German court says active consent always required for online cookies

By Rachel More, dpa
Berlin (dpa) – Websites that use cookies must always obtain active consent from users for doing so, a top German court ruled on Thursday, underpinning data protection regulations set down by the European Union.

The Federal Court of Justice said a pre-ticked box allowing cookies was not sufficient, settling a dispute between online gaming website Planet49 and the vzbv consumer protection group.

The judges based their decision on EU data protection laws in place since 2018, and had already asked the European Court of Justice (ECJ) to weigh in on the issue back in October.

The EU court’s decision came down against default consent for the storage of cookies, or traces of a user’s browsing activity, which are often used for marketing or advertising purposes.

Last year, the EU put into force the General Data Protection Regulation, governing how institutions collect data from online users.

It was a busy day for the German court in terms of cases related to the EU regulation, two years after it first came into force.

Its judges also issued a statement on who is entitled to sue when companies such as Facebook do not adhere to the rules – but instead of answering the question, passed the case on to the ECJ in Luxembourg for another preliminary ruling.

Consumer protection watchdogs want to know whether they can launch civil lawsuits in such cases, or whether the EU regulation only empowers data protection officers to do so.

Presiding federal court judge Thomas Koch said that it was relatively clear that the Facebook “App Center,” which offers free games from other providers, violates data protection.

In a 2012 version, user data was automatically made available to other parties when the person clicked a “Play now” button.