Run a free scan

Neue Osnabrücker Zeitung: refusing must be as easy as accepting

A German administrative court upheld an order against the cookie banner on noz.de. It found the banner steered visitors towards Accept all and that Google Tag Manager needed consent before it loaded.

LfD Niedersachsen and VG Hannover · TTDSG §25 and GDPR · Judgment 19 March 2025

Claim dismissed at first instance; appeal status not confirmed

Regulator or court
LfD Niedersachsen; VG Hannover
Jurisdiction
Germany
Framework
TTDSG §25 (now TDDDG); GDPR Articles 4(11) and 7
Judgment

Unequal choices or identity checks · Notice, consent scope and assent · Cookies before choice or after refusal · IP addresses and device identifiers

The problem

The banner on noz.de offered Accept all on the first screen. Refusing meant opening Settings, working through drop-down menus and saving a selection. Even then, about fifty third-party providers stayed active, and the banner came back on every visit until the visitor accepted. The court held that this design did not produce free consent. It also held that Google Tag Manager, which contacted Google on the first page load, needed consent or had to go.

Case record

Court
Verwaltungsgericht Hannover, 10th chamber, case 10 A 5385/22
Parties
The publisher of www.noz.de (claimant) v the Lower Saxony data protection commissioner, LfD Niedersachsen (defendant)
Decision
Judgment of 19 March 2025, made public by the LfD in May 2025
Law
TTDSG §25 (since renamed TDDDG) and GDPR Articles 4(11), 6(1)(a) and 7
Result
Claim dismissed; the LfD order of 23 November 2022 stands
Stage
First instance. A law firm blog reports an appeal; Inth found no appeal ruling

What the court found

These are court findings in a judgment that may not be final. They come from the full judgment text and the LfD press release. Inth translated the German quotes.

  • Consent was not free. The design steered visitors to Accept all: refusing took more steps, visitors could not tell how many steps were left, and the banner reappeared on each visit after Save selection.
  • A close button labelled "Akzeptieren & schließen x" (translated: "Accept & close x") gave consent. The court treated this as misleading, since visitors expect a close button to dismiss, not agree.
  • The banner headline promised an "optimales Nutzererlebnis" (translated: "optimal user experience"). The first layer never said in so many words that clicking gave consent.
  • The court doubted the consent was informed. The first layer did not show how many third parties were involved, and the notes on withdrawal and transfers to third countries such as the US appeared only after scrolling.
  • Google Tag Manager stores and reads information on the device. It is not strictly necessary for a service the visitor asked for, so the §25(2) exemption did not apply and consent was needed.
  • The LfD was competent to enforce §25 against the publisher.

The court also noted that NOZ’s own argument only asked whether a Reject all button must appear on the first layer. The court said the real question was whether the design as a whole steered visitors to give broad consent. The LfD’s press release headline puts its reading more bluntly: "Alles ablehnen-Schaltfläche ist ein Muss" (translated: "a Reject all button is a must"). That is the regulator’s summary, not the court’s wording.

Technical issue

According to the judgment, the LfD tested the site in its IT lab on 15 November 2022. On first load, before any choice, the browser contacted www.googletagmanager.com, sent an ID with device data, the IP address, the country and the referrer, and stored the gtm.js script. The banner was a Sourcepoint consent tool using the IAB Transparency and Consent Framework. The LfD’s order named 122 third-party services.

Inth’s technical interpretation: a tag manager is a loader. If it runs before consent, it already sends a request to its vendor, and it can then inject other tags. Loading it early and relying on it to hold back later tags does not meet a consent requirement for the loader itself.

// Risky: tag manager loads on every page view
loadScript('https://www.googletagmanager.com/gtm.js?id=GTM-XXXX');

// Safer: load it only after the visitor agrees
consent.onGranted('measurement', () => {
  loadScript('https://www.googletagmanager.com/gtm.js?id=GTM-XXXX');
});

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

  1. 4 December 2018Complaint to the LfD about cookies on noz.de
  2. 21 November 2019First LfD order. NOZ sued, then withdrew; the case closed on 28 January 2021 and the order became final
  3. 15 November 2022LfD lab test finds Google Tag Manager contacted before consent
  4. 23 November 2022Second LfD order on banner design and Google Tag Manager
  5. 22 December 2022NOZ sues to overturn the order
  6. 19 March 2025VG Hannover dismisses the claim
  7. May 2025LfD and court publish press releases

Outcome

The court dismissed NOZ’s claim, so the order stands: the publisher must collect valid, informed and free consent where the law requires it, and must either get consent for Google Tag Manager or remove it. The published judgment text does not show whether leave to appeal was granted. A law firm blog (KIJUDA) reports that NOZ appealed. Inth found no ruling from the higher administrative court in Lüneburg, so treat this outcome as not confirmed final.

What it cost

No fine. This was a compliance order, not a penalty. The cost was a banner redesign, removal or gating of Google Tag Manager and more than six years of proceedings from the first complaint to the judgment.

Why it matters

This is one of the most detailed German rulings on banner design. It looks at the whole flow, not one button: how many clicks refusal takes, whether visitors can see the end of the process, whether refusal sticks and whether the wording says what a click does. It also treats a tag manager as a tool that needs consent in its own right.

How Inth catches this

  • Website audit records what loaded before a choice and after Reject, with the page, time, region and consent state. A request to a tag manager on first load shows up there.
  • Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.
  • Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses. Accept and Reject get the same weight by default. Tags without a c15t helper must be gated in your own code.
  • Evidence: consent records show each visitor’s choice, country and policy.

None of this decides whether your wording is clear enough or whether a vendor is strictly necessary. Those are legal judgements for your team.

Checks for your own systems

In the repository

  • Find where the tag manager snippet loads and confirm it sits behind a consent check.
  • Check that a saved refusal is stored and read, so the banner does not return on every visit.

In the browser and network

  • Load the site in a clean profile and list every third-party request before any click.
  • Count the clicks to refuse everything and compare them with the clicks to accept.
  • Check what a close or X button actually records.

With the people responsible

  • Ask whether the first layer says plainly that a click gives consent, and how many partners are involved.
  • Ask which vendors stay active after a full refusal, and on what basis.

Sources and limits

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit NOZ’s current systems. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.