The First Civil Senate of the Federal Court of Justice, which is responsible, among other things, for claims under the Injunctions Act, has ruled on the question of what requirements must be met for consent to telephone advertising and the storage of cookies on the user's terminal device.
Facts:
The plaintiff is the Federal Association of Consumer Centres. In September 2013, the defendant organised a competition at its internet address. After entering the postcode, the user reached a page on which the user's name and address had to be entered. Below the input fields for the address were two consent forms with checkboxes.
By confirming the first text, the checkbox of which did not have a preset tick, consent was to be given to advertising by sponsors and cooperation partners of the defendant by post, telephone, e-mail or SMS. There was the possibility to select the advertising sponsors and cooperation partners from a linked list of 57 companies. Otherwise, the defendant was to make this selection.
The second checkbox had a preset tick and showed the following text:
"I agree to the web analytics service Remintrex being used on me. As a result, the competition organiser, the [defendant], sets cookies after registration for the competition, which enables [the defendant] to evaluate my surfing and usage behaviour on websites of advertising partners and thus interest-based advertising by Remintrex. I can delete the cookies at any time. Read more here."
In the explanation linked with the word "here", it was pointed out that the cookies would receive a specific, randomly generated number (ID), which was assigned to the registration data of the user who had registered with name and address in the web form provided. If the user with the stored ID visited the website of an advertising partner registered for Remintrex, this visit would be recorded as well as which product the user was interested in and whether a contract was concluded.
The preset tick could be removed. However, participation in the competition was only possible if at least one of the two fields was ticked.
As far as relevant in the appeal proceedings, the plaintiff has demanded that the defendant be prohibited from including or relying on corresponding declarations of consent in sweepstake agreements with consumers. The plaintiff also demanded compensation for the warning costs.
Process history so far:
The Regional Court ordered the defendant to cease and desist with regard to both consent forms and to pay warning costs. The defendant's appeal was successful with regard to the application for an injunction against the use of the declaration of consent to the use of cookies with a pre-set checkbox. Both parties have filed an appeal, which was admitted by the Higher Regional Court.
By order of 5 October 2017, the Federal Court of Justice stayed the proceedings and referred various questions to the Court of Justice of the European Union on the interpretation of Directive 2002/58/EC (ePrivacy Directive), Directive 95/46/EC (Data Protection Directive) and Regulation (EU) 2016/679 (General Data Protection Regulation) regarding the effectiveness of consent to the setting of cookies by means of a pre-set checkbox. These questions were answered by the Court of Justice of the European Union in its judgment of 1 October 2019.
Decision of the Federal Supreme Court:
The Federal Court of Justice has now rejected the defendant's appeal and, on the plaintiff's appeal, set aside the appeal judgment with regard to the cookie consent and restored the defendant's conviction at first instance.
With regard to consent to telephone advertising, the defendant is obliged to cease and desist and to reimburse warning costs pursuant to §§ 1, 3 para. 1 no. 1 UKlaG in conjunction with § 307 para. 1 sentence 1 and para. 2 no. 1 BGB and § 7 para. 2 no. 2 case 1 UWG, because an effective consent to telephone advertising is lacking both according to the legal situation applicable at the time of the act complained of and according to the legal situation at the time of the decision. § Sec. 7 para. 2 no. 2 UWG serves to implement Art. 13 para. 3 and 5 sentence 1 of Directive 2002/58/EC, Art. 2 sentence 2 letter f of which refers to Art. 2 letter h of Directive 95/46/EC for the definition of consent, so that the term "consent" must be defined in conformity with the Directive. For the period from 25 May 2018, the definition provided for in Art. 4 No. 11 of Regulation (EU) 2016/679 must be taken into account, because since then, pursuant to Art. 94(1) and (2), first sentence, of that Regulation, references to the repealed Directive 95/46/EC are deemed to be references to this Regulation.
Consent is given "in full knowledge of the facts" within the meaning of Article 2(h) of Directive 95/46/EC if the consumer knows that his statement constitutes consent and to what it relates. Consent is given "in the specific case" within the meaning of this provision if it is clear which products or services of which companies it specifically covers. This is lacking in the case in dispute because the impugned design of the declaration of consent is designed to confront the consumer with an elaborate procedure of selecting partner companies on the list in order to induce him to refrain from this selection and instead to leave the choice of advertising partners to the defendant. If the consumer, in the absence of knowledge of the content of the list and without exercising the right of choice, does not know which products or services of which entrepreneurs are covered by the consent, there is no consent for the specific case. For these reasons, there is also no consent "for the specific case" within the meaning of Art. 4 No. 11 of Regulation (EU) 2016/679, which has not brought about a change in law in this respect.
With regard to the consent to the storage of cookies, the plaintiff is also entitled to injunctive relief pursuant to § 1 UKlaG in conjunction with § 307 para. 1 sentence 1 and para. 2 no. 1 BGB. The consent of the user provided by the defendant in the form of a general business condition, which allows the retrieval of information stored on his terminal device with the help of cookies by way of a pre-set checkbox, constitutes an unreasonable disadvantage to the user both under the law applicable at the time of the act complained of and under the law applicable at the time of the decision.
Obtaining consent by means of a pre-set checkbox was, according to the legal situation applicable until 24 May 2018 - i.e. before the validity of Regulation (EU) 2016/679 - incompatible with essential basic ideas of Section 15 subsec. 3 sentence 1 TMG within the meaning of Section 307 subsec. 2 no. 1 BGB. The contested use of cookies by the defendant as a service provider serves, as required by Section 15 (3) sentence 1 TMG, the creation of user profiles for the purpose of advertising by recording the user's behaviour on the internet and using it to send tailored advertising. The randomly generated number (ID) stored in the cookies in the case in dispute, which is assigned to the user's registration data, is a pseudonym within the meaning of this provision. § Section 15(3) sentence 1 of the German Telemedia Act (TMG) must be interpreted in conformity with Article 5(3) sentence 1 of Directive 2002/58/EC as amended by Article 2 No. 5 of Directive 2009/136/EC to the effect that the consent of the user is required for the use of cookies to create user profiles for the purposes of advertising or market research. The Court of Justice of the European Union, following a referral by the Senate, ruled that Article 2(f) and Article 5(3), first sentence, of Directive 2002/58/EC in conjunction with Article 2(h) of Directive 95/46/EC are to be interpreted as meaning that there is no effective consent within the meaning of these provisions if the storage of information or access to information already stored in the user's terminal equipment of a website is permitted by means of cookies by means of a pre-set checkbox which the user must deselect in order to refuse his consent. According to the Court's decision, the question of whether the information is personal data is irrelevant in this context. The interpretation of Section 15 (3) sentence 1 TMG in conformity with the Directive is not precluded by the fact that the German legislature has not yet adopted a transposition act. It can be assumed that the legislature considered the existing legal situation in Germany to be in conformity with the Directive. A corresponding interpretation in conformity with the Directive is still compatible with the wording of Section 15 (3) sentence 1 TMG. In view of the fact that the legislator considered Section 15 (3) sentence 1 TMG to implement the consent requirement under EU law, the lack of (effective) consent can be seen as a contradiction to the permissibility of creating user profiles under this provision.
This legal situation has not changed since 25 May 2018, the first day of application of Regulation (EU) 2016/679, because this regulation, according to its Art. 95, does not affect the continued validity of Section 15 (3) sentence 1 of the German Telemedia Act (TMG) as a national provision transposing Art. 5 (3) sentence 1 of Directive 2002/58/EC. Insofar as the definition of consent can no longer be based on Article 2(h) of the repealed Directive 95/46/EC, but instead Article 4 No. 11 of Regulation (EU) 2016/679 must be used, this leads to the same result. Upon referral by the Senate, the Court of Justice of the European Union has also ruled with regard to Art. 4 No. 11 of Regulation (EU) 2016/679 that a pre-set checkbox to be selected by the user does not constitute effective consent.
Lower courts:
Frankfurt am Main Regional Court - Judgment of 10 December 2014 - 2/6 O 30/14
OLG Frankfurt am Main - Judgment of 17 December 2015 - 6 U 30/15
BGH, Order of 5 October 2017 - I ZR 7/16, Cookie Consent I
ECJ, Judgment of 1 October 2019, C-673/17, PLANET49
Source: Press release of the Federal Supreme Court of 28.05.2020
