The Federation of German Consumer Organizations had sued a website operator for injunctive relief, among other things. The point of contention was a competition offered on the website. In order to take part in the competition, users had to tick at least one of two checkboxes and thus consent to certain advertising and cookies.
The Federal Court of Justice had to clarify two questions at once: Firstly, consent to telephone advertising and secondly, consent with regard to cookie storage (judgment of May 28, 2020, case reference: I ZR 7/16 – Cookie Consent II).
Consent to telephone advertising must be clearly recognizable to advertising companies
The first field was not preselected. Those who ticked this box were asked to give their consent to receive advertising from up to 57 sponsors and cooperation partners, e.g. by telephone.
With regard to consent to telephone advertising via general terms and conditions, the BGH objected to the fact that such general terms and conditions consent to advertising must identify the specific products and advertising companies.
No cookie consent possible with preset checkbox
The second field for the competition contained the following text:
I agree to the use of the Remintrex web analysis service. As a result, the competition organizer, [Beklagte], sets cookies after registration for the competition, which enables [der Beklagten] to evaluate my surfing and usage behavior on websites of advertising partners and thus interest-based advertising by Remintrex. I can delete the cookies at any time. Read more here.
where the word “here” led to further information about how the cookie works. This field was already ticked and should therefore have been actively deselected by the user. It was not possible to take part in the competition if both boxes were unchecked.
The BGH did not consider this preselected cookie notice to be effective consent. It thus follows the decision of the ECJ of October 1, 2019, Ref.: C-673/17.
General Data Protection Regulation has not changed the legal situation
The competition and the subsequent warning took place at the time of the Data Protection Directive, and therefore before the General Data Protection Regulation (GDPR) came into force. However, this did not result in a change in the law. Consent was not valid under either the old directive or the GDPR if the checkbox was preselected.
Consumer associations authorized to pursue data protection law?
However, whether consumer associations can also issue warnings for data protection violations and sue in civil courts did not have to be decided in this case. In this case, the BGH considered the pre-selected checkbox to be an inadmissible general terms and conditions for participation in the competition.
However, the question of whether the GDPR conclusively regulates who may prosecute data protection violations and how arises in many other cases. For this reason, the BGH referred this question to the ECJ for a ruling on the same day in another case (decision of May 28, 2020, case reference: I ZR 186/17).