Liability for the use of tracking cookies without consent – Fundamental decision by the Higher Regional Court of Frankfurt a.M.
The Higher Regional Court of Frankfurt am Main recently adjusted the question of responsibility for the unlawful use of tracking cookies on websites with its judgment of July 29, 2024 (Ref. 6 U 192/23). The decision primarily concerns the legal obligation to obtain consent under data protection law when using cookies, especially in the context of large digital companies. In this context, the liability for violations of the Telemedia Act (now TTDSG) and the General Data Protection Regulation (GDPR) also comes into focus for beneficiaries of integrated tracking technologies such as Microsoft.
Background of the decision
Initial situation: Use of analytics cookies without sufficient consent
According to the findings of the Higher Regional Court of Frankfurt, Microsoft was involved as a provider of tracking technology on a website where analytics cookies were implemented. The contentious cookies were placed without the user consent required for non-essential data processing. A competition association filed a lawsuit alleging a violation of § 25 para. 1 TTDSG. According to the legal situation, the setting and reading of information on end devices for the purpose of direct marketing or statistical evaluation generally requires consent – except for technically necessary cookies.
Procedural status: Higher Regional Court decision after lower court
Microsoft argued that it should not be regarded as responsible under the regulations or have committed any direct breach of duty. The lower court had dismissed the lawsuit. The Higher Regional Court of Frankfurt overturned this decision, affirming the liability of the supplier of the tracking software.
Central legal questions of accountability
Extended concept of accountability in data protection and competition law
The court clarified that not only the website operator but also third parties – in this case, the technology provider – can be considered accountable for data protection illegitimate processing procedures. This is particularly the case if the technology provider actually exerts design influence over the processing of personal data. The technical implementation or mere provision of the software alone is not decisive. Rather, the court relied on a functionally-based interpretation of the term accountability.
Requirements for effective consent under TTDSG and GDPR
The focus was on whether an active, informed consent of users is always required for analytics and marketing cookies. The Higher Regional Court of Frankfurt emphasized the EU law requirements of the GDPR, which are specified by the TTDSG. It is not enough to have a preset consent or a mere reference in the cookie banner. Instead, the declaration of intent must be explicit, voluntary, and occur after sufficient information has been provided.
Shared responsibility of third-party providers in tracker integration
In the case to be decided, the court assumed so-called joint responsibility between the website operator and the third-party provider. The decisive factor is whether the third-party provider – in this case, Microsoft – participates in the data processing and influences the purpose and means of processing through technical specifications or control of cookie use. The mere delivery of software is generally not sufficient for this; however, standardized settings that initiate data processing, which would be unlawful without consent, are sufficient.
Competition law injunction claim
Application of fairness law in the data protection context
Another key aspect of the decision was the competition law implications. The Higher Regional Court of Frankfurt classified the violation of the TTDSG as a noticeable distortion of competition according to § 3a UWG. This means that competitors or associations, in addition to primary legal protection under data protection law, can also take direct action against unfair data processing practices.
Implications for international technology providers
The decision of the Higher Regional Court of Frankfurt underscores that providers of tracking technologies located outside the EU, such as Microsoft, can be held responsible under competition law as soon as their products are used on websites targeting German users. This sets a binding framework for compliance for international actors as well. For companies that provide such technologies to third parties or use them themselves, there is an increased risk of claims by associations or competitors.
Outlook and practical relevance
Significance for the design and operation of Internet offerings
The landmark judgment has significant effects on the legally compliant operation of websites that use analysis tools or other third-party services. In addition, with liability extending to indirectly involved parties, the requirements for data protection and technical implementation become more complex – both organizationally and in terms of liability law. Compliance with consent requirements is of central importance, and the potential for third-party claims significantly increases the need for examination and monitoring.
Legal situation in flux – Reference to non-decision of the Federal Court of Justice
It should be noted that an appeal to the Federal Court of Justice has been allowed against the judgment of the Higher Regional Court of Frankfurt. Thus, the definitive clarification of the questions regarding the extent of accountability and the scope of consent obligations remains subject to a supreme court review. Until a final decision is made, the legal situation remains provisional (Source: urteile.news, Judgment Higher Regional Court of Frankfurt a.M. dated 29.07.2024, Ref. 6 U 192/23).
Conclusion
The decision of the Higher Regional Court of Frankfurt a.M. marks a significant step in the interplay of data protection, IT, and competition law and highlights the substantial requirements for the use of tracking technologies on internet sites. Companies that integrate their own or third-party services into online presences are challenged to continuously adapt their compliance structures to the evolving legal situation. For further questions on practical implementation or a strategic assessment of individual circumstances, a professional Data protection legal consultation by MTR Legal Attorneys may be helpful.
