LG Rostock - 3 O 762/19
The regional court of Rostock (LG Rostock) held that tracking cookies can only be placed with the user's active consent. A preset permission that is only to be confirmed via an "OK" button is not sufficient.
Further, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google.
The controller appealed, the decision is not (yet) in force.
English Summary[edit | edit source]
Facts[edit | edit source]
The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries.
(Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.)
Dispute[edit | edit source]
- Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)?
- Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR?
- Did the defendant violate GDPR provisions on transparency?
- Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers?
Holding[edit | edit source]
Legal basis and validity of consent[edit | edit source]
The court held that the marketing and analytics cookies used by the defendant can only be placed with the users' consent under Article 6(1)(a) GDPR: § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons.
Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid.
Transparency[edit | edit source]
Sole or joint controllership when using Google Analytics?[edit | edit source]
Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google. Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the official opinion of the "Datenschutzkonferenz", a gathering of all German DPAs.
Comment[edit | edit source]
Please note that the decision is not (yet) in force, as the controller filed an appeal with the OLG Rostock at which the case is now pending. Therefore, the decision is not officially published but only presented on the plaintiff's website, where one can download the (redacted) decision. Once the OLG Rostock has issued its decision, it will be linked here.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original as published on the webiste of the vzbv for more details. Please also note that below translation might be incomplete as is had to be created from a PDF document not readable in MS word.