Unlike in the UK, the implementation of the European Directive 2009/136/EC, also called Cookie-Directive, is not a major point of concern amongst e-commerce businesses in Germany.
So far, the Federal government limited the implementation of the directive to amendments of the Telecommunications Act (TKG) that mainly covers the technical process of sending signals and the telecommunications market regulation and sees no need to amend other German legislation due to the directive. In the TKG draft amendment, government stated that individual questions such as the amendment of Art. 5 para 3 of directive 2002/58/EC are still subject to a consultation process on the European level including self regulation solutions by the advertising industry, and that they intend to wait for the results of this consultation process before amending any laws.
However, the German data protection authorities think that the TMG will need to be amended to implement the Cookie-Directive, as the directive requires an informed consent to receive cookies. The German Federal Data Protection Officer doubts that such consent is currently provided by the browser option to accept cookies, as this option was often set as default without providing any information about cookies. Last month, Peter Schaar, Germany’s Federal Data Protection Officer, announced his opinion that the Directive might also be directly applied by the data protection authorities.
Legislative proposals by the Bundesrat, the legal representation of the German states, and the major opposition party SPD provided for an explicit consent for cookies, but were not adopted. However, the final say if the implementation is sufficient lies with the European Commission, which has already announced to sue Belgium, The Netherlands, Poland, Portugal, and Slovenia for non implementation of the Directive.
Although it is possible to take a different legal view, there is no known case of data protection authorities taking action against internet sites that use normal cookies. Some data protection officers have issued warning letters against webshops that use webtracking technology like Google Analytics, which is based on Cookies, but this was motivated by the fact that Google Analytics transfers the IP-address (which, according to the authorities, constitutes personal data) to Google. However, the German public is quite critical about large corporations who create personal user profiles for targeted marketing, and it is possible that the data protection authorities will change their strategy regarding cookies on the basis that the Directive may be directly applicable in Germany because it was not properly implemented.