For many tools and cookies, consent is required, also known as Consent. So-called Consent Tools are supposed to help here, but they do not suffice, as my practice test has shown. What requirements must a consent query actually meet?
Introduction
The use of data processing plugins and tools on websites is according to Art. 6 Sec. 1 GDPR essentially only permitted if
There is a legitimate interest of the website operator present
a consent from the website visitor has been obtained.
Websites that do not use cookies and also process data only as necessary (e.g., contact form) do not need a "cookie popup".
It also applies if only required cookies are used, such as for shopping cart management.
Furthermore, the ePrivacy Directive in Article 5 Section 3 stipulates that even the retrieval of cookies or reading out cookies is consent-obligatory. The directive also applies to Germany under § 15 Section 3 TMG, as the BGH established in its Planet49 ruling (28.05.2020 – I ZR 7/16) in 2020. The provision was officially introduced in Germany with § 25 TTDSG in December 2021.
The Art. 44ff GDPR stipulate that data transfer to insecure third countries (such as the USA) is not allowed in itself. Since IP addresses are already personal data, the GDPR law primarily applies to websites at all times.
According to these legal bases, for example, the following tools are mandatory:
- Google Analytics: ePrivacy Directive, Data transfer to the US. More details
- Google Maps: ePrivacy Directive (and/or others). More details
- *Facebook Plugin: ePrivacy Directive (and/or others)
- Google Fonts (external access): Art 44ff. GDPR or Art. 5 GDPR (data minimization). More details
- Google reCAPTCHA: ePrivacy Directive (and/or others). More details
- YouTube-Video with cookies: ePrivacy Directive (and/or others)
- YouTube-Videos without Cookies: Art. 44ff. GDPR or Art. 5 GDPR (Data Minimization)
- Vimeo-Videos: Art. 44ff. GDPR or Art. 5 GDPR (Data Minimization). More Details
- SoundCloud Player: ePrivacy Directive (and/or others). More details
The list can be continued almost arbitrarily for further known tools. The legitimate interest can be excluded for all these services. This can even be partly technically and thus undoubtedly proven.
Here you can check in seconds (free of charge and without registration) whether a website is data protection friendly or if action is required.
Consent Tool Checklist
If you are risk-aware enough to want to use one of the common consent solutions, this checklist will help you check your project. The common solutions, as my practice test has shown, are not solutions.
According to my tests inadequate are the following consent tools:
- Borlabs Cookie
- CCM19
- Cookiebot
- consentmanager
- Of course!
- OneTrust / Optanon / CookieLaw
- UserCentrics
The requirements for consent queries arise from the legislative text of the GDPR and from judgments by ECJ and BGH. Meanwhile, there are also judgments from smaller courts, such as from LG Rostock (15.09.2020 – 3 O 762/19), which considers it unlawful if refusal is not equally easy to accomplish as consent.
Requirements for consent queries:
- The right of withdrawal must be clearly visible → Art. 7 Sec. 3 GDPR
- Refusal should be as easy as consent → Judgment of LG Rostock
- A data protection hostile preselection is not allowed → ECJ ruling Planet49
- Simple revocation possibility → Art. 7 Sec. 3 GDPR
- The withdrawal must be simply possible (number of clicks!) → Art. 7 Sec. 3 GDPR
- The withdrawal must be fully possible (deletion of all cookies, unloading of all services) → Art. 7 Abs. 3 GDPR
- After revocation, the website should automatically reload in order to deactivate all active services by reloading the website
- Notification of services that consent is given for. Possibility to consent to each service or in categories of services→ Art. 12 GDPR, Art. 7 Sec. 4 GDPR
- For Service → Art. 13 GDPRRead full article now via free Dr. GDPR newsletter.Already a subscriber? Click on the link in the newsletter & refresh this page.↓Subscribe to Newsletter
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
