[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3yvV8ZqJrw6RhJcC-tBm8w_saPMconhc3ZjgqYpoygE":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"bc98c1c2-6f0b-45bb-87a2-e8bf1d44c6b8","LG Rostock - 3 O 762\u002F19","lg-rostock-3-o-762-19-31eee1","← Older revision Revision as of 14:38, 16 July 2026 Line 52: Line 52: |GDPR_Article_Link_16=Article 95 GDPR |GDPR_Article_Link_16=Article 95 GDPR |EU_Law_Name_1=Article 5(3) e-Privacy Directive |EU_Law_Name_1=Article 5(3) ePrivacy Directive 2002\u002F58\u002FEC |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58 |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj |National_Law_Name_1=§ 15(3) Telemediengesetz |National_Law_Name_1=§ 15(3) Telemediengesetz","The Regional Court of Rostock (LG Rostock) held that tracking cookies require active user consent and cannot rely on pre-ticked permission boxes, finding advocado GmbH's cookie banner unlawful under GDPR Articles 6 and 7. The court also determined that using Google Analytics creates joint controllership between the website operator and Google, requiring proper transparency and disclosure. The defendant has appealed the decision, which is not yet final.","German court rules pre-ticked cookie consent boxes violate GDPR; Google Analytics creates joint controllership.","Help LG Rostock - 3 O 762\u002F19: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 13:58, 20 September 2021 view sourceFD (talk | contribs)noContributionReport1,180 editsTag: Visual edit← Older edit Latest revision as of 14:38, 16 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators189 editsTag: Visual edit Line 52: Line 52: |GDPR_Article_Link_16=Article 95 GDPR|GDPR_Article_Link_16=Article 95 GDPR |EU_Law_Name_1=Article 5(3) e-Privacy Directive|EU_Law_Name_1=Article 5(3) ePrivacy Directive 2002\u002F58\u002FEC |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58|EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj |National_Law_Name_1=§ 15(3) Telemediengesetz|National_Law_Name_1=§ 15(3) Telemediengesetz Latest revision as of 14:38, 16 July 2026 LG Rostock - 3 O 762\u002F19 Court: LG Rostock (Germany) Jurisdiction: Germany Relevant Law: Article 4(2) GDPR Article 4(2) GDPR Article 4(11) GDPR Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 13 GDPR Article 14 GDPR Article 21 GDPR Article 24 GDPR Article 26 GDPR Article 28 GDPR Article 44 GDPR Article 45 GDPR Article 95 GDPR Article 5(3) ePrivacy Directive 2002\u002F58\u002FEC§ 15(3) Telemediengesetz§ 3 Gesetz über Unterlassungsklagen bei Verbraucherrechts- und anderen Verstößen (UKlaG)§ 8 Gesetz gegen den unlauteren Wettbewerb (UWG) Decided: 15.09.2020 Published: Parties: Claimant: Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv) Defendant: advocado GmbH National Case Number\u002FName: 3 O 762\u002F19 European Case Law Identifier: Appeal from: Appeal to: Pending appealOLG Rostock (Germany)unknown Original Language(s): German Original Source: Homepage of the plaintiff (decision not officially publsihed yet) (in German) Initial Contributor: Marco Blocher The regional court of Rostock (LG Rostock) held that tracking cookies can only be placed with the user's active consent. A preset permission that is only to be confirmed via an \"OK\" button is not sufficient. Further, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google. The controller appealed, the decision is not (yet) in force. Contents 1 English Summary 1.1 Facts 1.2 Dispute 1.3 Holding 1.3.1 Legal basis and validity of consent 1.3.2 Transparency 1.3.3 Sole or joint controllership when using Google Analytics? 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13\u002F14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673\u002F17 on 01.10.2019 (\"Planet 49\"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law \u002F consumer protection law perspective. This will not be discussed further in this summary.) Dispute Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)? Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR? Did the defendant violate GDPR provisions on transparency? Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers? Holding Legal basis and validity of consent The court held that the marketing and analytics cookies used by the defendant can only be placed with the users' consent under Article 6(1)(a) GDPR: § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons. Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big \"OK\" button. The option \"use only necessary cookies\" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered \"freely given\" and was invalid. Transparency The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies. Sole or joint controllership when using Google Analytics? Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google. Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the official opinion of the \"Datenschutzkonferenz\", a gathering of all German DPAs. Comment Please note that the decision is not (yet) in force, as the controller filed an appeal with the OLG Rostock at which the case is now pending. Therefore, the decision is not officially published but only presented on the plaintiff's website, where one can download the (redacted) decision. Once the OLG Rostock has issued its decision, it will be linked here. Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original as published on the webiste of the vzbv for more details. Please also note that below translation might be incomplete as is had to be created from a PDF document not readable in MS word. Rostock District Court In the name of the people Verdict In the litigation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Federation of German Consumer Organisations - Verbraucherzentrale Bundesverband e. V., represented by d. Vorsitzender, Rudi-Dutschke-Straße 17, 10969 Berlin - Plaintiff - Attorney-at-law- aga","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=LG_Rostock_-_3_O_762\u002F19&diff=52284&oldid=19832","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-16T14:38:48+00:00","2026-07-16T16:00:21.931648+00:00",7,[18,21,24],{"name":19,"type":20},"Google","vendor",{"name":22,"type":23},"Google Analytics","product",{"name":25,"type":20},"advocado GmbH","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":26,"icon":28,"name":29,"slug":30},null,"GDPR","gdpr",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[]]