Inadmissible data transfer to Google through use of Google Analytics without sufficient consent
In its recently published judgment of March 23, 2023 (33 O 376/22), the Cologne Regional Court ruled, among other things, on the design of the consent button in Google Analytics on a website. The action was brought by Verbraucherzentrale Nordrhein-Westfalen e.V. against a well-known German telecommunications company.
With reference to the Schrems II decision of the ECJ, the Cologne Regional Court found that the company’s transfer of data to the USA was not in compliance with the GDPR. An effective consent to the third country transfer had not been obtained.
A simple consent in the cookie banner via the button “Accept all” was not sufficient for this. The site operator had provided a colorless button with a gray border with the option “Change settings” next to this button highlighted in color.
From the ruling: “For while in the case of the “Accept all” button a one-click solution in
size, color and layout was clearly designed as an eye-catcher, the option to continue surfing “only with the necessary cookies” was hidden in the body text and thus insufficient in size, shape and design to be regarded as an actual and equivalent choice.
The option “Change settings” also does not lead to the effectiveness of the consent, since the button […] does not contain a choice in the form of a declaration of intent or a reference to it that is recognizable for the consumer in an alternative relationship to the button “Accept all”.”
Which design of a cookie banner would specifically meet the requirements of voluntary and informed consent was left open by the Cologne Regional Court. According to the court, different designs are conceivable that satisfy the requirements for voluntary consent. The ruling is not legally binding.
WHAT DOES THIS MEAN FOR COMPANIES?
The consequences of this ruling can be significant. Google Analytics represents one of the most popular tools for analyzing user behavior and is used on numerous websites. Users of the tool should ensure to obtain explicit and informed consent from their website visitors to third country transfers and adapt their privacy notices accordingly.