Run a free scan

Telekom and Google transfers: Accept all did not cover sending data to the US

Visiting telekom.de sent IP addresses and browser and device data to Google in the US for Google Ads. Two Cologne courts held this had no valid basis, before and after the EU-US Data Privacy Framework.

Landgericht and Oberlandesgericht Köln · GDPR transfers and consent · Appeal judgment 3 November 2023

Not confirmed final: revision to the BGH allowed

Regulator or court
Landgericht Köln and Oberlandesgericht Köln (consumer association claim)
Jurisdiction
Germany
Framework
GDPR Articles 44 to 49 and 6(1)(a); German Civil Code §307; Injunctions Act (UKlaG)
Appeal judgment

International data transfers · IP addresses and device identifiers · Notice, consent scope and assent

The problem

Verbraucherzentrale NRW checked the traffic from telekom.de and found that Google Ads still received visitors' IP address, browser and device information in the US. Telekom relied on clicks of "Alle akzeptieren" (accept all) and on privacy notice clauses citing a contract-necessity exception. The courts held neither worked.

Case record

Courts
Landgericht Köln 33 O 376/22; Oberlandesgericht Köln 6 U 58/23
Parties
Verbraucherzentrale NRW v Telekom Deutschland GmbH. The published judgments anonymise the defendant; VZ NRW names it
Decisions
Regional court 23 March 2023; appeal court 3 November 2023
Law
GDPR Articles 44 to 49 and 6(1)(a); German Civil Code §307
Stage
The appeal court allowed Telekom a further appeal (revision) to the BGH. Inth found no BGH ruling, so the case is not confirmed final

What the courts found

These are court findings, from the OLG Köln judgment. Inth translated the German.

  • Telekom was responsible for the transfer of personal data to Google LLC in the US when the site loaded (para 81).
  • Before the Data Privacy Framework, the transfer was not covered by appropriate safeguards under Article 46 or by valid consent under Article 49(1)(a). Contract necessity did not apply, because Telekom’s own advertising was not needed to perform a contract (para 112).
  • The DPF took effect on 10 July 2023 and Google LLC is certified under it. That changed nothing for the injunction: the general rules still apply, including valid consent under Articles 6 and 7 (paras 110 to 122).
  • The consent was invalid because the privacy notice suggested that Google Ads works without any transfer of personal data. Users who believe no personal data is processed are not properly informed (para 123).
  • Two privacy notice clauses on analytics and marketing cookies, built into the banner’s consent text, were standard terms. They wrongly claimed that third-country transfers were covered by Article 49(1)(b), the contract exception, and were invalid (paras 60 to 70).

The regional court had also criticised the banner design but rejected that claim as too broadly worded, according to GDPRhub’s summary. That part did not lead to an order.

Technical issue

The injunction refers to Google-provided HTML elements, in particular image pixels, that made the browser contact Google servers. Each request carries the visitor’s IP address and browser details. The consumer association could not see the site’s source code, so the court accepted a description of the observed behaviour (para 84).

// Risky: ad pixel fires on page load
loadAdPixel();

// Safer: fire only after a recorded marketing choice,
// with notice text that says data goes to the vendor
if (consent.has('marketing')) {
  loadAdPixel();
}

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call. Gating alone would not have fixed the misleading notice.

Timeline

  1. 24 February 2022Warning letter covering the privacy notice clauses
  2. 23 March 2023Regional court enjoins the US transfer
  3. 10 July 2023EU-US Data Privacy Framework takes effect
  4. 3 November 2023Appeal court dismisses Telekom’s appeal and adds the clause injunctions
  5. After November 2023Revision to the BGH allowed; no outcome found

Outcome

Telekom must not transfer consumers' personal data to third countries for analytics and marketing on its website in the way described, and must not use the two clauses. Each breach can lead to a court penalty of up to €250,000. Other claims were dismissed, and the consumer association bears 55% of the costs of both instances. The revision allowed covers these three orders, so they may still change.

What it cost

No fine. €260 in warning-letter costs plus interest, 45% of the legal costs and the injunctions.

Why it matters

The DPF does not fix a consent that misdescribes what happens. If a notice tells visitors that an ad tool sends no personal data, Accept all does not cover sending it.

How Inth catches this

  • Website audit records observable browser requests, and what loaded before a choice and after Reject, with page, time, region and consent state.
  • Code audit can trace reviewed outbound data flows and flags a pull request that adds an advertising tag outside the consent check.
  • Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses. The Google tag uses Consent Mode v2 defaults set to denied.

A browser observation cannot establish downstream use, and Inth cannot decide whether a transfer is lawful or whether a privacy notice is accurate.

Checks for your own systems

In the repository

  • List every ad and analytics pixel and confirm each one waits for the matching consent.

In the browser and network

  • Record which vendor domains receive requests before a choice, after Accept and after Reject.

With the people responsible

  • Check that the privacy notice says which vendors receive personal data and on what legal basis.
  • Remove any claim that a tool sends no personal data unless you can show it.

Sources and limits

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Telekom’s current systems. Inth searched for a BGH ruling on the revision and found none; that is not proof that none exists. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.