Consent management: cookie banner must also include "reject all" option

Cookie banners must also offer a button for "Reject all".
Categories:

The design of cookie banners is legally significant. Data protection law stipulates certain requirements for effective consent. Nevertheless, many cookie banners are designed manipulatively and steer users towards consent, criticizes the State Commissioner for Data Protection. Data protection Lower Saxony. In a recent case, the Supervisory authority enforced: Anyone who offers a clearly visible "Accept all" button must also provide an equivalent button for "Reject all".

Dispute over cookie banner ends up in administrative court

The case in question concerned the cookie banner of a large media company in Lower Saxony. The data protection supervisory authority of Lower Saxony (the State Commissioner for Data Protection of Lower Saxony, LfD) had ordered the company to redesign its banner. The reason was that the existing banner did not offer users a real choice between using cookies or not. The authority criticized the fact that before setting unnecessary Cookies no informed and voluntary Consent of the users is obtained.

The media company countered that their cookie consents were effectively obtained. Furthermore, the company denied that it personal data to process cookies. It also questioned the competence of the data protection authority for cookie issues.

The company resisted this order and took the matter to court. The administrative court (case no. 10 A 5385/22) therefore had to decide on the legality of the official intervention.

Legal assessment of the VG Hannover

The Hanover Administrative Court dismissed the complaint and thus confirmed the official order. The judges found that the design of the cookie banner in its present form violated applicable law in several respects. In particular, the user consents obtained in this way were invalid. This constitutes a Infringement against § 25 TTDSG and against the General Data Protection Regulation (GDPR).

The Chamber concluded that the users had not given an informed, voluntary and unambiguous consent. Consent in the sense of GDPR had given. Accordingly, the use of unnecessary Cookies without a lawful basis. The objection that the data protection authority lacked jurisdiction did not prevail either.

Source: Judgment of the Hanover Administrative Court dated 19.03.2025 (10 A 5385/22)

Requirements for effective consent for cookie banners

The ruling underlines the general legal requirements for effective consent. According to the GDPR must have a Consent be voluntary, informed, specific and unambiguous.

The most important criteria can be summarized as follows:

  • Voluntary: One Consent must take place without coercion. The user must have genuine freedom of choice, Cookies to reject or accept. "Rejecting must be just as easy as accepting.
  • Informed: The user must be clearly and fully informed about the data processing. This includes information about Cookies and their purpose. Information must also be provided on all third-party providers involved, possible data transfers to third countries and the right to withdraw consent.
  • Specific: A Consent must relate to specific processing purposes. Ideally, users should have the option of consenting to individual cookie categories or purposes separately.
  • Unambiguous: Consent must be given by a clear, unambiguous action on the part of the user. An active click on a clearly labeled consent button is required. Pre-ticked boxes or simply navigating further are not sufficient.

Reading tip: Acceptance or rejection of Cookies must be equally possible

Users are invited to Consent crowded

In the specific case, the court objected to the following points in particular:

  • Difficult rejection: The rejection of Cookies was much more complicated than accepting it.
  • Pressure to give consent: Users were constantly prompted to give their consent by new banners. Consent pushed.
  • Misleading labels: The headline "optimal user experience" and the button text "accept and close" were misleading.
  • No reference to Consent: The banner was missing the term "Consent" complete.
  • Non-transparent partner list: The number of integrated partners and third-party providers was not recognizable.
  • Hidden information: References to the right of withdrawal and to data processing in third countries were only visible after scrolling.


All these deficiencies meant that the consents obtained were to be regarded as invalid.

"Reject" button belongs in cookie banner

In practice, many banners currently contain a clearly visible "Accept all" button, but no equivalent offer to decline. This tends to steer users towards consent, which is known as "nudging".

The Administrative Court clarifies: A consent banner must not be specifically aimed at obtaining consent. It must also not prevent users from rejecting the Cookies hold.

This requirement is in line with the principles of the supervisory authorities. As early as 2021, the Data protection conference clear that a banner with only the options "Accept all" and "Settings" is not legally compliant. The Higher Regional Court of Cologne also ruled in 2024 that the "Reject" option must be just as easily accessible as "Accept".

Reference to GDPR§ 25 TTDSG and Google Tag Manager

The VG Hanover also confirmed the legal opinion of the LfD Lower Saxony that the use of Google Tag Manager of a Consent pursuant to Art. 25 para. 1 TDDSG and Art. 6 para. 1 lit. a GDPR need.

The Google Tag Manager is used to integrate tracking codes and scripts, particularly from advertising service providers, into the website.

This is neither a service that is expressly requested by the user of the website, nor does it offer any added value for the user of the website, explains the LfD Niedersachsen.

A common error is that GTM scripts are already activated when the page is called up - i.e. even before the Consent - are loaded. This means that data can flow to Google or other third-party providers even before consent is given. Correct configuration is therefore crucial: all tracking tags must be blocked until consent is given. The sole use of a Consent Management Platform (CMP) does not automatically lead to legally effective consent.

Implications for website operators

For website operators, the ruling provides clear guidance on the design of content banners. Anyone who uses a cookie banner on their website should now critically review its legal compliance and improve it if necessary.

The following principles can be derived from the decision:

  • Add a clearly visible "Reject all" button on the first banner level.
  • Make rejecting just as easy as accepting.
  • No constant banner repetitions if the user does not consent.
  • Clear, truthful wording: no misleading headlines or button texts.
  • Full Transparency on partners, third country transfers and right of withdrawal.
  • No tracking tags or Cookies without prior consent - not even via GTM.

Conclusion: Website users must Consent have a real choice

The judgment of the VG Hannover sends a clear signal for data protection-compliant cookie banners. Operators must give users a real choice. Manipulative consent dialogs must be avoided.

Source: Communication from the State Commissioner for Data Protection of Lower Saxony on the judgment of the Administrative Court of Hanover (Ref. 10 A 5385/22)

Would you like to make your cookie banners legally compliant?

The ruling by the VG Hannover increases the pressure on website operators to obtain consent in compliance with data protection regulations. Our specialized team at 2B Advice supports you in the legally compliant implementation of your consent management - efficiently, pragmatically and tailored to your business model.

✔ Legally compliant banner design
✔ Implementation of current GDPR and TTDSG requirements
Integration into your existing website infrastructure
✔ Optional: Certification with the CookieProof® seal

Get non-binding advice now:
www.2b-advice.com/de/cookieproof

Protect your website - we help you to avoid warnings and fines.

Tags:
Share this post :