German court rules that 'Reject all' button is required on 'Do you allow cookies?' screen
Many websites display a pop-up asking for permission to use cookies when browsing. However, most of these pop-ups have an 'Allow All' button but no 'Reject All' button, so you have to click several times to reject cookies. This is inappropriate, and a German court has called for a correction, arguing that rejecting cookies should be as easy as accepting them.
OH_Digitale_Dienste.pdf
(PDF file)
Cookie-Banner: ``Alles ablehnen''-Schaltfläche ist ein Muss | Der Landesbeauftragte für den Datenschutz Niedersachsen
https://www.lfd.niedersachsen.de/startseite/infothek/presseinformationen/urteil-zu-manipulativem-cookie-banner-all-ablehnen-schaltflache-ist-ein-muss-241960.html
``Alles ablehnen''-Schaltfläche im Einwilligungsbanner auf Webseite unter Umständen ein Muss | Der Landesbeauftragte für den Datenschutz Niedersachsen
https://www.lfd.niedersachsen.de/startpage/theme/internet/all-ablehnen-schaltflache-im-einwilligungs-banner-on-website-under-an-assessment-241880.html
Administrative court: Cookie banner must contain 'Reject all' button | heise online
https://www.heise.de/en/news/Administrative-court-Cookie-banner-must-contain-Reject-all-button-10390520.html
When you access a website, a pop-up may appear requesting permission to use cookies, as shown below. Cookies are information used to identify users who visit a website. They are collected in a form that does not identify individuals, but they may sometimes be provided to hundreds of service providers, allowing for the creation of very detailed user profiles. The collection of such cookies is subject to rules set by laws such as the EU's General Data Protection Regulation (GDPR), and many websites are required to request permission when using cookies.
However, as you can see from the image above, many sites have 'Allow' buttons that are easily clickable, but most do not display a 'Reject' button. In these types of pop-ups, you cannot 'reject' the cookies unless you click a button such as 'Cookie Settings' to display the second level or higher.
A trial was held in the German state of Lower Saxony over the inappropriateness of requiring multiple clicks to deny access, while allowing access with a single click, and displaying confusing text such as 'Confirm your choice' instead of simply 'Deny.'
The incident started when Dennis Rehmkemper, the state's data protection officer, ordered the state's major media outlet 'NOZ (Neue Osnabrücker Zeitung)' to redesign its cookie banner. Rehmkemper pointed out the design flaws in the 'Do you allow cookies?' banner placed by NOZ, notifying them that any consent obtained with such unclear wording would be invalid, saying, 'It is much harder to refuse than to allow, making it difficult for users to know whether they have consented to the use of cookies.'
NOZ contested this and took legal action against the order, but the Hanover Administrative Court sided with Rehmkemper and found NOZ guilty of multiple violations.
The Administrative Court criticised the following points:
- Rejecting cookies requires a lot more effort than accepting them.
Users were pressured into giving consent through constant repeating banners
The use of cookies was described as 'optimized user experience' and the 'x' button in the top right corner of the banner was replaced with an 'Agree and Close' button, which was misleading to users.
・The word 'consent' was completely missing from the permission process
- The number of partners and services that provide cookies was not clear.
Information about the right to withdraw consent and about data processing in third countries outside the EU was visible only after scrolling.
The Administrative Court found that this violated both the EU GDPR and the German Telecommunications Digital Services Data Protection Act (TDSDS), and ruled that 'if a website displays an 'Allow all' button in the cookie banner, it must also display a clearly visible 'Reject all' button at the same level.'
Related Posts:
in Web Service, Posted by log1p_kr