Enlarge image

Cookie banner: EU judges question the validity of consent

Photo: Lino Mirgeler / dpa

“This decision will not only be the end of the largest wave of spam in history, it is also the death knell for the tracking-based advertising industry,” says Irishman Johnny Ryan, who, together with other privacy activists, went to the European Court of Justice in 2022.

On Thursday, the judges announced their long-awaited decision on personalized online advertising.

Accordingly, the so-called "TCF string", which is sent every time a cookie banner appears on a screen or an advertising banner is loaded, applies to the personal data of EU citizens.

You must therefore explicitly agree to the transfer.

If they don't do this, it would not be possible to display personalized advertising, which would lead to greatly reduced advertising revenue for many media.

According to the judges' vote, the small industrial organization IAB Europe based in Brussels is at least partially liable for data trading, which is the basis for a large part of the 600 billion euros in advertising sales worldwide.

However, if the organization has its way, the verdict is actually good news for the advertising industry: "Nothing will change for the advertising market," assures Townsend Feehan in an interview with SPIEGEL.

Turning point for the advertising industry

The head of the association argues that the verdict is a technicality that only affects her small organization.

With the Transparency and Consent Framework (TCF), IAB Europe created the technical basis for millions of cookie banners and the associated advertising trade.

But the court determined that the organization was not responsible for the ongoing business with user interests, personality profiles and even location data, which are offered billions of times in huge online marketplaces.

At the same time, the organization attaches great importance to the statement that the judge's ruling has no immediate impact, but that a commercial court in Belgium will first decide on the next steps.

“This could take months,” she wrote in an initial public announcement.

But it doesn't seem very likely that the advertising business can continue as usual under the court's new guidelines.

IAB Europe had tried, for good reasons, to legally avert liability as a “jointly responsible party” (in technical language: “joint controller”).

This would mean that the organization could be held liable for infringements committed by other companies involved in the advertising trade.

This could mean a fine of 20 million euros per case, which IAB Europe might have to recover from those actually responsible.

It would be difficult to imagine continued business operations under these circumstances.

Feehand now claims that the judges have limited liability sufficiently so that the organization can continue to operate as usual, not even the cookie banners need to be changed.

The manager hopes that she would be sufficiently isolated from dubious data traders who misuse advertising data in order to spy on billions of users.

When asked by SPIEGEL, their German colleagues from the Federal Association of the Digital Economy (BVDW) are less optimistic that everything can stay the same: “The digital industry in Germany and Europe has developed steadily in recent years.

We are confident that even with a possible new legal situation, sustainable and economical solutions will emerge from the industry," explains a spokesman for the association, which is particularly active in the area of ​​online advertising.

Conversely, this means that a fundamental change is considered necessary.

Furthermore, they do not want to anticipate the upcoming court decisions in Belgium.

“Cookie banners probably won’t solve this problem”

When asked, the Federal Commissioner for Data Protection and Freedom of Information explains that the judgment is likely to have an impact on actors other than IAB Europe.

The data protection organization NOYB, run by the Austrian activist Max Schrems, does not see the verdict as the end of personalized advertising, but expects consequences: "Fundamentally, changes in the online advertising market are to be expected as a result," a spokesman told SPIEGEL.

How the advertising industry wants to get out of the mess is a matter for organizations like IAB Europe.

The industry is changing its business practices: “Modified cookie banners alone will probably not solve this problem.”

In the run-up to the decision, IAB Europe had tried to make the standards for cookie banners a little more consumer-friendly and in this way find a compromise with the Belgian supervisory authority.

Since then, it has been shown how many different market participants personalized data should be passed on to.

However, since this number is often in the three or even four-digit range, the industry has revealed the problem underlying the dispute: Can consumers actually agree to the passing on of potentially explosive information to such a large group of recipients who are effectively can hardly be controlled?

A dispute has now broken out in the industry as to who will be allowed to access which data in the future, for example in order to determine which advertising display led to a purchase.

Apple and Google are trying to insulate their advertising businesses from the controversial practices.

An initiative by the federal government, which wanted to effectively abolish cookie banners in Germany with a new legal regulation, also speaks for the explosive nature of the ruling.

“Recognized consent management services” should allow or reject cookies on behalf of users.

But according to the General Data Protection Regulation, these services would also have had to take responsibility for the data.

To date, no interested parties have been found for the risky job.