Judgments of the European Court of Justice are of great importance and regularly give rise to debate. The judges found that technically unnecessary cookies may only be set with the active consent of the site visitor. The solution of using check boxes that are already marked or activated does not do this justice: users do not actively give their consent, but only have to act if they do not want to give their consent – this is generally understood as an opt-out.
Consent - Now Mandatory?
All of this has been reported by our own Melvin Loius Dreyer, Editoral Lawyer – and there is a lot.
One thing can now be said for certain: in the case of cookies and consent, there are some questions that have not been clarified by the ruling of the European Court of Justice. Online retailers are confronted with different views on the Internet as to what effect this now has in practice. In principle, such judgments of the European Court of Justice apply immediately and must be taken into account by all national courts. The case itself, however, was not decided by the European Court of Justice – the Court only helps the inquiring national court to interpret Union Law.
The situation would now be simpler if the legal situation in Germany did not differ from the requirements of the e-privacy directive. The matter becomes a delicate one because there has practically never been a genuine transposition of the provisions into German law: where the e-privacy directive requires active consent, the German Telemedia Act only wants an objection from the person concerned if one does not agree – i.e. an opt-out. And the fact that this law is in force does not directly alter anything – even the ruling of the European Court of Justice. Nevertheless, the e-privacy directive is also in existence and binds the courts.
Any judgment that would have to be handed down here, in such a case, would now have to take into account the ruling of the European Court of Justice. Thus, the case also lies with the Federal Court of Justice, which is now, again, dealing with the dispute that originally led to the judgment of the European Court of Justice in the first place. It is obvious that online retailers should take the judgement into account.
The Checkbox Should Not Be Pre-Activated
"Marking a field on an Internet website", on the other hand, is a solution that meets the requirements for consent. This has also been established by the European Court of Justice and is based on the e-privacy directive. Consent can therefore be given "in any appropriate way which expresses the user's wish in a specific statement which is made in an informed and free decision."
It is therefore important that the user does something actively, decides voluntarily and also knows what they are deciding on – like informing the customers. Consent can, therefore, also be given in ways other than checking a box.
One of these other methods is in use by Digital Business News: for cookies that are not necessary, according to Händlerbund's concept, we of course also obtain the consent of the site visitors – as long as this is not done, the corresponding cookies are not set.
We have some options at our disposal for giving consent:
- corresponding active participation within the cookie banner
- active use of the page (e.g. by scrolling)
This solution is not an isolated, but does not correspond to the restrictive view of the data protection conference – which requires explicit consent (in the form of active ticking).
The legal situation, the judgment and the implementation of what it says provide material for discussion about what needs to be done now. For although the judges have spoken and answered the Federal Supreme Court's questions, for both lawyers and practitioners, this is far from eliminating all ambiguities. And where there are ambiguities, there are compellingly also different interpretations, not to mention perspectives. Many a consumer will be pleased with the judgement because it strengthens the protection of their data from their personal point of view.
Web workers and companies who, for example, work in the area of affiliate marketing, and are therefore dependent on analysis and marketing data that can now be obtained through cookies requiring consent are concerned about the data required for their business. For example, it is also important for Digital Business News: "For the operation of our blogs, we are dependent on advertising revenue, for which, of course, we also have to provide advertising partners with meaningful (anonymous) data about visits and clicks – which must first be obtained. Therefore, the decision was made in favour of this consent solution, which also focuses on the use of the site."
These conditions are not carved in stone. Politicians are working on a new legal course. And even now, it is up to everyone to decide on an interpretation of the legal situation which, according to their own assessment of the legal circumstances, is justifiable and at the same time does not completely sweep away their own interests. Finally, in view of the ambiguous legal situation, there is room for improvement with regard to consent. The active setting of checks is one way of obtaining them, but other connecting factors such as the use of the site do not appear to be excluded as such. There are also "only" solutions for the exact design of cookie banners, but no binding specifications – and which cookies are technically necessary in detail and therefore do not require consent, this too is currently becoming a question of interpretation.
The legal situation surrounding cookies will probably not be solved quickly. The Federal Court of Justice will presumably provide even more clarity with its ruling, and politicians are also in discussion and occupied with it. The situation is unsatisfactory and there is room for discussion between lawyers and experts alike. In this respect, all that remains is to get the best out of the matter at hand. What is certain: to rely on a classic opt-out solution is no longer possible. Further information can be found in Händlerbund's information sheet on consent.