Verdict: Tracking at Focus.de is against the law

The Munich I Regional Court has ruled against Burdaforward GmbH, the company behind the focus.de portal, in a lawsuit brought by the Verbraucherzentrale Bundesverband. The tracking practiced on the site to date violates applicable data protection law. Focus.de must adjust its cookie banner.

Consent easier than rejection

The background to the complaint filed by the consumer advice center is the fact that focus.de previously relied on a cookie banner in which consent is significantly easier to achieve than rejection: the tracking can be activated with one click; however, it can only be rejected with several clicks through several pages of the banner. Moreover, the opt-out option is kept very discreet, whereas the opt-in option is highly visible. In technical language, such a design is called Dark Pattern.

The consumer organization initially invoked the EU General Data Protection Regulation in its lawsuit, but later amended its complaint to make the new Telecommunications Telemedia Data Protection Act its basis. This stipulates that tracking is only permitted “if the end user has consented on the basis of clear and comprehensive information.”

Court rules in favor of Verbraucherzentrale

The Munich I Regional Court followed the argumentation of the consumer advice center. In the reasons for its ruling, the court pointed out that the relevant provision is always not fulfilled if the refusal of tracking is more difficult to achieve than consent. The ruling states, slightly misleadingly, that already “the fact that a visitor cannot use the defendant’s website without further interaction with the CMP” speaks “against a voluntary decision.”

However, the court rejected another element of the complaint for formal reasons. Thus, the consumer center had further demanded that the company behind focus.de also be condemned for not providing sufficient information about the intended data use as well as about agreements with third-party providers. The court did not comment on the content of this accusation. In its ruling, it merely pointed out that the relevant provision is to be found exclusively in the EU General Data Protection Regulation, but not in the Telecommunications Telemedia Data Protection Act, on which the lawsuit relies.

In the run-up, there had already been a broad debate and some discussion. Burda, for example, fiercely defended itself against the lawsuit, citing its legitimate interest in the data as well as the fact that the selected cookie banners were standard market practice. In addition, the formal legal question of whether the Federal Association of Consumer Organizations had the right to sue was long in the air.

Also other companies in the sights

.
In addition to focus.de, numerous other companies and platforms that work with corresponding cookie banners are also in the sights of the responsible authorities as well as the consumer centers. Following heavy fines, Google and YouTube, for example, have already changed their banners so that it is now just as easy to refuse as to give consent.