We have waited a long time for this and now here it is – the decision of the German Federal Court of Justice (FCJ) in relation to the so-called “Planet 49” case. The origin of the case was a dispute raised by the German Federal Association of Consumer Advice Centres about the design of a cookie consent mechanism on Planet 49’s lottery site. . The dispute centred on the website containing a pre-ticked checkbox that indicated that the web user agreed to the setting of cookies for advertising purposes. The Court of Justice of the European Union European Court of Justice (CJEU) considered this procedure to be legally ineffective under the requirements of the E-Privacy Directive (sometimes referred to as the “Cookie Directive”) valid at the time (judgment of 01.10.2019, Ref.: C-673/17), because a pre-ticked checkbox did not constitute active consent.
Business as usual
First of all, it must be said that so far only press announcements about the decision are available (i.e. the full judgement is not yet available). This post can therefore only refer to what is known so far about the decision – and that is as follows:
Initially, the FCJ states, just like the CJEU, that the use of a pre-ticked checkbox was invalid even prior to the General Data Protection Regulation (GDPR). The judges referred here to section 15(3) of the German Telemedia Act (TMG) and explained:
“In the light of the first sentence of Article 5(3) of Directive 2002/58/EC [the E-Privacy Directive], as amended by Article 2(5) of Directive 2009/136/EC, section 15(3) of the German Telemedia Act must be interpreted in conformity with that directive as meaning that the use of cookies to create user profiles for the purposes of advertising or market research requires the consent of the user.”
So far then it is quite simple: active consent is required if cookies are used to create user profiles for the purposes of advertising or market research. This basically only brings Germany up to speed with most of the rest of the EU and is not very surprising.
The unique German way
In order to be able to understand the further explanations of the court, one has to examine the background legal situation in Germany in relation to the E-Privacy Directive. The version of the Directive in force since 2009 already stated that users must consciously consent to online tracking, yet section 15(3) TMG has never complied with this requirement, instead permitting tracking provided an opt-out is offered. The German data protection authorities, in particular, have been pointing out this discrepancy for years and the CJEU has confirmed this view in its Planet 49 decision.
Looking at the further explanations in the FCJ decision, the court’s remarks on the connection between the TMG and the E-Privacy Directive can be kindly described as “interesting” or “pragmatically creative”. This is what they say:
“Interpretating section 15(3) sentence 1 of the German Telemedia Act as being in conformity with the Directive is not prevented by the fact that the German legislator has not yet made any act of transposition. This is because it can be assumed that the legislator considered the existing legal situation in Germany to be in conformity with the Directive. An interpretation of the wording of section 15(3) sentence 1 German Telemedia Act that is in conformity and compatible with the Directive is still possible. In the absence of (effective) consent, in view of the fact that the legislature saw the Union law requirement for consent implemented in section 15(3) sentence 1 German Telemedia Act, the contradiction according to this provision which contradicts the permissibility of the creation of user profiles can be seen.”
Thus, although the wording of the German provision transposing the Directive said exactly the opposite (namely an opt-out) to what the Directive required, the legislature had in fact meant an opt-in. This reasoning may seem confusing (even after reading it several times), but, in the end, it is a reading which may at least help those like the German legislator and even the European Commission, who had indicated that there was no need to change section 15(3) of the TMG in light of the E-Privacy Directive (for reference see this article), to save face in light of the CJEU judgement.
The end of the (cookie) story…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
