Overview
Although the German parliament has failed to transpose the Cookie Directive into German law, operators of websites must require explicit consent before setting cookies on users’ computers, the German Federal Court of Justice ruled. The judgment can also affect website operators and app providers outside of Germany.
In Depth
Cookies are small pieces of information that are stored on the device of an end-user when they visit a website. In the European Union, the “Cookie Directive”, or more precisely Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) sets out the rules for website operators and other providers of information society services who want to remotely store or access information on end-user devices. As of the latest amendment by Directive 2009/136/EC, providers are required to obtain informed consent (“opt-in”) unless the cookie is strictly necessary for providing the website or service (functional cookies).
Germany, however, has failed to correctly transpose this requirement into German law. Instead, Section 15 of the German Telemedia Act (Telemediengesetz; TMG) allows website operators to create pseudonymous user profiles for advertising, market research and usability purposes. For that, the text of the TMG does not require opt-in but only that the user be informed and be allowed to object (“opt-out”).
As Directives are, in general, not directly applicable in the Member States, website operators in Germany would often not implement the strict EU cookie requirements, pointing out that German law is more permissible.
Decision of the Court
The German Federal Court of Justice (Bundesgerichtshof; BGH) decided (judgment of 28 May 2020, Cookie Consent II, I ZR 7/16 , not yet published) that websites in Germany must follow the European cookie rules. Instead of applying Section 15(3) TMG literally, the highest German court in private law matters pointed out that the German legislators intended the provision to comply with the ePrivacy directive. Consequently, the lack of valid consent should be equivalent to an “objection” under the TMG. With this flexible interpretation of the TMG, the court thus avoided a ruling that would be contrary to the EU directive.
Regarding the requirements for consent under the ePrivacy Directive, the BGH had already referred (decision of 5 October 2017, Cookie Consent I, I ZR 7/16, ECLI:DE:BGH:2017:051017BIZR7.16.0) to the Court of Justice of the EU (CJEU) for a preliminary ruling (judgment of 1 October 2019, Planet49, C-673/17, ECLI:EU:C:2019:801). In line with the EU court’s judgment, the German court confirmed that website operators cannot use pre-checked checkboxes to obtain consent. Furthermore, the requirements apply regardless of whether the information contained in the cookie is personal data subject to the GDPR (Regulation (EU) 2016/679).
Implications
The decision confirms that website operators in Germany are subject to the same cookie rules as their peers in other Member States of the European Union (EU) and the European Economic Area (EEA). If they relied on the text of the German TMG, they will now need to implement the means to obtain cookie consent on their website – unless they do not use cookies at all or only use functional cookies.
Compared to other countries in the EU/EEA, however, operators of websites in Germany are at a higher risk of litigation. In Germany, consumer protection laws are not enforced by potentially understaffed authorities but by competitors under the German Act Against Unfair Competition (Gesetz gegen den Unlauteren Wettbewerb; UWG) as well as private consumer protection associations under the Prohibitory Injunction Act (Unterlassungsklagengesetz; UKlaG). Furthermore, even the legal costs for the initial cease-and-desist letter must be paid by the losing party. There is thus virtually no cost and risk for a competitor or association taking action against a website operator who fails to obtain proper consent.
However, it is not just website operators in Germany who may be affected by this ruling of the BGH.
It is likely that the courts will apply German law to website operators outside of Germany, including those outside the EU/EEA, if their website is targeted at an audience in Germany and thus affects consumers or competitors in Germany (this follows from Article 6 of Regulation (EC) No 864/2007). Such targeting may be implied inter alia by the use of the German language, the listing of offices in Germany, the mentioning of customers in Germany, or other special arrangements for customers in Germany.
Many of these website operators were, in theory, already required to implement the EU cookie rules as they were already targeting audiences in other member states but in practice, this was rarely enforced. The BGH’s decision increases the risk for those website operators as consumer associations and competitors in Germany can now rely on this decision in order to take action under the UKlaG or UWG.
Consequently, website operators outside of Germany – in particular outside the EU/EEA – who target a German audience should now bring their website in line with the EU cookie requirements.
——–
For more information, please contact your regular McDermott Will & Emery lawyer or an author.
