Locations
Business as usual
First of all, it must be said that so far only press announcements about the decision are available (i.e. the full judgement is not yet available). This post can therefore only refer to what is known so far about the decision - and that is as follows:
Initially, the FCJ states, just like the CJEU, that the use of a pre-ticked checkbox was invalid even prior to the General Data Protection Regulation (GDPR). The judges referred here to section 15(3) of the German Telemedia Act (TMG) and explained:
"In the light of the first sentence of Article 5(3) of Directive 2002/58/EC [the E-Privacy Directive], as amended by Article 2(5) of Directive 2009/136/EC, section 15(3) of the German Telemedia Act must be interpreted in conformity with that directive as meaning that the use of cookies to create user profiles for the purposes of advertising or market research requires the consent of the user."
So far then it is quite simple: active consent is required if cookies are used to create user profiles for the purposes of advertising or market research. This basically only brings Germany up to speed with most of the rest of the EU and is not very surprising.
The unique German way
In order to be able to understand the further explanations of the court, one has to examine the background legal situation in Germany in relation to the E-Privacy Directive. The version of the Directive in force since 2009 already stated that users must consciously consent to online tracking, yet section 15(3) TMG has never complied with this requirement, instead permitting tracking provided an opt-out is offered. The German data protection authorities, in particular, have been pointing out this discrepancy for years and the CJEU has confirmed this view in its Planet 49 decision.
Looking at the further explanations in the FCJ decision, the court's remarks on the connection between the TMG and the E-Privacy Directive can be kindly described as "interesting" or "pragmatically creative". This is what they say:
"Interpretating section 15(3) sentence 1 of the German Telemedia Act as being in conformity with the Directive is not prevented by the fact that the German legislator has not yet made any act of transposition. This is because it can be assumed that the legislator considered the existing legal situation in Germany to be in conformity with the Directive. An interpretation of the wording of section 15(3) sentence 1 German Telemedia Act that is in conformity and compatible with the Directive is still possible. In the absence of (effective) consent, in view of the fact that the legislature saw the Union law requirement for consent implemented in section 15(3) sentence 1 German Telemedia Act, the contradiction according to this provision which contradicts the permissibility of the creation of user profiles can be seen."
Thus, although the wording of the German provision transposing the Directive said exactly the opposite (namely an opt-out) to what the Directive required, the legislature had in fact meant an opt-in. This reasoning may seem confusing (even after reading it several times), but, in the end, it is a reading which may at least help those like the German legislator and even the European Commission, who had indicated that there was no need to change section 15(3) of the TMG in light of the E-Privacy Directive (for reference see this article), to save face in light of the CJEU judgement.
The end of the (cookie) story?
Although the decision of the FCJ is hardly surprising almost seven months after the CJEU's ruling, it ultimately is still very relevant to the business model of many website operators who rely on cookie-based user tracking as a source of income. Anyone in Germany who now operates their website without an effective opt-in mechanism will have to expect consequences.
On the one hand - namely with regard to the use of cookies to create user profiles for the purposes of advertising or market research - the ruling provides legal assurance. At this point, it should also be emphasised once again that due to the reference to the E-Privacy Directive in the CJEU and FCJ rulings, the consent requirement for these cookies applies irrespective of whether personal data of users is collected or not. This is because Article 5(3) of the Directive refers to any kind of "storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber". It is also evident that, despite the judgements dealing specifically with cookies, other tracking technologies (such as pixels, tags, web beacons, or even device fingerprinting) are also affected in this context.
On the other hand, the question is still outstanding as to the specific cases in which an opt-in is not required because the services provided through the cookie are "strictly necessary" (refer to Art. 5(3) of the Directive).
Finally, the question can be asked to what extent users will or will not actually benefit from this decision. Following the decision of the CJEU, cookie banners have appeared in a wide variety of forms, overlaying websites and apps to such an extent that it is almost possible to speak of "cookie exhaustion". The banners may primarily be perceived as annoying with the user simply clicking "accept" without making a real, conscious decision regarding tracking.
Moreover, in the past, many website providers have been satisfied with tracking technologies where they were only provided with general demographic data about a user (e.g. that the user is a woman in her twenties). This level of statistical data about the user has often been sufficient to display target group advertising and, under section 15(3) TMG, this form of tracking was possible without the user's active consent. However, to the extent that active consent is now required for almost all cookies, it may incentivise website providers to change not only to a general opt-in approach (i.e. active consent), but also to make any tracking they do then undertake fully identifiable.