Cookie banner: Acceptance or rejection of cookies must be equally possible

The selection option in the cookie banner should be equivalent.
Categories:

In a recent decision, the Austrian Administrative Court has commented in detail on the design of cookie banners. The court clarifies that the data protection requirements for cookie banners must be strictly adhered to and that there is no room for exceptions. The acceptance or rejection of Cookies must be equally possible.

Data protection authority intervenes over cookie banner

In a decision dated December 14, 2023, the data protection authority requested o GmbH & Co KG to adapt its cookie banner. The Supervisory authority took action following a data protection complaint from a data subject. The authority found that the existing cookie banner of o GmbH & Co KG did not meet the requirements of the GDPR complied with. Specifically, the authority criticized the fact that users only had the option on the first level of the cookie banner, Cookies or click on the "Show purposes" button. The option, Cookies directly was only accessible on the second level of the banner after several clicks.

In addition, the data protection authority found that the cookie banner did not include the option to accept Cookies visually strongly preferred. The opt-in button was clearly visible, while the option to not opt-in was Cookies was clearly less visible. In the opinion of the authority, this design constituted a Infringement against the GDPR as according to Art. 7 para. 3 GDPR the Revocation one Consent must be just as simple as issuing them.

o GmbH & Co KG filed an appeal against this decision. Complaint which was rejected by the Federal Administrative Court. Subsequently, o GmbH & Co KG lodged an appeal with the Administrative Court. This court has now ruled that the data protection authority acted correctly and rejected the appeal.

Rejection of Cookies more difficult than assumed

In this case, the Administrative Court (VwGH) found that the design of the cookie banner of o GmbH & Co KG did not meet the legal requirements of the GDPR complied with. Specifically, it was objected that the rejection of Cookies is much more difficult for users than their acceptance.

The cookie banner of o GmbH & Co KG only offered two options on the first level: a prominently placed, color-highlighted "Accept" button and a less conspicuous link labeled "Show purposes". By clicking on "Show purposes", the user was taken to the second level of the banner, on which the rejection of Cookies was only possible after further clicks.

According to Art. 7 para. 3 GDPR the Revocation one Consent be just as easy as granting them. The VwGH found that the design of the cookie banner did not comply with this requirement. While a user Cookies could be accepted with just one click, rejection required at least two clicks and was less intuitively accessible.

"Accept" button highlighted in color

In addition to the more difficult opt-out option, the VwGH also criticized the visual design of the cookie banner. A central point of criticism was the uneven visual design of the selection options in the cookie banner. In this case, the button for consenting to Cookies much more prominent than the opt-out option. The "Accept" button was highlighted in color and was located in a conspicuous position on the first level of the cookie banner. In contrast, the opt-out option was only integrated as an inconspicuous link labeled "Show purposes", which was visually less prominent and less intuitively perceived by users.

The VwGH emphasized that such a design restricts the user's freedom of choice and does not meet the requirements of the GDPR corresponds. According to Art. 7 para. 3 GDPR the Revocation one Consent be just as easy as issuing them. This also means that both options should be offered in the same way visually. By hiding the rejection option with a less visible and inconspicuous design element, users have been made unnecessarily difficult to reject.

The court also pointed out that this unequal design could not be justified by referring to "industry standards". Rather, it must be ensured that the user can recognize at first glance how they can use their Consent can refuse or revoke. The European Data Protection Board (EDPB) also recommends that the first level of a cookie banner should always include an equally conspicuous and equivalent button for rejecting cookies. Cookies as should be available for their acceptance.

No exceptions for the use of Cookies

As part of the proceedings, o GmbH & Co KG invoked the so-called media privilege pursuant to Section 9 (1) DSG. This privilege provides for certain exceptions to the general data protection requirements if personal data are processed for journalistic purposes. The appellant argued that its use of cookies fell within this journalistic context, as the website also served to provide information.

The VwGH clarified that the media privilege only applies if the data processing in question is directly attributable to the Transmission of information, opinions or ideas to the public. In doing so, the court explicitly referred to the case law of the European Court of Justice, which has determined that journalistic purposes exist in particular if the Processing of personal data is directly linked to the dissemination of information on matters of public interest.

The setting of Cookies for marketing, advertising and analysis purposes does not fulfill this requirement in the opinion of the VwGH. The use of Cookies of this kind is not aimed at reporting on issues of public interest or conveying journalistic content. Rather, the focus of such Cookies the economic and commercial interests of the website operators were paramount. As these are not journalistic activities within the meaning of Section 9 (1) FADP, the media privilege was not applicable in this case.

Options outside the cookie banner not sufficient

The question of whether alternative measures for the rejection of Cookiesthat are offered outside the actual cookie banner are sufficient to meet the requirements of the GDPR to comply. The appellant argued that there is a clearly visible link in the footer of its website that allows users to enter their Consent to revoke your consent at a later date. This link labeled "Cookie settings and Revocation" can be accessed at any time and is therefore a suitable and user-friendly way of Revocation the Consent ensure.

However, this argument was not considered sufficient by the Administrative Court. Such a downstream revocation option can only be considered as a supplementary option, but not as an equivalent alternative to the immediate rejection of Cookies be regarded as a "good thing". The GDPR the possibility of rejecting the application of Cookies directly and equivalently to the acceptance of Cookies on the first level of the cookie banner. The reference to later revocation options does not meet this requirement.

Reading tip: Cookie Consent Management - secure Consent for companies

Requirements for companies for cookie banners

The decision makes it clear that companies must design their cookie banners in such a way that the rejection of Cookies is just as easy as accepting them. In concrete terms, this means that the first level of the cookie banner already contains a visually equivalent button for rejecting Cookies must be present.

The sole provision of a downstream link for the rejection of Cookies in the footer or in a separate menu structure is not sufficient and violates the requirements of the GDPR.

Furthermore, the ruling makes it clear that the reference to supposedly "industry-standard" standards is no justification for inadequate cookie banners. Companies must actively check whether their consent mechanisms comply with the principles of the Transparencysimplicity and equivalence are sufficient.

Violations of these requirements can result in significant sanctions. The data protection authorities are authorized to oblige companies to adapt their cookie banners and to impose fines in the event of violations. Companies are therefore well advised to review their existing cookie banners and ensure that they meet the requirements of the GDPR correspond.

Source: Decision of the Administrative Court of January 16, 2025 (Ra 2024/04/0424-9)

Would you like to check whether your cookie banner is legally compliant? Then get in touch with us - we will be happy to advise you.
☎️ +49 (228) 926165-100
📧info@2b-advice.com

Tags:
Share this post :