The use of cookies on websites
In its ruling of May 28, 2020 (I ZR 7/16), the German Federal Supreme Court (BGH) addressed the question of whether users must actively consent to certain cookies.
The Federal Association of Consumer Associations had filed a lawsuit against a sweepstakes provider because of a pre-ticked checkbox for cookies that were intended to serve the creation of usage profiles for purposes of advertising or market research.
After referring the matter to the ECJ (judgment of 1.10.2019, C-673/17), the BGH rendered a judgment as the final instance.
The Federal Court of Justice (BGH) has assessed the legality of the use of cookies in accordance with Section 15 (3) Sentence 1 of the German Telemedia Act. In view of Article 5 III of the ePrivacy Directive (Directive 2002/58/EC), this is to be interpreted in conformity with the Directive in such a way that service providers may only use cookies to create usage profiles for advertising or market research purposes with the consent of the user.
Thus, the consent requirement only covers technically unnecessary cookies. These are those that serve tracking for advertising purposes or profiling. In contrast, consent is not required for all cookies that are technically necessary for the operation of a website and its functions.
Neither a “You can continue surfing quietly banner” is sufficient, nor an already pre-ticked checkbox. Users must declare their consent by actively agreeing.
The decisions of the ECJ and BGH have provided clarity on a topic that the GDPR does not address. And a European ePrivacy Regulation, which would contain a clear regulation on cookies, will not come into force any time soon.
Thus, an opt-in instead of an opt-out applies to all technically unnecessary cookies.