LG München I classifies § 25 TTDSG as a data protection provision and opens up consumer choice regarding cookie banners in accordance with the German UKlaG

The judgement of the Regional Court of Munich I – what is it about?

On November 29, 2022, the Regional Court of Munich I issued a judgement regarding the permissibility of storing and accessing cookies in end user devices (Case No. 33 O 14776/19). A consumer protection association had sued the provider and operator of a well-known German online news portal.

The judgment is very relevant for two practical reasons. On the one hand, the court classified Section 25 TTDSG as a consumer protection law. On the other hand, the court decided on the practical design of so-called cookie banners.

1. Section 25 TTDSG as a consumer protection law

Regional Court of Munich I classified Section 25 of the German Telecommunications and Telemedia Data Protection Act (“TTDSG”) as a consumer protection law within the meaning of Section 2 (2) sentence 1 no. 11 of the German Consumer and Other Violation Injunctions Act (“UKlaG”). Although it is generally disputed whether competition law can apply to data protection provisions under the General Data Protection Regulation (“GDPR”), Section 25 TTDSG stands alongside the GDPR in terms of the legal system. The TTDSG is not based on the GDPR, but on the ePrivacy Directive.

Section 25 TTDSG as a data protection regulation is covered by the scope of Section 2 (2) sentence 1 no. 11 UKlaG. Among other things, the TTDSG regulates the protection of personal data. Furthermore, the TTDSG contains a consumer protection component, since it is at least also about the collection, processing or use of personal data of natural persons in their capacity as consumers by companies as part of the market.

According to the decisions of the Regional Court of Munich I, it is an infringement of Section 25 TTDSG if the operator of a website stores cookies on the user’s end device and subsequently uses such cookies for so-called “tracking” of said user without a sufficient user consent. In particular, the consent is only sufficient if it has been given voluntarily.

2. Design of cookie banners

The Regional Court of Munich I also stated with regard to the very relevant question of the general design of cookie banners that the given consent is not voluntarily if there are only two options for further website use at the first level of the cookie banner: Either give comprehensive consent or go to a second level via the “Settings” button.

The consent has only been given voluntarily if a user actually has the possibility of choice. He must therefore also be able to waive the consent without any disadvantages. Already the fact that a user could not use the defendant’s website without the further interaction with the Consent Management Platform argues against a voluntary decision.

Due to the design of the defendant’s website, this was not the case. A user has to click the “Settings” button first in order to be able to make a specific selection regarding his consent. According to the Regional Court of Munich I, even this relatively small effort was already considerable. The Internet depends on its speed and users are therefore generally less attentive. In addition, the “Accept” button on the first level of the cookie banner was highlighted in blue. This would indicate to the respective user that simply accepting the cookie without making a selection was the “faster” way to the actual website.

Practical relevance

The judgement certainly has high practical relevance.

The requirements for the legally compliant design of cookie banners are high. In addition, Section 25 TTDSG could also be classified as a market conduct regulation within the meaning of Section 3a of the German Federal Act against Unfair Competition (“UWG”). As a result, competitors could potentially also pursue a corresponding breach of competition law (see the order of reference of the Federal Court of Justice (“BGH”) of January, 12, 2023, Case No. I ZR 223/19 to the European Court of Justice on the relationship of the GDPR to the UWG here).

Probably many website providers will have to adapt their cookie banners. According to the Regional Court of Munich I, it is no longer sufficient if there are only two buttons on the cookie banner: “Accept” or “Settings”. A further selection via the “Settings” button on the second level of the cookie banner is not permissible.

On the one hand, there should be probably further selection options on the first level of the cookie banners. This could be, for example, a button with the content “Cancel” or “Continue only with absolutely required cookies”.

On the other hand, it is not clear how many choices must actually be possible on the first level of the cookie banner. A strict interpretation of the judgement would raise the question of whether all cookies that are not necessary would have to be displayed for selection on the first level of cookie banners. Especially with a large number of such cookies / trackers / identifiers, this is likely to become quite confusing, in particular on smaller displays (e.g. smartphones).