Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
93 results · Showing 1–20
Otavamedia Oy
The media company used a two-layer cookie consent banner where rejecting cookies required more steps than accepting them, violating GDPR and ePrivacy Directive requirements.
KFC Restaurants Spain, S.L.U.
In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website. The data subject claimed that the privacy information applicable to users in the EEA was not easily accessible, as the main privacy link led to a global policy. The data subject also alleged that users could not create an account without apparently accepting promotional communications, that the registration form did not correctly link to the privacy policy and that the controller had not appointed a data protection officer. The complaint further identified deficiencies in the privacy information, including insufficient details about the identity of the controller, recipients, international transfers and retention periods. During the investigation, the controller acknowledged that certain links and checkbox descriptions had been incorrectly configured and undertook to correct them. It maintained, however, that its privacy information was provided through several interconnected documents and that it was not required to appoint a DPO. According to the controller, it did not engage in profiling, its marketing communications were based on opt-in consent and the processing of personal data was ancillary to its restaurant business. The DPA found that the information provided on the website was excessively generic and did not comply with Article 13 GDPR. It imposed a €5,000 fine and ordered the controller to bring its website into compliance. The DPA also concluded that the controller’s processing activities required the appointment of a DPO under Article 37(1)(b) GDPR. It imposed a further €20,000 fine and ordered the controller to appoint a DPO. The controller appealed both the sanctioning decision and a subsequent resolution requiring it to demonstrate that it had implemented corrective measures. The Court dismissed the appeal and upheld the total fine of €25,000. Regarding Article 13 GDPR, the Court found that the controller’s privacy information was excessively generic and did not clearly explain the purposes, legal bases and relevant circumstances of the processing. It also held that the DPA was not limited to investigating only the exact issues identified in the initial complaint. The €5,000 fine was proportionate despite the controller’s subsequent corrective action. Regarding Article 37(1)(b) GDPR, the Court held that the controller was required to appoint a DPO. Although its primary business was the provision of restaurant services, the processing of customer data was inseparable from its online ordering, marketing, loyalty and customer-management activities. The processing also involved regular and systematic monitoring, as the controller continuously collected data such as customer preferences, browsing history, IP addresses, cookies and geolocation for commercial and operational purposes. Considering the number of data subjects, the volume and variety of data, the duration of the processing and its nationwide scope, the Court concluded that the processing was carried out on a large scale.
Pour un RGPD respecté
Pour un RGPD Respecté, a French NGO that advocates for GDPR compliance, and three individuals requested the CNIL, the DPA, to partially repeal its 2020 recommendation on cookies and trackers. They challenged Figure 5, which showed a cookie banner where users could refuse cookies through a “continue without accepting” link placed in the upper-right corner. After the DPA rejected the request, the applicants asked the Court to annul that decision. They argued that refusing cookies was not as easy as accepting them and that the banner contradicted the positions of the DPA, the EDPB and the Belgian DPA. The Court dismissed the action. It held that the DPA’s decision did not require a specific statement of reasons under national administrative law. The Court also found that the refusal option was available on the same screen, was immediately accessible and used clear wording and a comparable font size. Therefore, refusing cookies was as easy as accepting them. The Court further held that the example did not contradict the positions of the DPA, the Belgian DPA or the EDPB. The DPA had therefore not made a manifest error of assessment. The requests for an injunction, periodic penalty payment and legal costs were also rejected. No fine or corrective measure was imposed.
La Quadrature du Net
Several digital rights organisations asked the Prime Minister to repeal Decree No. 2010-236 of 5 March 2010. The decree regulated an automated personal data processing system used by the French authority for freedom of communications (ARCOM, hereinafter the French authority) for France’s online copyright enforcement mechanism, known as the graduated response procedure. Under this system, the French authority could receive IP addresses linked to alleged copyright infringements and request the corresponding subscriber identity data from electronic communications operators. This data could then be used to send warnings to subscribers and, in repeated cases, refer the matter to the public prosecutor. The applicants argued that the decree allowed the French authority to access personal data linked to IP addresses without sufficient safeguards under EU law. The court had previously referred questions to the CJEU, which ruled in Case C-470/21 that such access may be allowed, but only under strict conditions. Following the CJEU judgment, the court reviewed whether the French decree complied with EU law. The court partly upheld the action. First, the court held that EU law allows the general and indiscriminate retention of IP addresses for combating criminal offences in general only where serious interference with private life is effectively excluded. This requires strict separation between different categories of retained data, secure technical safeguards and regular monitoring by an independent public authority. The court found that French law did not require electronic communications operators to retain subscriber identity data and IP-related data under these conditions. Therefore, the decree was unlawful insofar as it allowed the French authority to process data that had not necessarily been retained in compliance with EU-law safeguards. Second, the court held that the French authority may access subscriber identity data linked to IP addresses in order to identify persons suspected of online copyright infringements and send the first two warnings under the graduated response procedure. However, the court distinguished the third access to such data. At that stage, the authority is no longer dealing with an isolated identification request: it has already linked the same person’s identity twice with alleged unlawful online activity and with the protected works concerned. A third access therefore allows the authority to build a more detailed picture of the person’s conduct and may reveal sensitive aspects of their private life. It also marks a more serious procedural stage, since it may lead to a registered letter and ultimately to referral to the public prosecutor. For that reason, EU law requires prior authorisation by a court or an independent administrative body before this third access takes place. The decree did not provide for such prior review, so the court held that it was unlawful to that extent. For this third access, EU law requires prior authorisation by a court or an independent administrative body. The decree did not provide for such prior review. The court therefore held that the decree was unlawful to that extent. The court annulled the Prime Minister’s refusal to repeal the unlawful parts of the decree and ordered their repeal. It also held that the French authority must stop applying the unlawful provisions. However, the French authority may still access identity data for the first and second warnings, and may request access in serious copyright offence cases under the conditions set out in the judgment.
Court case 4 U 353/24
The controller is a company that operates several social media platforms, as well as software products grouped under the term “Business Tools“. Third parties can integrate the Business Tools into their websites and apps (subject to the controller’s Terms of Use) to track data subjects and display personalised advertising on data subjects’ social media platforms. Third parties process data subjects’ personal data (such as their IP address, operating system or time zone) and transfer this data to the controller. The data is processed regardless of whether the data subject is logged into one of the controller’s platforms. The business tools are used on a wide range of high-traffic websites and related apps. A data subject (who uses the controller’s platform for personal purposes) filed a claim with the Regional Court of Stuttgart. The data subject requesting the court to order the controller to stop processing their data through third party websites and apps, provide them with full access to their data, erase said data after providing complete access and pay the data subject a minimum of €5,000 in non-material damages. The Regional Court dismissed the claim, on the grounds that the data subject had not provided sufficient evidence to substantiate their claims. In addition, the court considered that the data subject actions were contradictory, as it demanded the controller to cease processing personal data while not accepting cookies. The court stated that the request for the erasure (Article 17 GDPR) and restriction (Article 18 GDPR) of the data subject’s data were not compatible with the injunction sought by the data subject. Finally, the court considered that the controller had provided the data subject with access in accordance with Article 15(1) GDPR. The data subject appealed the decision to the court. The data subject argued that the injunction against future data processing was justified, because the data is automatically transferred to the controller by third parties. Furthermore, the lower court interpreted the erasure and restriction requests too narrowly. Finally, the data subject argued that the “self help tool” of the controller did not fulfil their request for access. On the other hand, the controller argued that the data subject had not provided evidence on how third parties processed their data. The claim was also too vague and unfounded, as the data subject had not yet decided whether to consent to their data being processed for advertising purposes or pay an ad-free subscription (this is also known as “Pay or Okay”). According to the court, it must be assumed that the data subject visited websites that implemented the controller’s business tools, and therefore the data subjects’ data was collected and transferred to the controller. The data subject claimed this in general terms and specified it in relation to individual websites in the second instance; the court considered that the general claim in the first instance was sufficient to substantiate the data subject’s claims, including demonstrating that their personal data was unlawfully processed. The court also stated that the individual websites were responsible for obtaining data subject’s consent to process their data and transfer it to the controller. The court considered the controller and website operators as joint controllers, in accordance with CJEU case law.See C-40/17 (Fashion ID), margins 79, 81, 85, 102 However, as a joint controller, the company operating the social media platforms bore the burden of proof in demonstrating that the data subject consented to the processing. The court partially upheld the data subject’s claims. == The court dismissed three of the data subject’s claims on procedural grounds. First, the court dismissed the data subject’s request to declare that the user agreement did not allow the controller to process the data subject’s data through third parties. The court stated that it could bring an injunction and not a request for declaratory judgment. The court also dismissed the data subject’s request to order the controller to cease processing personal data on third party websites and apps without a legal basis (consent or legal bases under Articles 6(1)(b) to (e) GDPR). The court dismissed the data subject’s injunction claim for data erasure (Article 17 GDPR). According to the court, Article 17 GDPR does not grant a right to injunctive relief. However, the GDPR does not preclude national law from allowing these claims (e.g. Sections 823 and 1004 of the German Civil Code). In this case, however, the court considered that the controller lacked the conditions under national law to be liable for injunctive relief; specifically, the court considered the fact that the controller developed the business tools insufficient to consider that it had directly violated its obligations as a joint controller under Article 26 GDPR.This reasoning was the opposite to OLG Dresden, judgment of March 12, 2026, 17 U 625/25, p. 56 == The court first upheld the data subject’s request to order the defendant to not delete the processed data (Article 18 GDPR), but did not order the controller to leave the data at the location it is stored. Under Article 18(1)(b) GDPR, the data subject may request to restrict the processing if the processing is unlawful and they oppose the erasure of the data. The court considered that the data processing was unlawful, as the controller stored the data on security and integrity grounds without proving it had a legal basis under Article 6(1)(f) GDPR to do so. Specifically, the controller had not specified why it processed the data for security purposes, why it was necessary, or the storage periods. The court also upheld the data subject’s claim for access to information under Article 15(1) GDPR. The court stated that the controller had deliberately restricted the information provided through its “self help tools”, and had therefore not complied with its information obligations. The court considered these tools as particularly unsuitable to provide information on the processing of data outside the social network. Once this information obligation is fulfilled, the court stated that the controller had the obligation to fulfil the data subject’s request for erasure under Article 17(1)(d) GDPR (if the personal data is unlawfully processed). Finally, the court upheld the data subject’s claim for damages, but reduced it to €500. The claim for damages were well founded, as the controller violated the GDPR, and caused the data subject to suffer damage (loss of control over their data), and there was a causal link between the two.
Court case W171 2305420-1
The data subject visited a news website operated by the controller on 20 January 2021. During the visit, the website set cookies after the data subject interacted with the cookie banner and processed the data subject's personal data. On 11 August 2021, the data subject filed a complaint with the Austrian DPA. The complaint alleged that the controller's cookie banner used dark patterns, did not provide a rejection option on the first layer, and enabled the placement of non-essential cookies without valid consent. The data subject requested that the DPA order the deletion of the collected data, stop the processing and impose a fine. The controller argued that it had deleted the relevant data during the proceedings and that no ongoing infringement existed. It also maintained that the data subject had never submitted an erasure request directly to the controller under Article 17 GDPR. On 28 October 2024, the DPA dismissed the data subject's complaint but, acting on its own initiative, ordered the controller to redesign its cookie banner and stop setting certain non-essential cookies before obtaining consent. The data subject appealed. They argued that the controller had not sufficiently proven the deletion of the data, that tracking activities likely continued, and that the DPA should have ordered the deletion of all data collected after the complaint had been filed. First, the court held that the data subject could not rely on Article 17 GDPR because no erasure request had been submitted to the controller before the complaint was filed. It found that a valid request to the controller is a prerequisite for a complaint concerning the right to erasure. The draft complaint previously sent to the controller did not constitute an Article 17 GDPR request because it primarily challenged the cookie banner and sought intervention by the DPA rather than erasure from the controller. Second, the court accepted that the controller had deleted the personal data collected through the cookies during the administrative proceedings. The court considered the controller's submissions credible and noted that the data subject had effectively acknowledged the deletion. Third, the court rejected the argument that Article 17 GDPR entitled the data subject to an order preventing future processing. The court relied on the judgment of the Court of Justice of the European Union in Quirin Privatbank AG (Case [https://infocuria.curia.europa.eu/tabs/document?source=document&text&docid=303866&pageIndex=0&doclang=DE&mode=req&dir&occ=first&part=1 C-655/23]) and held that neither Article 17 GDPR nor any other GDPR provision grants data subjects a standalone right to obtain a preventive injunction against future processing. Consequently, the controller could not be ordered to refrain from future cookie-based processing under the data subject's erasure claim. Finally, the court held that the request to stop the unlawful processing had become moot because the personal data collected on 20 January 2021 had already been deleted. The court also noted that data subjects do not have a subjective right to require a DPA to adopt a specific corrective measure under Article 58 GDPR. The court therefore confirmed the dismissal of the complaint.
Österreichischer Rundfunk - ORF
On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject, represented by noyb, against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of Article 17 GDPR by the ORF (the controller) as the DPA considered that the controller had deleted the data already. The data subject had also argued that the cookie banner did not offer an equally prominent rejection option on the first layer and that refusing consent was more difficult than accepting it. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of Article 4(11) GDPR. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equally prominent (gleichwertig) choice between "Accept all cookies" and "Only necessary cookies", so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting. The controller appealed this decision on 25 November 2024. It claimed that the DPA’s order regarding the redesign of its cookie banner was unlawful. The controller argued that the authority had exceeded its jurisdiction by making an ex officio decision without informing it first of its intention. Furthermore, the controller argued that the GDPR does not lay down binding rules on the visual design of cookie banners and that the DPA had relied on non-binding guidance and literature rather than legally binding provisions. Regarding the DPA’s jurisdiction in issuing the ex officio order for the modification of the controller’s cookie banner, the court held that this was permissible, both under Article 58(2)(d) GDPR and relevant CJEU case law, irrespective of whether the proceeding was initiated by a data subject’s complaint. The court maintained the position that when a DPA notices GDPR violations during its investigation, it is in its powers to adopt on its own initiative the appropriate measures to remedy the identified infringements. The court rejected the controller’s argument that its procedural rights were violated. It further stated that the controller was given the opportunity to comment on the ex officio matter and found that a lack of impartiality on the part of the DPA could not be established. Regarding the DPA’s order of redesign of the controller’s cookie banner, the court first noted that it had to assess whether the cookie banner allowed users to give valid consent within the meaning of Article 4(11) GDPR. It emphasised that consent requires a freely given, specific, informed and unambiguous indication of the user’s wishes and that, under Article 7(1) GDPR, the controller must be able to demonstrate that such consent was obtained. The court examined its latest version which had not changed since the DPA’s decision. It found that the controller’s website was designed is such a way that, when the site was accessed, a pop-up window opened and on this, there were three buttons: “Cookie Preferences”, “Only Necessary Cookies” and “Accept All Cookies” and users could not navigate through the website without selecting one of these options. The court noted that the buttons had the same size but different colour scheme. While the first two buttons displayed blue text on a white background and appeared less prominent against the light grey pop-up background, the “Accept All Cookies” button displayed white text on a blue background and was therefore visually highlighted through stronger contrast The court confirmed the DPA’s decision that the controller’s cookie banner, including the consent request, had been designed in a such a way that the "Accept all cookies" button would stand out due to its colour scheme, especially compared with the other buttons that were visually less prominent. The court agreed that the visual emphasis placed on the “Accept All Cookies” button nudged users towards consent. Furthermore, it pointed out that a design steering users towards the more invasive option was in violation of the principle of transparency. The court rejected the controller’s argument that the absence of detailed binding provisions on cookie banner design made the DPA’s order unlawful. The issue was not whether the GDPR prescribed a specific design, but whether the design of the banner allowed users to make a free and genuine choice. Consequently, the court upheld the DPA’s order and dismissed the controller’s appeal as unfounded.
RTM
The controller, Sky Betting and Gaming ("SBG"), operated an online betting and gaming platform. The data subject, RTM, opened an account with the controller, which they used between April 2017 and early 2019. The controller presented the data subject with a cookie banner stating that by visiting or using this website they would consent to the use of cookies. The banner included a hyperlink with the controller’s cookie policy. The controller’s privacy notice also stated that, unless customers had asked otherwise, they would send them direct marketing communications and use information about them to provide tailored advertising. The controller’s records showed that, on 26 July 2017, the data subject changed his marketing preferences. From 28 July 2017, the controller began sending him direct marketing communications. The data subject did not remember opting in. In March 2018, the controller carried out a “GDPR refresh”. Customers were required to confirm that they had read, understood and accepted updated terms and privacy/cookie information. The controller’s records indicated that the data subject ticked the relevant boxes and chose to continue with his existing direct marketing preferences. The data subject brought proceedings before the High Court under Article 82 GDPR/UK GDPR and Regulation 30 PECR. He argued that the controller had unlawfully placed cookies, processed his personal data, profiled him and sent him direct marketing communications. In particular, he argued that the controller had no valid consent within the meaning of Article 4(11) and Article 7 GDPR/UK GDPR, the DPA 1998 and Regulations 6 and 22 PECR. Although the pleadings referred to GDPR/UK GDPR, the relevant processing period was governed by the DPA 1998 for the earlier period and by the GDPR from 25 May 2018; the Court considered that the meaning of consent was materially the same across the relevant data protection and PECR regimes.. The data subject submitted that the cookie banner did not offer an active way to refuse consent and that the controller’s processing and direct marketing contributed to his gambling addiction, causing financial loss and distress. He also alleged that the controller’s processing was unfair, insufficiently transparent, breached the principles of purpose limitation, data minimisation and storage limitation, and involved special category data because it revealed problem gambling. The key question before the Court was: “What must be proved to establish that consent was given for the placement of cookies, the processing of personal data, and the sending of unsolicited direct marketing communications? Mainly, does the concept of consent for these purposes have a subjective aspect?“ The High Court upheld the data subject’s claim and found that the data subject did not give valid consent. The High Court treated consent as involving three strands: 1) the data subject’s subjective state of mind; 2) whether any lack of subjective consent resulted from an autonomous choice not to engage with the information provided by the controller; and 3) whether the controller had sufficient evidence to prove legally operative consent. Applying that approach, the High Court concluded that the controller’s conduct was unlawful in both periods. In the first period, she found that the data subject lacked subjective consent because of his gambling addiction and that the controller’s “accept and close” mechanism did not provide sufficient evidence of an autonomous choice to give, or to forego, consent. In the second period, the High Court accepted that the GDPR refresh had significantly improved the controller’s consent mechanism. However, it found that this was still insufficient on the facts of the case. In its view, the controller could not rely solely on the general probability that a user who ticked the relevant boxes had validly consented. Instead, where consent was challenged, the controller had to demonstrate that this particular data subject’s consent met the required legal standard. The High Court found that his consent was not sufficiently freely given, because the data subject’s gambling addiction impaired the autonomous quality of his decision-making. It also considered that the resulting uncertainty for businesses was an inevitable consequence of the high standard of consent required by data protection law. The controller appealed the decision on the following grounds: Firstly, that the High Court had applied the wrong legal test for valid consent by treating consent as involving a subjective inquiry into the data subject’s state of mind and autonomy. Secondly, that the High Court’s conclusion that the data subject’s gambling addiction impaired the validity of his consent was not an argument put forward by the data subject. Thirdly, that the High Court erred in failing to find that the data subject had factually consented to direct marketing on 26 July 2017. Fourthly, that there was no evidence that cookies were used to send the direct marketing communications complained of by the data subject. Fifthly, that the High Court’s conclusion on profiling was parasitic on its erroneous findings on consent, cookies and direct marketing, and that it misunderstood the controller’s concession on legitimate interests. The Court of Appeal allowed the appeal on all five grounds. First, the Court held that consent under the relevant data protection and PECR regimes, including the GDPR/UK GDPR where applicable, is assessed objectively. To prove consent, a controller must show that the data subject made a statement or took a clear affirmative action amounting to an indication of their wishes, signifying agreement to the relevant processing or direct marketing. The controller must also prove, on the balance of probabilities, that this indication was freely given, specific, informed and unambiguous. The Court rejected the High Court’s subjective approach. The controller does not have to prove what was actually in the data subject’s mind at the time of the indication. Nor is it necessary or relevant, for the purpose of establishing consent, to examine whether the data subject was vulnerable or had an impaired ability to make autonomous decisions. The Court considered that this objective approach was supported by the wording of Article 4(11) and Article 7 GDPR/UK GDPR, as applicable, and the relevant provisions of PECR. The statutory criteria of consent focus on the outward indication given by the data subject, the information provided by the controller, and the structural relationship between the parties. Second, the Court held that the High Court’s approach was procedurally unfair. The data subject had not argued that his gambling addiction made his consent legally ineffective because of a subjective impairment of autonomy. The High Court therefore decided the case on a basis that had not been properly pleaded or argued, meaning that the controller had not had a fair opportunity to address that specific theory of liability. Third, the Court held that the High Court should have found that the data subject gave factual consent to direct marketing on 26 July 2017. The applicable standard was the balance of probabilities, not certainty. On the evidence, the most likely explanation was that the data subject had ticked a box or otherwise changed his preferences to opt in. Fourth, the Court held that there was no evidence that cookie-derived data was used to create or send the specific direct marketing communications complained of by the data subject. the controller used cookies for personalised advertising on third-party websites and social media, but those activities were not the direct marketing communications at issue in the claim. Fifth, the Court held that the High Court’s finding on profiling was parasitic on its erroneous findings on consent, cookies and direct marketing. The High Court had also misunderstood the controller’s concession on legitimate interests. the controller had only accepted that a gambling operator could not rely on legitimate interests to market to a problem gambler if it had grounds to know that the person was a problem gambler. The High Court had made no such finding. As a result, the Court of Appeal set aside the High Court’s liability judgment. However, the case still had to be remitted to the High Court because other issues, including fairness and other data protection principles, remained unresolved.
Criteo
In 2023, the French Data Protection Authority (CNIL) fined Criteo, an advertising company (the controller), €40,000,000 for breaches of the GDPR related to the processing of browsing data through cookies for the purpose of placing personalised advertisements. The decision followed complaints lodged by Privacy International and noyb. The DPA found violations of Article 26(1) GDPR and Article 26(2) GDPR based on the lack of a joint controllers' agreement with its partners, Article 7(1) GDPR by processing user data without consent, Article 7(3) GDPR and Article 17 GDPR by failing to erase data subjects’ personal data based on their requests, and Article 12 GDPR, Article 13 GDPR, and Article 15 GDPR by failing to inform data subjects of the processing of their personal data. The controller appealed the decision asking for its annulment or, alternatively, the reduction of the fine. First, the Council of State (the court) held that the controller processed personal data since the identification of individuals would not be technically impossible based on the very large amount of information, sometimes very precise, collected and cross-referenced for a given identifier assigned to each data subject. Secondly, the court noted that the controller did not contest the DPA’s findings regarding the lack of a joint controllers' agreement. Thirdly, it found that the DPA’s conclusion regarding the violation of Article 7(1) GDPR did not disregard the principles of legality of offenses, presumption of innocence and exclusion of liability for others in criminal matters. Fourthly, it dismissed the argument that the contested decision was based on error of fact and assessment regarding the information provided to data subjects on the purposes for which their data were processed. Finally, the court noted that the controller could not rely on legitimate interest for continuing to process the data of data subjects who requested their erasure. Therefore, the court dismissed the controller’s appeal.
Court case 3 U 31/25
The controller is a company that operates several social media platforms, as well as software products grouped under the term “Business Tools“. Third parties can integrate the Business Tools into their websites and apps (subject to the controller’s Terms of Use) to track data subjects and display personalised advertising on data subjects’ social media platforms. Third parties process data subjects’ personal data (such as their IP address, operating system or time zone) and transfer this data to the controller. The data is processed regardless of whether the data subject is logged into one of the controller’s platforms. The business tools are used on a wide range of high-traffic websites and related apps. A data subject brought a case to the Mühlhausen Regional Court. According to the data subject, the “M Pixel“ (part of the Business tools) is designed to identify them, track their internet use outside of the social media platform, and draw inferences about their political views, health status or sex life/sexual orientation without their consent. In addition, the data subject claimed that the controller denied any data processing in relation to the Business Tools, following an access request from the data subject. The data subject argued that they could never know with certainty whether the controller is tracking them, and has therefore lost control over their data. The data subject requested the court to order the controller to provide access in accordance with Article 15 GDPR.This includes the data processed on third party websites and apps, what data the controller disclosed to third parties, the storage period, and whether the data was used for automated decision-making. In addition, the data subject requested the court to order the controller to completely erase and anonymise all data and to pay the data subject at least €5,000 in damages. The controller argued that the data subject had not provided substantiated evidence to support their claims (including the claim for damages). In addition, the data subject could exercise control over their activity-related data through the settings in their social media account. The controller argued that the third parties acted as controllers within the meaning of Article 4(7) GDPR. According to the controller, third parties are primarily responsible for processing the data and obtaining the consent from data subjects. Finally, the controller argued that the data processing was lawful because it was based on data subjects’ consent, and that it fulfilled its information obligations following the data subject’s access request. The Regional Court dismissed the claim in December 2024. According to the court, the controller fulfilled its information obligations. In addition, the data subject was not entitled to erasure under Article 17(1) GDPR, because they did not demonstrate that the processing was unlawful. Specifically, there was no evidence that the controller processed sensitive personal data (Article 9(1) GDPR). Similarly, the data subject did not have the right to anonymisation under Article 17(1) GDPR. Therefore, the data subject was not entitled to compensation. The data subject appealed the case to the higher regional court in January 2025, requesting a minimum of €1,500 in damages. The data subject amended their claim to exclude the request for anonymisation. The data subject added that they could not provide evidence of tracking through the Business Tools because they do not know when they are being tracked. The court first clarified that the company operating the Business Tools was the controller in accordance with Article 4(7) GDPR, as it had the authority to determine the scope of data processed using the tools. The court stated that it was irrelevant that the controller does not decide how third parties use the tools. At most, the company could be considered a joint controller with third parties (Article 26(1) GDPR), which would not limit data subjects from asserting their rights against the controller. == The court found a violation of Article 15 GDPR, as the controller had failed to fulfil its information obligations in relation to the data subjects access request. The data subject did not need to object to the processing in order to exercise the right to access, and the argument that the tools are an integral part of the Internet could not be used to dismiss the data subjects request. In addition, the court stated that the controller could not refuse an access request on the grounds that thousands of other data subjects had also requested access to their data. Finally, the court stated that the controller deliberately misunderstood the access request, and failed to provide information on the data storage periods and safeguards, the existence of automated decision-making, and disclosure of data to third parties. According to the court, the self-service tools of downloading your own data provided largely meaningless information that was not individualised. The court ordered the controller to provide the data subject access to information related to their off-site data, as well as the storage periods (including the country), and the existence of automated decision-making and logic involved. == The court found a violation of Article 17 GDPR. The court dismissed the previous courts ruling, and stated that its reasoning on the data subjects burden of proof risked violating the right to a fair trial under national law. According to the court, it is virtually impossible for data subjects to account for all their internet activities, especially if they regularly delete their browser history. In addition, the court considered that the average data subject would inevitably come in contact with the controller's Pixel, based on the fact that it is active on 30 to 40% of all websites. Therefore, the controller's involvement is beyond doubt, and this is sufficient to answer the question of the legality of the tools. Finally, the controller has the burden of proof, in accordance with the principle of accountability (Article 5(2) GDPR). This extends to demonstrating compliance with GDPR principles, such as purpose limitation. The court found that the controller processed personal data unlawfully through its Business Tools. The court found that the controller could not rely on any of the legal bases under Article 6(1) GDPR. Specifically, it could not rely on consent (Article 6(1)(a) GDPR), as the controller indiscriminately processed data subjects' data even if they do not consent. Similarly, it could not rely on contract (Article 6(1)(b) GDPR), as it did not explain why it is necessary to process data subjects' internet usage outside of its social media platforms for the performance of the contract. In terms of legitimate interests, the court stated that the controller failed to explain why the processing was necessary, and therefore it was not necessary to determine whether its interests outweigh data subjects' rights. Nonetheless, it referred to CJEU case law, stating that data subjects' fundamental rights and interests outweigh the controllers interest in enhancing profits through personalisation of advertising.See Case C‑252/21 (Meta Platforms Inc and Others v Bundeskartellamt), margin 117, https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62021CJ0252 or the GDPRhub summary of the case: CJEU - C-252/21 - Meta Platforms and Others (General terms of use of a social network) Finally, the court found that the controller had unlawfully processed sensitive personal data (Article 9(1) GDPR) by linking sensitive data on websites visited by the data subject to their profile on the social media platform. The court found it sufficient that the websites and apps are related to sensitive information and that it is only possible to infer aspects such as political orientation when considering the data collected as a whole. The court stated that the data subject had the right to have their data erased in relation to the Business Tools, as none of the grounds for exclusion under Article 17(3) GDPR applied. The court noted that a self-service tool was not sufficient to fulfil this right, and that the data subject was not required to use it or accept the complete deletion of his social media platform profile. The court ordered the controller to erase all personal data on third party websites and apps used to identify the data subject within six months. == The court found that the conditions under Article 82(1) GDPR were met; the controller processed data unlawfully, the data subject suffered damage (loss of control over their data), and there is a link between the infringement and damage. The court noted that the controller could not avoid liability by referring to its terms of use with third parties. Therefore, the court considered the amount of €3,000 in non material damages as appropriate. The court took into consideration the potential sensitive data processed (Article 9 GDPR), the loss of control and the duration of the violation.
ANSPDCP
A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him for the placement of optional cookies onto users’ devices when visiting his website, as well as for failing to inform data subjects of the processing of their personal data via the contact form available on the website. The DPA sanctioned the controller a total of RON 50,286.80 (approximately €10,000) for breaching Article 4(5)(a) & (b) Romanian Law no. 506/2004 transposing e-Privacy Directive 2002/58 and Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The controller claimed in its appeal that, among other things, the DPA failed to include in its decision the complete mandatory information prescribed by administrative law, that the cookies placed on the users’ devices were necessary, and that data subjects were informed of the processing activities on the website. Therefore, the controller requested the annulment of the DPA decision. The court dismissed the controller’s appeal. It found that the website links directing to the privacy policy and information notice were not functional, but that they became functional following communications from the DPA to the controller. Furthermore, the court noted that website users did not have a clear and visible way of providing consent to the use of cookies on the website. Moreover, the court found that the DPA decision contained most of the necessary information required by law. The court noted that the missing information referred only to the objections of the controller. However, the court emphasised that such an omission did not require the annulment of the DPA decision, since the controller was able to raise his objections during the appeal. Finally, the court emphasised the electoral context in which the violations occurred, pointing out that the increased danger for the unlawful processing of the personal data collected via the website at that time. Therefore, the court dismissed the controller’s appeal and maintained the DPA’s decision in the case.
Court case 6 U 81/23
The controller placed cookies on the data subject’s terminal equipment and processed the resulting data for advertising purposes without obtaining the data subject’s consent. The personal data concerned included, in particular, the data subject’s IP address and a cookie identifier. The data subject brought an action before the Regional Court (LG Frankfurt), seeking an injunction and compensation for non-material damage. The controller argued that the data subject had knowingly triggered the processing and that the data were only processed in aggregated and pseudonymised form. The controller further contended that the data subject could have deleted the cookies from his device at any time. The Court rejected these arguments and granted an injunction and awarded damages of €1,500 to the data subject. The controller subsequently appealed the decision to the OLG Frankfurt. The Court partially upheld the lower court's decision. The court held that the controller could not rely on the fact that the data subject was technically able to delete cookies from his terminal equipment. The lawfulness of processing depends on the existence of valid prior consent, not on the data subject’s ability to mitigate the effects of unlawful processing after the fact. The Court further clarified that the burden of proof for demonstrating valid consent rests with the controller. Accordingly, the controller’s argument that the data subject had failed to show that he did not consent was dismissed as irrelevant. With regard to damages, the court found that the infringement did not result in a significant loss of control over personal data, as the data subject was aware of the processing and the personal data at issue (IP address and cookie ID) were not particularly sensitive. Nevertheless, the court held that the storage and processing of cookies for advertising purposes without consent gave rise to a feeling of being monitored, which amounted to non-material damage. Given that the impairment suffered by the data subject was minor, the Court considered an award of €100 in non-material damages under Article 82 GDPR to be appropriate.
Meta Platforms Ireland Limited
The case was about unlawful processing of personal data for advertising without a valid legal basis, not specifically about cookie or consent banner violations.
Court case C/10/677340 / HA ZA 24-317
Criteo placed tracking cookies on users' devices through third-party websites without obtaining prior consent.
Inteligo Media SA
Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service). On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose. The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court. In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: #In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free daily newsletter: ##(a) is that email address obtained by the publisher of the online news publication “in the context of the sale of a product or a service” within the meaning of Article 13(2) of Directive 2002/58 ('e-privacy Directive')? ##(b) is the transmission by the news publisher of a newsletter such as that described in the abovementioned point (ii) carried out “for direct marketing of its own similar products or services” within the meaning of Article 13(2) of [Directive 2002/58]? #If the answers to Question 1(a) and (b) is "yes", which of the conditions laid down in Article 6(1)(a) to (f) of [the GDPR] apply when the publisher uses the user’s email address for the purpose of sending a daily newsletter [...], in accordance with the requirements of Article 13(2) 'e-privacy Directive'? #Does Article 13(1) and (2) 'e-privacy Directive' preclude national legislation which uses the concept of “commercial communication” laid down in Article 2(f) of [Directive 2000/31/EC] instead of the concept of “direct marketing” laid down in the 'e-privacy Directive'? If not, does a newsletter [...] constitute a “commercial communication” within the meaning of Article 2(f) of [Directive 2000/31]? #If the answers to Question 1(a) and (b) are in the negative: ##(a) does the transmission via email of a daily newsletter[...] constitute “use … of electronic mail for the purposes of direct marketing” within the meaning of Article 13(1) 'e-privacy Directive'? ##(b) must Article 95 GDPR, in conjunction with Article 15(2) 'e-privacy Directive', be interpreted as meaning that failure to comply with the conditions for obtaining valid consent from the user pursuant to Article 13(1) 'e-privacy Directive' will be penalised in accordance with Article 83 GDPR or in accordance with the provisions of national law contained in the act transposing the 'e-privacy Directive', which contains specific penalties? #Must Article 83(2) GDPR be interpreted as meaning that a DPA which decides whether to impose an administrative fine and decides on the amount of the administrative fine in each individual case is obliged to analyse and explain in the administrative act imposing the fine the effect of each of the criteria laid down in points (a) to (k) on the decision to impose a fine and, respectively, on the decision regarding the amount of the fine imposed? = # The newsletter constitutes direct marketing # Article 13(2) 'e-privacy Directive' is lex specialis to Article 6(1) GDPR # The DPA must not necessarily explain all criteria in Article 83(2) GDPR when imposing fines = The AG summarized that the referring court seeks to ascertain, in essence, whether it can be considered that a user’s email address obtained when he or she creates an online account entitling them to free access to a number of articles/resources and to receive, by email, a daily newsletter, is obtained ‘in connection with the sale of a product or a service’ and whether the transmission of the daily newsletter constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of Article 13(2) 'e-privacy Directive'. The AG considered CJEU, C-484/14, McFadden, opining that the Personal update pursued an advertising purpose which in turn constitutes an indirect form of remuneration which satisfies the CJEU’s definition of a ‘sale’. Thus, the AG opined that Article 13(2) 'e-privacy Directive' must be interpreted as meaning that a user’s email address obtained when he or she creates an online account entitling him or her to a 'Personal Update' such as the one in question constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of that provision. = The AG opined, that Article 95 GDPR establishes the principle lex specialis derogat legi generali for the relationship between that directive and the GDPR: whenever there is a specific provision in Directive 2002/58 entailing obligations with the same objective as corresponding provisions in the GDPR, it is the provision 'e-privacy Directive' which must be applied. The AG held, that Article 13(2) 'e-privacy Directive' comprehensively governs the conditions and purposes of the processing as well as the rights of the data subject and imposes ‘specific obligations’ on the controller, within the meaning of Article 95 GDPR including specifically the question of consent. As a consequence, the AG found, that recourse to the GDPR, in particular Article 6(1)(a) to (f) GDPR, is neither possible nor necessary. = The AG considered the question, if Article 13(1) and (2) 'e-privacy Directive' precludes transposing national legislation which replaces the term ‘direct marketing’ with the term ‘commercial communication’, as defined in Article (2)(f) of Directive 2000/31 to be hypothetical with respect to the case at issue and therefore inadmissible. The AG opined that, commercial communication has a wider scope that encompasses the concept of direct marketing; thus all direct marketing constitutes commercial communication, but not all commercial communication constitutes direct marketing. = The AG summarised the question as to whether, when a DPA imposes an administrative fine, it is required to analyse and explain in the administrative act concerned the impact of each of the criteria provided for in Article 83(2)(a) to (k) GDPR. Since that question refers to the eventuality that the GDPR is applicable to the present case, the AG responded only in case that the CJEU should decide contrary to his Opinion above. The AG concluded, that as long as an individual can understand the grounds of the individual measure adversely affecting them, the obligation springing from the principle of respect for the rights of the defence) of the administration to state reasons for a decision which are sufficiently specific and concrete is complied with, without it being necessary to go into detail regarding each of the criteria listed in Article 83(2) GDPR. = == The Court referred to its existing case-law when explaining the concept of communications ‘for the purpose of direct marketing’. It highlighted that the concept covers communications which pursue a commercial purpose and are addressed directly and individually to a customer (Case C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz, para 47, available here), such as advertising messages promoting services in the form of emails sent to the user’s inbox. The Court held that the communication was intended to entice users to access the paid content provided by the published, thus promoting the sale of that content and pursuing a commercial purpose. Lastly, the Court emphasised that, by being ‘directly displayed in the inbox’ of the recipient, the newsletter qualifies as direct marketing. Therefore, the Court held that a newsletter containing a summary of articles on new legislation, hyperlinks to those articles and to content available for a fee, sent directly to the email inbox of a user constitutes a use of electronic mail ‘for the purposes of direct marketing’ within the meaning of Article 13(1) and (2) Directive 2002/58/EC (e-Privacy Directive). == The Court referred to the Advocate General’s Opinion when discussing the definition of a ‘sale’. It noted that the term covers only transactions involving payment. At the same time, it emphasised that Article 13(2) e-Privacy Directive does not distinguish between the type of services provided. Therefore, the Court applied the reasoning for the concept of services under Directive 2000/31 to the interpretation of Article 13(2) e-Privacy Directive. Specifically, the Court reiterated that remuneration of a service does not require that payment is made by those for whom the service is performed. Thus, the Court held that the cost of advertising paid content through the newsletter is included in the price of that content, meeting the requirement of payment and falling within the concept of ‘a sale of … a service’ under Article 13(2) e-Privacy Directive. = The Court noted that Article 13(2) e-Privacy Directive imposes specific obligations on the controller for the processing activities carried out on personal data in the context of a communication falling within its scope. At the same time, Article 95 GDPR and recital 173 exclude the application of the Regulation to matters which are already subject to specific obligations under the e-Privacy Directive. Therefore, the Court held that the lawfulness of the processing of personal data in relation to a communication within the scope of Article 13(2) e-Privacy Directive can be established based on that provision without applying the conditions in Article 6(1) GDPR as well. = The Court held that there was no need to give an interpretation to the concept of ‘commercial communication’ since the newsletter falls within the concept of ‘direct marketing’. = The Court held that there was no need to answer point (b) of the fourth question and the fifth question.
Apple Distribution International Limited
The DPA imposed an €8 million administrative fine on Apple (the controller) in 2022 (CNIL - SAN-2022-025). The DPA found that Apple used identifiers stored on users’ devices to enable personalized advertising in the App Store without first obtaining valid user consent, as required by Article 82 of the French Data Protection Act, which implements Article 5(3) of the ePrivacy Directive. Apple challenged the sanction before the Supreme Administrative Court (Conseil d’État), arguing that the DPA lacked jurisdiction, that the investigation violated Apple’s procedural rights, that the advertising-related processing did not fall within the scope of Article 82, and that the case should be referred to the Court of Justice of the EU. Apple also claimed that the fine was disproportionate. The court held that reading identifiers stored on user devices for the purpose of delivering personalised advertising constitutes access to information under Article 5(3) of the ePrivacy Directive, requiring the controller to obtain the user’s prior consent. It reasoned that since this operation was to implement personalized advertising it could not fall within the exemptions to the consent requirement. The court found that the national authority was competent because the controller’s establishment within the country contributed to the advertising operations in question. It did so by marketing devices pre-equipped with the App Store where personalized advertising appears and by providing Search Ads Specialists who helped monetize and optimize that advertising space. It also rejected the controller’s claim that the authority had violated its procedural rights, finding that the right to remain silent did not apply during CNIL investigations and that the authority had lawfully carried out the investigation providing sufficient opportunity for the controller to respond. Additionally, the court rejected Apple's request to reference the case to the Court of Justice of the EU stating that there wasn't any reasonable doubt Finally, it held that the €8 million fine was proportionate, noting the scale of the processing, the number of affected users, and the economic significance of the advertising activity.
Der Standard
Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked. The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR. In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban. The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a processing ban. The Court first stated that personal data was processed when the data subject visited the controller’s website, in agreement with the reasoning of the DPA. Recording the preferences of the data subject’s consent through a TC stringA TC string is a "combination of letters and characters which encodes and records user preferences through consent management platforms (CMPs), when they visit a website or app. The TC String is then shared with ad platforms and other participants of the ad-tech ecosystem". For more information, see https://privacymatters.dlapiper.com/2024/03/cjeu-ruling-clarifies-data-protection-and-e-privacy-issues-in-the-ad-tech-space/ falls under the definition of personal data according to Article 4(1) GDPR and CJEU case law.C-673/17, para. 45, 67; ECJ 07.03.2024, C-604/22 para. 50 The Court then stated that the data processing under the “Pay or Okay” model does not fall under the definition of media privilege. The GDPR allows for derogations in its provisions in cases where it is necessary to reconcile the right to data protection and the right to freedom of expression and information. However, processing personal data through cookies could not be considered processing for journalistic purposes, as it does not in itself contribute to a debate of general interest. According to the Court, this was the case even if the processing finances the working framework for journalists. Finally, the Court agreed with the reasoning of the DPA that the controller could not argue that the processing was exclusively for journalistic purposes, as it was also not fully aware of the data transferred to social media platforms or its use. In terms of the granularity of consent and the “Pay or Okay” model, the Court first noted that the DPA is not bound by previous legal opinions. The Court found a violation of Article 6(1)(a) GDPR, as consent was not granular; the data subject did not have the option of consenting to a specific processing purpose, but instead could only give a blanket consent to the controller’s processing. This is supported by EDPB Guidelines,See EDPB, 'Guidelines 05/2020 on consent under Regulation 2016/679', 4 May 2020 (Version 1.1) (available https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) and EDPB, 'Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms', 17 April 2024 (available https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf). which state that in consent or pay models data subject should be able to choose which individual purposes they wish to consent to, rather than only having the option to consent to a bundle of all processing purposes. The Court dismissed the controller’s argument that the purposes of optimising the website and advertising were closely connected. Therefore, the data subject’s consent was not valid. The Court saw no need to consider the other legal bases under Article 6(1) GDPR, as the controller cannot retroactively invoke another legal basis when consent is not valid. Finally, the Court upheld the decision of the DPA in rejecting a processing ban. The Court noted that the data subject does not have the subjective right to a specific remedy, and that the DPA had correctly rejected the request to issue a processing ban.
Meta Platforms Inc.
The Federal Press Office operated a fan page on the social network Facebook, provided by Meta Platforms Inc., where it provided information about current political activities of the Federal Government. When users visited the page, cookies could be placed on their end devices. In 2023, the Federal DPA (BfDI) prohibited the Federal Press Office from operating its fan page because the design of the cookie banner used by Meta was not GDPR compliant. It held that the Federal Press Office was regarded a joint controller, together with Meta, responsible for ensuring that the data processing regarding cookies was based on a sufficient legal basis such as consent. Therefore, not only Meta, but also the Federal Press Office, as the operator of the fan page, was legally obliged to obtain the consent of the respective visitor. Both the Federal Government and Meta appealed against the DPA's decision addressed to the Federal Press Office before the court of first instance (Cologne Administrative Court-VG Cologne). The court held that under the GDPR, Meta and the Federal Press Office were not joint controllers for the contested data processing. Meta was solely responsible for obtaining the consent of visitors of the fan page for the placement of cookies. It ruled that the Federal Press Office's contribution to the storage and reading of cookies was limited to the operation of the page. In particular, the Federal Press Office could not specify any parameters for the placement of the cookies and the analysis of the data collected. In the opinion of the court, the mere facilitation of data processing does not constitute the necessary joint determination of the means of data processing. Consequently, the Press and Information Office of the Federal Government was permitted to continue operating its Facebook fan page.
Data Subject versus Social Media Platform Operator
The social media platform was accused of tracking users through embedded Business Tools without consent, violating cookie consent requirements.
IAB Europe
IAB Europe (“IAB”, short of Interactive Advertising Bureau) is an association of undertakings active in the field of digital advertising such as publishers, ecommerce and marketing companies and intermediaries, including major international players such as Microsoft and Google. IAB is established in Belgium and operates on a European level. IAB developed the “Transparency & Consent Framework” (“TCF”). The purpose of the TCF is to make the processing of personal data for online advertising compliant with data protection requirements. To this end, the TCF provides a set of technical standards and rules (in the form of contractual obligations) for companies in the sector. In particular, the TCF specifies how publishers, advertisers, and intermediaries should use the OpenRTB protocol, a widely used Real Time Bidding (“RTB”) system. RTB consists in the instant and automated online auction of users profiles for the purpose of selling and purchasing advertising space online. When an internet user visits a webpage where advertising space is available, the server sends the user’s data to a platform where advertisers automatically and instantly place bids. Advertisers place their bids based on some characteristics of individual users visiting the page (such as their location, marketing profiles, and browsing history). The bid winner displays their customer's advertising in that specific advertising space. The whole process involves a mass exchange of personal data. For this operation to be possible, users are (in principle) asked to express their advertising preferences when they first visit a publisher’s website. These preferences are collected by websites (more specifically, by each website's Consent Management Platform) and stored in a string called Transparency and Consent string (‘TC string’). The TC string is subsequently shared with advertisers and data brokers, in order to inform them of the user's preferences. At the same time, the CMP writes a cookie called euconsent-v2 on the user’s device. In combination with the TC string, the euconsent-v2 cookie can reveal the user’s IP address. In 2019 a number of complainants, including several non-profits, filed complaints with different DPAs against the TCF. The DPA decision [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_21/2022 The Belgian DPA, as lead supervisory authority, ruled] that IAB was acting as a joint controller (along with the TCF participants) in relation to the TC string. The DPA also considered that this processing influenced the OpenRTB protocol and that IAB was therefore a joint controller in relation to the OpenRTB as well. It also found several breaches of the GDPR. As a result, the DPA fined IAB €250,000. The decision was adopted pursuant to the cooperation procedure under Article 60 GDPR, in the context of which 21 supervisory authorities agreed with the DPA’s draft decision during the procedure. IAB challenged the DPA decision IAB challenged the decision before the Court of Appeal of Brussels (hereafter the Court). In particular, IAB claimed that the TC string did not constitute personal data, and that even if it did, IAB was not a controller for the processing in relation to the TC strings. In particular, it claimed that by creating the TCF, it merely set a standard for processing personal data across the organizations handling TC strings. In IAB's view, this did not amount to actually processing data. Request for preliminary ruling The Court of Appeal referred several questions to the CJEU. In 2024 the CJEU issued a preliminary ruling in which it confirmed (i) that TC strings were personal dataCJEU, Case C-604/22, IAB Europe, 7 March 2024, margin 51 (available [https://curia.europa.eu/juris/document/document.jsf?docid=283529&doclang=en here]). and (ii) that IAB was a joint controller for the processing in relation to the TC stringsCJEU, Case C-604/22, IAB Europe, 7 March 2024, margin 77 (available [https://curia.europa.eu/juris/document/document.jsf?docid=283529&doclang=en here])., along with the other recipients of the string. The CJEU specified that its findings about IAB’s qualification as a controller, did not extend to the entire data processing happening through the OpenRTB protocol. In other words, IAB was a controller for the TC string processing, but it did not necessarily follow that it was a controller for the broader processing of personal data in the OpenRTB protocol for the purpose of targeted advertising. The Court resumed the proceedings after the preliminary ruling of the CJEU. On the nature of the TC string Further to the preliminary ruling, the Court observed that IAB members - who were recipients of the TC strings - held data that could identify the data subject when combined with the TC string. This implied that the TC string qualified as personal data, irrespective of the possibility for IAB to actually identify users. The Court then examined if IAB could actually identify users. It held that under IAB's internal policies, which are binding for the other participants in the TCF, IAB could require to access data which, in combination with the TC string, could identify users. The Court concluded that as IAB could require such information, it had reasonable means to identify the users. For these reasons, the Court held that TC strings were personal data in the meaning of Article 4(1) GDPR. On the processing of personal data The Court then confirmed that once created, the TS strings are then structured and organized by IAB, which qualifies as a processing operation within the meaning of the GDPR. On IAB’s controllership The Court then examined if IAB qualified as a controller under Article 4(7) GDPR. The Court noted that IAB shares a purpose with other participants in the TCF: that users preferences are captured in a structured way and the shared with other participants. Given its overriding control over the TCF, the Court found that IAB held clear decision making power both over the purposes and means of the processing. Regarding the joint controllership, the Court distinguished between the processing in relation to the TC String and the processing in the context of the OpenRTB protocol. For what concerns the TC Strings, the Court confirmed that IAB was jointly responsible, with the TCF participants, for storing data subject's consent preferences in the TC string. It therefore qualified as a joint controller. For the processing in relation to the OpenRTB, the Court however refused to follow the DPA's reasoning. It considered that the scope of the litigation was limited to the processing within the TCF and that the DPA did not sufficiently prove that IAB was a joint controller in the context of the OpenRTB protocol. The Court therefore found that IAB's claim was founded only to the extent that the DPA decision considered that IAB acted as a joint controller in the context of the OpenRTB protocol. On other violations The Court mostly upheld the DPA’s findings and confirmed that IAB violated Articles 5(1)(a), 5(1)(f), 6, 13, 14, 24, 25, 30, 32, 35, and 37 GDPR. In particular, the Court confirmed that: * IAB had no legal basis under the GDPR to process TC strings. In particular, the Court confirmed the DPA's findings on the legal basis of legitimate interest: IAB failed to correctly balance its legitimate interest with that of the end users and, therefore, could not invoke legitimate interest as a legal basis for processing the TC string. * IAB failed to inform website visitors about the processing of personal data, in violation of the controller's transparency obligations; * the TCF did not meet GDPR standards for data protection by design and default; * IAB failed to appoint a data protection officer and carry out a data protection impact assessment. Conclusion In conclusion, the Court upheld most of the DPA reasoning and confirmed the €250,000 fine imposed. The only part of the DPA decision that was not confirmed was the extension of IAB's controller quality to the full OpenRTB protocol. The Court did not specifically decide on the matter but considered that it was out of scope of the present proceeding and that the DPA did not sufficiently justify its reasoning. The Court also specified that the case would not be sent back to the DPA.