Pharmacy fined €1.1m over cookie consent violations

On 18 May, a court in Hannover, Germany, clarified the rules on getting consent to use cookies and other tracking technologies under the General Data Protection Regulation (GDPR) and Germany’s Telecommunications and Telemedia Data Protection Act (TTDSG).

The case further clarifies how businesses should operate online, including by obtaining freely given consent for cookies and similar technologies. The court also gave a specific ruling on the use of Google Tag Manager that is relevant to thousands of website operators. 

Jump to:

1. The noz.de case
2. The findings on NOZ’s cookie banner
3. The ruling on Google Tag Manager
4. Lessons for website operators

The noz.de case 

The court ruled on a dispute between the Lower Saxony Data Protection Authority (LfD) and the Neue Osnabrücker Zeitung (NOZ). The LfD had ordered NOZ to adjust its cookie banner, which it claimed violated the GDPR and TTDSG. 

The alleged problem with NOZ’s cookie banner: Users could accept cookies easily but had to take extra steps to reject them.

Arriving on NOZ’s website, the cookie banner prompted users to choose one of three options: “Accept all”, “Accept and close (x)”, and “Settings”. Users could only reject cookies by choosing the “Settings” option and navigating through a deeper set of menus. 

The findings on NOZ’s cookie banner 

Although NOZ made several changes to its cookie banner and claimed that it met the requirements of the Interactive Advertising Bureau’s (IAB) Trust and Consent Framework (TCF) (a voluntary online advertising standard), the LfD remained unsatisfied and insisted on further changes. 

NOZ appealed to the Hannover court, which largely sided with the LfD. 

The court found several issues with the cookie banner and stated that NOZ had not obtained valid consent from its users.

In a press release about the decision, the LfD stated that the court’s ruling means users should have been offered a simple way to “reject all” cookies on the first layer of the cookie banner. 

The court also criticized the website for using vague or misleading language, including that cookies would ensure an “optimal user experience”. The court also said that Information about international data transfers and withdrawal of consent should have been presented earlier in the process. 

The ruling on Google Tag Manager 

The court also addressed NOZ’s use of Google Tag Manager (GTM), which activated immediately upon a user visiting the website without any interaction with the cookie banner, according to the LfD. 

NOZ defended its non-consensual use of GTM, arguing that the tool was necessary for providing its services.

The court disagreed, finding that GTM did not fall under either of the consent exceptions provided by the TTDSG, Germany’s implementation of the ePrivacy Directive. As such, NOZ should have requested consent before deploying GTM.

NOZ was ordered to bring its website into compliance with German data protection and privacy law.

Lessons for website operators 

Like several cases before it, the NOZ ruling provides a clear yet strict interpretation of the EU’s rules on cookies, which arguably applies beyond Germany to virtually every company operating in the EU.

• It must be as easy to “reject” as to “accept” cookies: Include a “reject all” button on the first layer of your cookie banner
• Use clear and plain language; provide all information required under Articles 12-14 GDPR, and don’t nudge your users into accepting cookies
• If you’re using tools such as Google Tag Manager, make sure you obtain consent unless such tools are “strictly necessary” for providing a service requested by the user.