Revolution in data protection: BGH decides on cookie consent!

Revolution in data protection: BGH decides on cookie consent!

On April 17, 2025, the topics of data protection and cookie consent will once again be the focus of the legal debate in Germany and the EU. A recent ruling by the Federal Court of Justice (BGH) has reaffirmed the opt-in requirement for advertising and marketing cookies, forcing people and companies to actively agree to cookies before they are used on their devices. This decision is directly related to a previous ruling by the European Court of Justice (ECJ) on October 1, 2019, which established the need for clear and informed consent for cookies. Loud FAU Users must be able to explicitly accept or reject the use of cookies.

A central issue is the lawsuit brought by the Federal Association of Consumer Organizations (vzbv) against the company “planet49”. This was directed against the use of a pre-checked consent box for cookies, which is not considered sufficient according to the ECJ. Passive consent, such as not removing a check mark, is therefore invalid. This new legal framework requires that cookies are only processed with explicit consent, unless they are strictly necessary, such as shopping cart cookies or those used to store login status.

Unclear definition of required cookies

However, the legislation leaves questions regarding the precise definition of which cookies are considered strictly necessary. Marketing and statistical cookies do not fall into this category. Overall, the ECJ ruling affects not only cookies, but all technologies that store data on user devices. The German Telemedia Act allows the creation of usage profiles, but not without the aforementioned consent.

One challenge arising from these developments is the design of cookie consents. These must be clear and informative, informing users about the type, purpose and lifespan of the cookies. Forced opt-ins are generally not permitted. Data protection authorities recommend avoiding pre-checked boxes, which potentially affects user-friendliness and legal requirements in equal measure.

The ePrivacy Regulation in focus

In the context of European data protection legislation, the ePrivacy Regulation (ePVO) is also under discussion. The legislative process is not yet complete and both Member States and business associations have expressed requests for changes. How ePrivacy update reported, the EU Commission, the EU Parliament and the Council of the European Union still have to agree on the final content. The timing of an agreement remains unclear, but the current draft under the Austrian Council Presidency is already contributing to the discussion.

Article 6(2a) of the ePVO, which introduces data processing for “compatible purposes”, could have far-reaching effects. Metadata, such as websites visited or geographical locations, could be processed in the future without the express consent of the user. This regulation requires a critical review in view of user privacy, while at the same time the deletion of Article 10, which originally provided for browser solutions to collect consent, is on the agenda.

Overall, it appears that the legal framework for data protection is still in flux both in Germany and in the EU. The upcoming decisions will have a significant impact on the implementation of cookie consents and the protection of user privacy.