Germany: Wait and see, have a Cookie!

Christian Leuthner

Unlike in the UK, the implementation of the European Directive 2009/136/EC, also called Cookie-Directive, is not a major point of concern amongst e-commerce businesses in Germany.

So far, the Federal government limited the implementation of the directive to amendments of the Telecommunications Act (TKG) that mainly covers the technical process of sending signals and the telecommunications market regulation and sees no need to amend other German legislation due to the directive. In the TKG draft amendment, government stated that individual questions such as the amendment of Art. 5 para 3 of directive 2002/58/EC are still subject to a consultation process on the European level including self regulation solutions by the advertising industry, and that they intend to wait for the results of this consultation process before amending any laws.

The Ministry of Economics takes the view that an opt-in solution is already realised by sec. 12 para 1 and 2 of the German Act on Telecommunication Media (TMG) which require the user’s consent for a collection of their personal data. The ministry thus seems to hold the view that a general consent by using the browser option to accept cookies is sufficient to declare such consent and that the directive does not set a higher threshold for such consent. This interpretation is similar to the IOC recent guidance on implied consent. However, it is also wider, as it only requires the user to select the browser setting “accept cookies”, but no action of the user on a particular website. Accordingly, German websites are not more active in publicising their use of cookies in practice after the deadline for the implementation of the Cookie-Directive became effective.

However, the German data protection authorities think that the TMG will need to be amended to implement the Cookie-Directive, as the directive requires an informed consent to receive cookies. The German Federal Data Protection Officer doubts that such consent is currently provided by the browser option to accept cookies, as this option was often set as default without providing any information about cookies. Last month, Peter Schaar, Germany’s Federal Data Protection Officer, announced his opinion that the Directive might also be directly applied by the data protection authorities. 

Legislative proposals by the Bundesrat, the legal representation of the German states, and the major opposition party SPD provided for an explicit consent for cookies, but were not adopted. However, the final say if the implementation is sufficient lies with the European Commission, which has already announced to sue Belgium, The Netherlands, Poland, Portugal, and Slovenia for non implementation of the Directive.

The current view of the government is consistent with German business practice pursuant to which a consent by the user to accept cookies is only required if the cookies process personal data, and any way, consent may be given by setting the browser to accept cookies. Due to sec. 13 para 1 TMG, the use of cookies must also be mentioned in the website’s privacy statement if they might process personal data in the future, and most German websites comply with this requirement.

Although it is possible to take a different legal view, there is no known case of data protection authorities taking action against internet sites that use normal cookies. Some data protection officers have issued warning letters against webshops that use webtracking technology like Google Analytics, which is based on Cookies, but this was motivated by the fact that Google Analytics transfers the IP-address (which, according to the authorities, constitutes personal data) to Google. However, the German public is quite critical about large corporations who create personal user profiles for targeted marketing, and it is possible that the data protection authorities will change their strategy regarding cookies on the basis that the Directive may be directly applicable in Germany because it was not properly implemented.

Leave a Reply

Your email address will not be published. Required fields are marked *