted an inspection request of the procedural files at stake. Then, the Court clarified that both the ePrivacy Directive and the GDPR apply. It considered that the right of inspection of document including personal data is not absolute. However, it stated that the access right and the right of inspection have to be understood as a right to a complete overview of all personal data, in a form that enables the data subject to inspect his or her data and to check that they are correct and have been processed lawfully. Regarding the format, the Court recalled that the data subject cannot expect to be provided with the original document and that the material form depends on the concrete circumstances. Finally, the Court considered that in any cae, the applicant's purpose was not to verify the accuracy and lawfulness of the personal data processed but to use them to prove his innocence in the case he was involved against the State and in any proceedings to be brought against the S
The Austrian consumer organization ("Verein für Konsumenteninformation", VKI) has sued the provider of encrypted digital terristrial TV in Austria ("Simply TV") under the Austrian implementation of the Unfair Terms Directive 93/13/EEC (§ 6 Konsumentenschutzgesetz - KSchG) because it allegedly used 29 illegal clauses in its Terms of Service. Two clauses (18 and 19) concern data processing. The other parts of the judgment are irrelevant for the purpose of this page. = "The personal data provided by the subscriber as well as data on the type and frequency of his use of the services provided by Simply TV shall be collected, stored, used by Simply TV - insofar as this is necessary for the processing of subscriptions, for the provision of customer services as well as for the invoicing of remuneration - and transmitted to commissioned companies for the purposes of order data processing pursuant to § 11 Data Protection Act 2000." = "Simply TV may send electronic messages (in particular e-mail, SMS) to the subscriber for the purpose of informing him of offers from Simply TV in the pay-TV sector which are similar to the packages and/or channels already subscribed to by the subscriber. Simply TV will only transmit such messages if the subscriber has provided Simply TV with the relevant contact details (in particular e-mail address, telephone number) as part of the subscription. The subscriber may object to the transmission of such messages at any time in writing (post, fax, e-mail: infoservice@s*****.at). The subscriber will be informed of his right of revocation at each transmission of such messages." = VKI claimed that the clause is intransparent, as the controller does not inform about (1) the concrete companies data is shared with, (2) the the fact that the data subject can withdraw his consent at any time and because (3) the data subject may get the false impression that the clause would generally allow to use personal data as describted in the clause during the ent
In July 2018 the CNIL adopted a decision clarifying the new rules on consent for targeted advertisement under GDPR. It initiated a consultation process for the first quarter of 2020 to define the practical arrangements for obtaining consent. It determined a six-month adaptation period. Two associations requested to annul the decision of CNIL on grounds of excess of power and to instruct it to publish both on its website and on the pages of its press releases of 28 June and 18 July, a reference to the decision of the Conseil d'Etat which should indicate that "continued navigation" does not constitute a valid means of expressing consent for cookies and online tracking devices, while every day of delay would imply a penalty of 500 euros. The Council has to assess whether the CNIL had the power to initiate such a process. The Council found that the CNIL is an independent administrative authority with wide discretion in the exercise of its missions. In this sense, the CNIL can initiate such an action plan in order to achieve more effective compliance with the data protection law. The Council ruled that the six-month period of tolerance which the CNIL provided the stakeholders in order to fully comply with the rules is legal. Finally, the CNIL’s decision does not prevent the Commission from carrying out controls during the mentioned period and imposing sanctions for serious breaches of the new data protection framework.
The case focused on contractual terms and privacy policy issues related to Google+, not on cookie consent or tracking violations.
A German company called Planet49 organized an online lottery hosted on their webpage. In order to participate in the lottery the participant had to enter a name and an address. Underneath the input field there were two checkboxes. The first checkbox required the user to accept being contacted by firms for promotional offers. The second checkbox required the user to consent to cookies being installed on the participants computer. The first checkbox was not pre-ticked, while the second checkbox was. To participate in the lottery the user had to tick, at least, the first checkbox. The Federation of German Consumer Organisations (the “Bundesverband”) initated court proceedings against Planet49, claiming that the declaration of consent did not meet the requirements for a freely given and informed consent. The case reached the Federal Court of Justice (“Bundesgerichtshof”), which referred questions regarding the scope of consent under provisions of the Data Protection Directive 95/46/EC, the ePrivacy Directive 2002/58/EC, and the GDPR to the CJEU. The case was referred to the Court of Justice on 5 October 2017 - before the GDPR became applicable on 25 May 2018. As the Bundesverband sought an injunction to prevent Planet49 from continuing its practices in the future, the Court’s decision takes into account the requirements for consent on the basis of both the Directive 95/46/EC and the GDPR. The Court assessed the requirements for a valid consent under both Directive 95/46/EC and the GDPR and found that there were no substantial differences between them, noting however that the GDPR explicitly states requirements that need to be inferred under Directive 95/46/EC. As the Court notes, the notion of consent under the ePrivacy directive should have the same meaning as consent under Directive 95/46/EC and the GDPR. A key question posed by the referring court in relation to the consent requirement was whether consent could be “passive” or if it had to be “active”. The C
The company offered educational services through a fan page hosted by Facebook. As administrators, they obtained statistical information on visitors to the fan page via Facebook Insights offered by Facebook free of charge under non-negotiable conditions of use. The information was obtained using cookies, each containing a unique user code, stored by Facebook in the devices of visitors and were active for two years. The unique code could be matched with users registered on Facebook and their personal data was collected when the fan page was opened. Neither the company nor Facebook notified users/visitors of the fan page of the storing of cookies or processing of their personal data. The Independent Data Protection Centre Germany, (ULD) made a decision on 3rd November 2011 against the company ordering them to deactivate the fan page within the prescribed period or pay a penalty fine on grounds that: 1. Neither Facebook nor the company notified the users that Facebook collected Personal data of the users; 2. Facebook processed personal data of the users. The company brought a dispute against that decision arguing that it was not responsible for the processing of personal data under the data protection law. This dispute went back and forth from the Administrative Court to the Federal Court who referred the matter to the CJEU seeking clarifications on whether an administrator of a fan page hosted by a social network is a controller within the definition under Article 2 (d)of Directive 95/46. The CJEU held that the mere fact of using a social network doesn’t make the user a controller responsible for processing personal data. However, an administrator who creates a fan page, consents to the use policy, cookies policy, defines the objectives and promotes its activities has an influence on the processing of personal data for the purpose of producing a statistical report, by Facebook, on the fan page, whether anonymized or not. Thus, the administrator is a joint contro
The case focused on data retention laws and their compatibility with EU laws, not cookies or consent mechanisms.
The Belgian Professional Institute of Real Estate Agents (IPI) had used private detectives to collect information on a real estate company that allegedly breached regulatory rules. The admissibility of the private detectives’ evidence in court was questioned on the grounds that the company’s agents had not been informed that their personal data would be processed by third parties in accordance with [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 11(1) of the Data Protection Directive 95/46]. IPI argued that the use of private detectives fell within the exception under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46], which permits the collection of data without consent for the prevention, investigation, detection and prosecution of breaches for regulated professions. Belgian law had specified exceptions for journalistic purposes, artistic or literary expression, public authorities exercising judicial police duties, police services and the European Centre for Missing and Sexually Abused Children. The Belgian Constitutional Court considered that the Belgian law did not strictly transpose exceptions comparable to [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13 of Directive 95/46/EC]. It referred three questions to the ECJ for clarification on the obligations for Member States to implement Article 13 in national law: # Does [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46] leave Member States free to choose whether or not to provide for an exception to the immediate obligation to inform under Article 11(1) to protect others’ rights and freedoms? # Do professional activities of private detectives (governed by national law) come within an exception referred to in [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Articl
SABAM is a management company which represents authors, composers and publishers of musical works. Netlog ran an online social networking platform. On their Netlog profile, users could keep a diary, indicate their hobbies and interests, show who their friends are, display personal photos or publish video clips. However, SABAM claimed that the social network offered all users the opportunity to make use, by means of their profile, of the musical and audio-visual works in SABAM’s repertoire, making those works available to the public in such a way that other users of that network could access them without SABAM’s consent and without Netlog paying it any fee. SABAM first unsuccessfully tried to negotiate a licensing agreement with the social network, then gave it a notice that it should give an undertaking to cease and desist from making available to the public musical and audio-visual works from SABAM’s repertoire without the necessary authorisation - also without results. Given the lack of action taken by the social network, SABAM had it summoned before the Brussels Court of First Instance (rechtbank van eerste aanleg te Brussel) in injunction proceedings under Article 87(1) of the Law of 30 June 1994 on copyright and related rights. It requested that Netlog be ordered immediately to cease unlawfully making available musical or audio-visual works from SABAM’s repertoire and to pay a penalty of €1000 for each day of delay in complying with that order. The social network submitted that granting SABAM’s injunction would (1) effectively impose on Netlog a general obligation to monitor, which was prohibited by Article 15(1) of Directive 2000/31 and (2) introduce, at Netlog's own cost and for an unlimited period, a system for filtering most of the information which is stored on its servers in order to identify and block electronic files containing musical, cinematographic or audio-visual work in respect of which SABAM claims to hold rights. The rechtbank decided to stay t
Deutsche Telekom, a telecommunications network operator in Germany, publishes directories containing data related to its own customers and that of subscribers of approximately 100 other undertakings in accordance with paragraphs 47(1), 104 and 105 of the Telekommunikationsgesetz (German Law on Telecommunications) (‘TKG’). GoYellow and Telex AG operate an internet and telephone directory enquiry service through the use of available data provided to them by Deutsche Telekom for remuneration. However, the aforementioned companies came to a disagreement as to the scope of the data Deutsche Telekom has to provide to GoYellow and Telex AG. The matter was brought before the Bundesnetzagentur. On 11 September 2006, the Court ordered Deutsche Telekom to grant access to GoYellow and Telex AG to both data relating to Deutsche Telekom’s own subscribers and external data (i.e. data related to the subscribers of third-party telephone service providers), even when subscribers wished the respective data to be published solely by Deutsche Telekom. Deutsche Telekom challenged this decision before the Verwaltungsgericht Köln (Administrative Court, Cologne). On 14 February 2008, the Court dismissed the action. Deutsche Telekom appealed before the Bundesverwaltungsgericht (Federal Administrative Court) on the grounds that an obligation to make such external data available infringes Article 25(2) Universal Service Directive 2002/22/EC and Article 12 ePrivacy Directive 2002/58/EC—the matter was referred to the CJEU for a preliminary ruling. The Court firstly determined that Article 25 Universal Service Directive 2002/22/EC does not provide for full harmonization and is aimed at guaranteeing that at least one extensive directory is made available to end-users. Therefore, a minimum requirement is outlined under this article and Member States can consequently impose more stringent provisions. The Court thus held that Article 25(2) Universal Service Directive 2002/22/EC does not preclude na