Cookie consent queries have become an integral part of today’s online life. When you visit almost every website, the cookie consent behavior must first be set via a pop-up. However, high demands are placed on the legally compliant design of cookie banners. In particular, targeted guidance towards general consent through appropriate designs is not permitted. The Cologne Higher Regional Court has now decided that the lack of a “reject” button on the first level of the cookie banner is anti-competitive.
I. The facts
The North Rhine-Westphalia consumer advice center disputed with the operator of the online service “WetterOnline” about the legally compliant design of the cookie consent tool implemented there.
The tool’s central user interface had two buttons, one “Accept” and one “Settings”, whereby the “Accept” button was highlighted in color and the “Settings” button was contourless and gray.
In addition, there was a button at the top right with “Accept & Close”:
The consumer advice center was of the opinion that the design violated the data protection requirements on the “voluntariness” of consent by not giving the user consent for everyone through the visual highlighting of the “Accept” button and the lack of an equivalent consent button on the central interface impose necessary cookies.
At the same time, the “Accept & Close” button, which also grants general consent for all cookies, does not meet the requirements for express, informed consent.
Overall, this violates Section 25 Paragraph 1 TTDSG in conjunction with Article 7 GDPR (which regulates the requirements for the effectiveness of consent) and is over § 3a UWG can be prosecuted under competition law.
After the Cologne regional court appealed to did not fully comply with the consumer advice center’s application, the head office continued to pursue its legal protection goal with an appeal to the Cologne Higher Regional Court.
II. The decision
In its judgment of January 19, 2024 (ref.: 6 U 80/23), the Cologne Higher Regional Court upheld the appeal and sentenced the operator of the online offer to cease and desist as requested.
In the absence of an equivalent rejection option on the central interface of the cookie banner, the user is directed to give consent, with the result that consent given in this way is not considered voluntary and sufficiently informed within the meaning of Section 25 Paragraph 1 TTDSG and Art. 4 No. 11 GDPR could be considered.
Because there is no rejection button, the user has to deal with the two options provided and is tricked into granting universal consent by the visual highlighting of the “Accept” button. This is especially true as the “settings button” does not, even after being pressed, lead to a design that would then make it possible to reject all cookies that are not technically necessary.
Finally, obtaining consent via the “Accept & Close” button is not permitted. This button violated the requirements for transparency and informed consent in accordance with Article 7 GDPR. After all, the “X” symbol is known to users to close an interface, but is not reasonably understood as a declaration of consent for all non-essential cookies and technologies on the website.
III. Conclusion
It is particularly anti-competitive to withhold a dimensional and design-equivalent opt-out option on the central user interface.
To be legally compliant, a cookie consent interface must have three equivalent buttons, each with
all cookies can be accepted, all non-essential cookies can be rejected, individual consent settings can be accessed, via which consent is then only possible for individual cookie-based services
Otherwise, the voluntary nature of consent is not guaranteed and the way is paved for a claim under competition law.
Tip: Do you have any questions about the article? Please feel free to discuss this with us in the
Entrepreneur group of the IT law firm on Facebook.