“Reject all” cookies button must be present and visible, German court says

When confronted with cookie consent banners, many internet users click the “Accept All” button and expose themselves to a large number of cookies and tracking technologies. However, the Hanover Administrative Court in Germany has ruled out that a “Reject all” button must be equally offered and clearly visible.

Websites that use manipulative consent banners to encourage users to click “Accept all” violate the GDPR (European General Data Protection Regulation) and German law.

“Website operators must offer a clearly visible ‘Reject all’ button on the first level of the consent banner for cookie consent requests if an ‘Accept all’ option is available,” explains the State Commissioner for Data Protection of Lower Saxony.

“Consent banners may not specifically encourage consent and discourage the rejection of cookies, the Hanover Administrative Court stated in its reasoning for the ruling.”

German publication heise.de reports that the watchdog has recently achieved a legal victory in a long-standing battle against manipulatively designed cookie banners.

The state commissioner, Denis Lehmkemper, won a court battle against the Neue Osnabrücker Zeitung (NOZ), a major media company in the German state, which challenged the commissioner’s order to redesign its cookie consent banner.

“The company had obtained cookie consent via a banner – without offering users a real choice,” the commissioner said.

The ruling strengthens internet users’ data protection rights and may have implications for all website operators in Europe who do not obtain effective consent before setting up cookies and processing user data.

The court recognized several cookie banner layouts and designs as violations, such as:

• Making rejecting cookies more complicated than accepting them
• Pressuring users to consent by constantly repeating banners
• Misleading users with the heading “optimal user experience” and the label “accept and close” on the close button
• Not making the number of partners and third-party services involved apparent
• Hiding consent withdrawal and information about third-party data processing

“Many website operators have not yet implemented this choice. I hope this ruling sends a signal to as many providers as possible and thus contributes to the implementation of data protection-compliant consent solutions,” Lehmkemper warns.

Other supervisors in Europe are also fighting widespread manipulative cookie consent practices. The Dutch Data Protection Authority has recently found five organizations that asked for permission to place cookies and other trackers incorrectly.

And a UK watchdog has previously set a 30-day deadline for websites in Britain to ensure that they allow users to “Reject All” advertising cookies in the same way they can “Accept All.”