Although the German parliament has failed to convert the Cookie Directive into German law, website operators must seek explicit approval before setting cookies on a user’s computer, the German Federal Court ruled. The assessment can also affect website operators and application providers outside Germany.
Cookies are small pieces of information stored on end-user devices when they visit a website. In the European Union, the “Cookie Directive”, or more precisely Article 5 (3) of Directive 2002/58 / EC (Privacy Directive) sets rules for website operators and other information service providers who wish to store remotely or access information on end user device. In the latest amendment by Directive 2009/136 / EC, providers are required to obtain approval (“opt-in”) unless a cookie is indispensable for providing a website or service (functional cookie).
However, Germany has failed to appropriately change this requirement to German law. Instead, Section 15 of the German Telemedia Act (Telemediengesetz; TMG) allows website operators to create a pseudonym user profile for advertising, market research and usability purposes. For this reason, TMG text does not require participation but only that the user is given information and is allowed to refuse (“opt out”).
Because the Directive, in general, does not directly apply in Member Countries, website operators in Germany often do not apply strict EU cookie requirements, indicating that German law is more permissible.
German Federal Court (Bundesgerichtshof; BGH) decided (May 28, 2020, Cookie Consent II, I ZR 7/16, not yet published) that websites in Germany must follow European cookie rules. Instead of implementing Section 15 (3) TMG literally, the highest German court in private law matters shows that of German legislators intended provisions to comply with ePrivacy directives. As a result, the lack of legal approval must be equivalent to “objection” based on TMG. With this flexible interpretation of TMG, the court avoids decisions that would conflict with EU directives.
Regarding the requirements for approval based on the ePrivacy Directive, BGH has referred (Decision 5 October 2017, Permit Cookie I, I ZR 7/16, ECLI: DE: BGH: 2017: 051017BIZR7.16.0) to the European Court of Justice (CJEU) for a temporary decision (ruling 1 October 2019, Planet49, C-673/17, ECLI: EU: C: 2019: 801). In line with an EU court ruling, a German court confirmed that the website operator could not use the check box that was checked for approval. Furthermore, the requirements apply regardless of whether the information contained in the cookie is personal data that is subject to GDPR (Regulation (EU) 2016/679).
However, compared to other countries in the EU / EEA, website operators in Germany have a higher risk of litigation. In Germany, consumer protection laws are not enforced by potentially under-staffed parties but by competitors under the German Law Against Unfair Competition (Gesetz gegen den Unlauteren Wettbewerb; UWG) as well as private consumer protection associations under the Prohibitory Injunction Act (Unterlassungsklagengesetz; UKlaG). In addition, even legal costs for cease and initial termination must be paid by the losing party. As such there are virtually no costs and risks for competitors or associations taking action against website operators who fail to get the right approval.
However, it is not only website operators in Germany who might be affected by this BGH decision.
It is likely that the court will apply German law to operators of websites outside Germany, including those outside the EU / EEA, if their website is targeted at hearings in Germany and thus affects consumers or competitors in Germany (this follows from Article 6 of the Regulation (EC) No 864/2007). Such targeting might be implied among others by using German, listing offices in Germany, mentioning customers in Germany, or other special arrangements for customers in Germany.
Many of these website operators have, in theory, been obliged to implement EU cookie rules because they have targeted audiences in other member countries but in practice, this is rarely enforced. The BGH decision increases the risk for those website operators because consumer associations and competitors in Germany can now rely on this decision to take action based on UKlaG or UWG.
As a result, website operators outside Germany – specifically outside the EU / EEA – who are targeting a German audience must now bring their websites according to EU cookie requirements.
to request modification Contact us at Here or [email protected]