What is the ruling of the Regional Court of Hanover regarding Google Tag Manager?

The court ruled that Google Tag Manager may only be used after the website visitor’s consent. Furthermore, an ‘reject all’ button must be offered in the consent query.

According to the ECJ, what are the consequences of losing control over one's own data?

The Court of Justice of the European Union has ruled that loss of control over one's own data constitutes an immaterial damage, which justifies a claim for compensation. The amount of the damage is irrelevant as long as the loss of control can be proven.

What legal violations arise from the use of Cookiebot?

The court ruled that the processing and transfer of personal data by Cookiebot to the USA is illegal. This particularly concerned the use of the tool for collecting consent to cookies on websites.

When can compensation-in-kind be awarded due to received advertising emails?

Damages (or compensation) may be awarded if the claimant has suffered harm resulting from unsolicited advertising emails, as exemplified by the Heidelberg District Court, arising from the handling of these emails.

What responsibilities arise from judgments by the ECJ regarding cookies?

The Court of Justice of the European Union (CJEU) has ruled that cookies that are not technically necessary require the consent of the user. Furthermore, this consent must be obtained actively, for example, through an active selection, and not through pre-ticked checkboxes.

Who is jointly responsible for the processing of personal data, for example through social media plugins?

The website operator and the plugin provider, such as Facebook, share jointly the responsibility for the processing of personal data. This means that both parties are responsible for complying with the data protection regulations.

What did the Court of Justice of the European Union decide in the Safe Harbor (Schrems I) ruling?

The Court of Justice of the European Union (CJEU) has ruled that data transfers to organizations in the US that adhered to the Safe Harbor principles are invalid. This concerned the legally secure transfer of personal data to the US.

What are the requirements regarding cookie consent?

According to rulings such as Orange Romania and the ECJ, pre-activating checkboxes for consent is not permitted. Users must actively and voluntarily consent, and no tricks may be used to facilitate consent.

Important judgments

Data Protection Laws — Complying with data protection laws saves a lot of time and trouble (Image license: CC0).

Damages for Unauthorized Cookies

Reference: OLG Frankfurt am Main, Judgment of 11.12.2025 – 6 U 81/23

Description: A website visitor was awarded €100 in non-material damages because cookies were placed on the user's device without legal basis (particularly without consent).

Judgment Text

Google Tag Manager Only Permitted After Consent

Reference: VG Hannover, Judgment of 19.03.2025 – 10 A 5385/22

Description: The court decided, based on an application by the Lower Saxon Data Protection Commissioner, that Google Tag Manager may only be used (loaded) after consent from the website visitor. Furthermore, it was decided that a "Reject all" button must be offered on the consent request ("Cookie Popup").

Judgment Text

Loss of Control Sufficient for Damages

Reference: ECJ, Judgment of 04.10.2024 – C-200/23

Description: The ECJ has decided that loss of control over one's own data constitutes non-material damage that a person can claim against a controller. The amount of damage is irrelevant. The loss of control merely needs to be demonstrated. Note: This is particularly the case with Real-Time Bidding (online advertising platforms such as Google Ads, Criteo, etc.).

Judgment Text

Obstinate Violation of the Obligation to Provide Information Under Art. 15 GDPR

Reference: VG Ansbach, Judgment of 12.06.2024 – AN 14 K 20.00941

Description: Data access was not granted. The Bavarian State Office for Data Protection Supervision was subsequently informed. It was supposed to investigate the matter. The data protection authority did not act. It was convicted for this and must now take action. The court sees no discretionary margin for the authority. The information must be provided, the authority must investigate.

Judgment Text

Violation of Information Obligations Constitutes Unlawful Data Processing

Reference: ECJ, Judgment of 11.07.2024 – C‑757/22

Description: The mere violation of the information obligations arising from Art. 13 and 14 GDPR constitutes unlawful data processing that can be challenged under Art. 80 Para. 2 GDPR.

This means that data processing is unlawful if the information obligations are not fulfilled at the latest at the time of the first data processing. Privacy notices that are too late, incorrect, or non-existent therefore result in unlawful data processing.

Judgment Text

The Service Provider is (Also) Liable for Cookies

Reference: OLG Frankfurt am Main, Judgment of 27.6.2024 – 6 U 192/23

Description: When visiting a website, consent-requiring cookies from a Microsoft service were created and read, even though no consent from the website visitor was present. The court confirmed that the service provider is liable for this unlawful use of cookies. Microsoft is not exonerated by the fact that Microsoft obligates website operators in the terms and conditions to obtain consent for these cookies.

Note: An underlying expert opinion in this proceeding was provided by Dr. Klaus Meffert (Dr. DSGVO).

Judgment Text

Transfer of IP Addresses to Google is Problematic

Reference: LG Cologne, Judgment of 23.03.2023 – 33 O 376/22

Description: The consumer protection organization obtained a judgment against Telekom. The court sees a problem when data transfer of IP addresses to Google to the USA takes place without further legitimization. IP addresses are always transmitted to Google when Google services are embedded on websites.

Judgment Text

Right to Injunction for Data Subjects

Reference: BGH Judgment of 21.01.2021 – I ZR 207/19 – "Sascha Hehn"

Description: Data subjects have a right to injunction when their personal data is not processed in accordance with GDPR and is therefore unlawfully processed.

Judgment Text