Planet49 (BGH Cookie-Einwilligung II): a pre-ticked box is not consent

To enter the sweepstakes, users had to tick at least one of two boxes. One, already ticked, allowed a tracking service called Remintrex to set cookies linked to the user’s name and address for targeted advertising. The other, unticked, allowed marketing by sponsors chosen from a list of 57 companies, or by the organiser’s choice. The court held neither was valid consent.

These are court findings, from the BGH press release. Inth translated the German.

• Cookies: consent through a pre-ticked box unfairly disadvantaged users, both under the law at the time and under the GDPR. Cookies used to build user profiles for advertising or market research need the user’s consent, following the CJEU’s answer to the BGH’s questions.
• The random ID stored in the cookie and linked to the user’s registration details was a pseudonym, so profiling with it fell under the consent rule.
• Marketing calls: consent must be informed and "for the specific case" (translated), which means it must be clear which companies' products or services it covers. The form was designed to confront users with a laborious selection from the partner list so they would leave the choice to the organiser. Without that knowledge, there was no valid consent.

The pre-ticked box’s own explanation said the cookies would get a random ID tied to the registration data, so visits to Remintrex partner sites, the products viewed and any purchase could be recorded.

Illustrative pattern, not the defendant’s code.

1. September 2013Sweepstakes runs online
2. First instanceRegional court enjoins both consents and awards warning-letter costs
3. AppealHigher regional court overturns the cookie part; both sides appeal to the BGH
4. 5 October 2017BGH refers questions to the CJEU
5. 1 October 2019CJEU rules in C-673/17 that a pre-ticked box is not valid consent
6. 28 May 2020BGH restores the first-instance injunction

The BGH dismissed the organiser’s appeal, allowed the consumer federation’s appeal on the cookie consent and restored the first-instance ruling. The organiser must not use either consent wording and must pay the warning-letter costs. The decision is final.

No fine. An injunction, the warning-letter costs and about seven years of litigation.

This is the foundation case for active opt-in to advertising cookies, at both EU and German level. Every banner that requires a click before tracking traces back to it. It also shows that a long partner list can defeat consent if it is built to discourage reading.

• Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses.
• Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.
• Evidence: consent records show each visitor’s choice, country and policy.

Sign-up and sweepstakes forms are outside the banner. Pre-ticked boxes in your own forms must be fixed in your own code.

In the repository

• Search forms for consent checkboxes with a default checked state.
• Check that registration data is not linked to tracking IDs unless consent is recorded.

In the browser and network

• Submit each form without touching the consent boxes and check what cookies and requests follow.

With the people responsible

• Ask whether any campaign makes entry conditional on a marketing or tracking consent.

• BGH press release No. 067/2020 (German)
• BGH judgment, I ZR 7/16 (PDF) (German)
• CJEU, C-673/17

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit the organiser’s current systems. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Lakes v Ubisoft, GDPR and ePrivacy cookie rules, Neue Osnabrücker Zeitung