Federal Court of Justice Ruling on the Planet 49 Case

Yesterday, Thursday, the Federal Court of Justice issued a ruling on an issue that has long been a source of legal uncertainty (BGH, judgment of May 28, 2020, Case No. I ZR 7/16, “Cookie Consent II”). Among other things, the ruling addressed the requirements for valid consent regarding advertising and marketing cookies. These are not cookies that are strictly technically necessary to provide the service requested by the user, but rather those that a provider uses to track the user’s behavior on the Internet, create a user profile, and send the user targeted advertising based on that profile.

The BGH’s ruling was based on a previous decision by the ECJ (judgment of Oct. 1, 2019, Case C-673/17). We reported on the ECJ decision. The BGH ruling brings to a close a legal dispute dating back to 2013 between the Federal Association of Consumer Advice Centers and Planet 49 GmbH, a provider of online sweepstakes. In an online sweepstakes, Planet 49 had obtained participants’ consent to store advertising cookies on their devices. However, the checkboxes required for this purpose were already pre-checked. The issue at hand was therefore whether such so-called “opt-out” solutions constitute valid consent. In this context, the legal dispute also centered on whether advertising cookies are subject to § 15(3) of the German Telemedia Act (TMG) and may therefore be implemented even without consent under data protection law, which requires active consent (opt-in).

The Federal Court of Justice (BGH) has now ruled that preset consents (opt-outs) are invalid within the meaning of Art. 6(1)(a), Article 7 of the GDPR  . Instead, informed, active consent within the meaning of data protection law is required for the placement of advertising cookies.

Against this backdrop, the Federal Court of Justice’s (BGH) remarks on the directive-compliant application of § 15(3) of the German Telemedia Act (TMG) are particularly interesting. This is because the actual wording of this provision previously conflicted with Art. 5(3) of the ePrivacy Directive, to which the European Court of Justice (ECJ) also refers in its decision of October 1, 2019. Contrary to Article 5(3) of the ePrivacy Directive, § 15(3) of the TMG states that the service provider may, among other things, create usage profiles for advertising purposes, provided the user does not object. Accordingly, an opt-out by the user would suffice. Despite prevailing doubts regarding the conformity of this provision with European law, the German legislature has thus far maintained it, whereas the data protection supervisory authorities had declared, following the entry into force of the GDPR, that §§ Sections 11 et seq. of the TMG are contrary to European law and can no longer be applied.

In its ruling, the Federal Court of Justice (BGH) states that § 15(3) of the TMG must be interpreted in accordance with Article 5(3) of the ePrivacy Directive to mean that f&the use of advertising and marketing cookies requires the user’s active consent, thereby putting an end to the discussion outlined above. Nor does the fact that the German legislature has not yet implemented the ePrivacy Directive preclude this interpretation in accordance with the directive; rather, it must be assumed that the legislature considers the existing legal situation in Germany to be in compliance with the directive. The Federal Court of Justice (BGH) therefore continues to consider § 15(3) of the German Telemedia Act (TMG) to be applicable and explains that an interpretation in accordance with the Directive is still compatible with the wording of the provision.

In practice, the BGH’s ruling means that when companies use cookies on their websites that are not strictly technically necessary, they must obtain data protection-compliant consent from the user in advance (opt-in). Furthermore, § 15(3) of the TMG remains in effect due to the possibility of an interpretation consistent with the Directive and due toArt. 95 of the GDPR remains unaffected by the GDPR. This contradicts the statement by the supervisory authorities, which, following the entry into force of the GDPR, had categorically rejected the application of § 11 et seq. of the TMG. Nevertheless, for the sake of simplicity, companies can ignore the wording of § 15(3) of the TMG and instead refer directly to Art. 5(3) of the ePrivacy Directive . Consequently, website operators now need to take action to revise their privacy policies and update the corresponding entries in the record of processing activities.

The explanations provided here are based solely on yesterday’s press release from the Federal Court of Justice (BGH). The relevant grounds for the judgment are not yet available. It therefore remains to be seen whether the reasoning behind the ruling might reveal something else.

Sources