BayLDA is inspecting apps and websites

The Bavarian State Office for Data Protection Supervision (BayLDA) is currently conducting an unscheduled review of apps and websites to ensure their compliance with data protection regulations. Particular focus is being placed on the consent banners (“cookie” banners) on these sites.

App Audits

In the app reviews, the State Office verifies that user consent is properly obtained for the integration of third-party services. In particular, the processes following installation and when the app is opened for the first time are examined. The review examines whether processes requiring consent are initiated before the user has even had the opportunity to grant consent—for example, via a cookie banner. In particular, the timing of the consent is verified, as well as whether the consent was given as a sufficiently informed, case-specific, voluntary, and unambiguously active act. Attention is also paid to ensuring a simple option for revocation. 

First-level review of opt-out in cookie banners

Since there have been repeated complaints for years regarding third-party services requiring consent—such as cookies on websites—some of which have also led to hefty fines—the BayLDA has been scrutinizing these practices more closely since November 2023. To this end, the supervisory authority has developed its own analysis tool that enables automated review of cookie banners. To date, deficiencies have already been identified on over 350 scanned websites. In this process, the authority closely examines the cookie banners to determine whether, in addition to the option to accept all third-party services requiring consent, there is an equivalent option to reject them at the first level. This review is ongoing.

Cross-State Investigations

Although in this case the supervisory authority is conducting its investigation specifically in Bavaria, past experience has shown that such and similar investigations repeatedly take place across national borders. In addition, the European Data Protection Board (EDPB) recently released an automated tool, which is available for free download as open-source software.

Website audits are therefore becoming easier and faster to conduct, and it is important to pay closer attention to compliance with the GDPR and the TTDSG in these areas.

Sources