Enlarge image
Cookie banners: Agreeing is easy, rejecting it is often more difficult
Photo: Bernd Weissbrod / dpa
The European data protection organization noyb ("none of your business", translated: It's none of your business) is following up in its fight against illegal cookie consent requests on the web. After a first wave of complaints, which was addressed to the website operator themselves at the end of May, the team around the Austrian data protection activist Max Schrems now wants to submit 422 formal complaints to ten data protection authorities. In his opinion, the companies with manipulative cookie banners violate the General Data Protection Regulation (GDPR).
Cookies are small data sets that websites store in order to make users identifiable.
With their help, individual profiles can be created that allow far-reaching conclusions about surfing behavior, preferences and lifestyle.
This knowledge is then used, for example, for personalized advertising.
According to letters to more than 500 companies on May 31, 42 percent of all violations on more than 516 websites have been eliminated, said noyb.
Global brands such as Mastercard, Procter & Gamble, Forever 21, Seat and Nikon are among the companies that have completely stopped using so-called dark patterns to obtain consent.
Companies argue with unfair competition
Dark patterns are user interfaces and designs that are supposed to lead users to an action that does not correspond to their actual intentions.
In the case of cookies, the buttons, structure and labeling are specifically chosen so that website visitors are most likely to make a selection that is unfriendly to data protection.
Only a minority of the companies contacted followed noyb's request to make the revocation as easy as giving consent.
Only 18 percent would have set up such an option as a kind of cancellation symbol on their website.
The name noyb may not be very common yet, but in the cookie dispute the advertising industry is facing a serious opponent. Schrems has already brought Facebook to its knees in two spectacular cases. On the one hand, he enforced before the European Court of Justice (ECJ) in October 2015 that the transatlantic data protection agreement Safe Harbor used by Facebook was overturned. In June 2020, he finally brought down the successor regulation Privacy Shield before the ECJ.
Schrems has now said that companies have expressed concerns that their competitors will fail to comply, which will lead to unfair competition. “Others said they are waiting for a clear decision from the authorities before complying with the law. We therefore hope that the data protection authorities will soon issue decisions and sanctions. "
Independently of the review of the more than 500 websites in the first wave of complaints, Schrems and his team also scrutinized larger global and national websites that use individual "cookie banners" and therefore require manual review. This includes all major platforms such as Amazon, Twitter, Google or Facebook. "They all refused to improve their banners," declared the data protection activists. Noyb therefore filed a further 36 complaints against these companies.
"Larger players and sites that are heavily dependent on advertising have largely ignored our warning," lamented Schrems.
"Some of them argue openly that they have the right to manipulate users into clicking the OK button." Schrems advocated "clear pan-European rules".
"At the moment, a German company has the feeling that the interpretation of the GDPR by the French authorities only applies to France, although the law should apply equally everywhere."
pbe / dpa
