In a ruling dated October 5, 2017 (case reference: I ZR 7/16), the BGH referred the matter to the ECJ for a preliminary ruling.
The ECJ is to clarify the question of the extent to which checkboxes already preset in the user’s end device can constitute effective consent if the user has to deselect them in order to prevent the use of cookies.

Furthermore, the ECJ is to clarify the question of whether it makes a difference in the application of the provisions whether the data is personal data or not.
It is also to be clarified which information the service provider must provide to the user within the scope of Art. 5 para.
3 of the ePrivacy Directive.

The answers to the questions relate in particular to the interpretation of Art. 5 para.
3 i.V.m. Art. 2 f) of the ePrivacy Directive(Directive 2002/58/EC).

Inadequate information for online competitions

The case to be decided by the BGH concerned consent in the context of online competitions.
In order to take part in these online competitions, participants had to enter their personal data – i.e. name and address – and then tick two boxes.

The first checkbox did not have a checkmark in front of it and dealt with consent to advertising by third-party companies by telephone or post.

Consent by means of an already automatically set check mark

The second checkbox, on the other hand, was already marked with a checkmark and contained the following explanation:

I agree that the web analysis service R. may be used on my computer.
As a result, the competition organizer, P. GmbH, sets cookies after registration for the competition, which enables P. to evaluate my surfing and usage behavior on websites of advertising partners and thus interest-based advertising by R..
I can delete the cookies at any time.
Read more here.

Participation in the competition was only possible if the participant ticked the first box.
Consent to the use of cookies, on the other hand, was not a prerequisite for participation.
The user could therefore – if desired – deliberately deactivate the checkbox.

Compatibility of pre-ticked checkboxes with Art. 5 para.
3 of the ePrivacy Directive

The question that the BGH is now asking itself is whether the ticked checkbox violates the basic ideas of Art. 5 para.
3 i.V.m. Art. 2 f) of the ePrivacy Directive.

The directive was to be implemented by the member states by the end of May 2011.
However, Germany did not change the opt-out solution provided for in the TMG, but deliberately retained it.
Other countries are also using the implementation to create an “opt-out” regulation that requires the user to object.

However, an “opt-in” procedure, which requires prior consent, was also chosen by some member states.

Consent must be given expressly

According to the case law of the Federal Court of Justice on the application of Section 7 para.
2 No. 3 UWG, the required consent must be given in advance and expressly.
It prohibits advertising by automated calling machines, fax machines or electronic mail without the consent of the addressee.

Consent clauses in which the customer has to tick a box if they do not wish to give their consent (\”opt-out\” declaration) do not correspond to the concept of consent within the meaning of the ePrivacy Directive.
It is therefore now up to the ECJ to decide to what extent an “opt-in” or an “opt-out” procedure is required when consenting to the use of cookies.

Questions regarding the consent requirement for personal data

The retrieval of data from the cookies used by the online competition provider is subject to the consent requirement of Section 12 para.
1 TMG.
The reason for this is that the data collected is personal data.
Cookies contain a number (ID) that is assigned to the registration data of the user, who has to enter their name and address in the web form provided.
Linking the ID with the personal data entered by the user creates a personal reference to the data stored by the cookies about Internet use.

To date, the BGH has not considered an “opt-in” procedure to be necessary for the validity of consent within the scope of Section 4a para.
1 BDSG does not consider an “opt-in” procedure to be necessary.
However, the extent to which this can also be applied to consent in the present case is still unclear and is therefore to be decided by the ECJ.

Instruction: Comprehensive information obligation when using cookies

The extent to which the online competition provider must inform the user about the use of their data in accordance with Section 13 TMG was previously clear.
To this end, the user must be informed in a generally understandable form about the type, scope and purpose of the collection and use of their personal data.

The user must also be informed separately if subsequent identification is possible using an automated process.
As in this case, this also includes the setting of cookies on the user’s end device.
However, it is still unclear how far the duty to inform under Section 13 para.
1 sentence 2 TMG – with regard to Art. 5 para.
3 of the ePrivacy Directive – extends.
Therefore, the scope of the information obligation is also to be clarified by the ECJ.

In this case, the online lottery provider did provide information that the ID is assigned to the cookies and that the subsequent use of websites is recorded for the registered advertising partners.
However, there was no notification as to whether third parties also have access to the cookies and for how long the cookies are active.
This is also important data for the user, which actually requires clarification.
However, it remains to be seen whether the ECJ will take the same view.