vzbv v Google: one consent for 70 services was not valid

With express personalisation, users had to accept every use of their data or abandon sign-up. Manual personalisation let them refuse individual uses, but not the use of location in Germany. Neither path said which of Google’s services, apps, sites or partners the data would be used for.

These are first-instance findings as reported by vzbv, the claimant. They are under appeal. Inth translated the German.

• Not free: consent was not voluntary, at least because the processing could not be refused entirely.
• Not informed: Google did not say which services, apps, sites or partners the data would be used for, so the reach of the consent was "completely unknown" to users (translated).
• That listing every service would be confusing pointed "strikingly to the fact that the defendant has stretched the scope of the consent considerably" (translated).
• Privacy by default: deletion after three months could only be set afterwards. Not offering it in the default settings breached Article 25(2).

The consent covered Web and App Activity, meaning activity on Google sites, apps and services, searches, interactions with Google partners, location and voice, plus YouTube watch history and personalised ads. This is a sign-up flow inside the product, not a website cookie banner.

1. 30 June 2022Ten consumer groups act against Google under BEUC; vzbv sends a warning letter
2. 25 March 2025LG Berlin II grants the claim
3. 16 May 2025vzbv publishes the judgment and reports Google’s appeal

Injunction against the consent design and an order to offer a three-month retention period in the default settings. The judgment is not final.

No fine. This is a civil injunction claim by a consumer federation.

Any product that bundles consent for many purposes into one sign-up step faces the same test: users must be able to refuse and must know what they agree to. It is the German counterpart to the French regulator’s action on the same sign-up flow.

Mostly it does not. In-product settings and sign-up screens are outside the banner, and this page does not claim that Inth reviews sign-up consent design or retention defaults.

• Consent banner: on the website itself, Accept and Reject get the same weight by default, so refusing is as easy as accepting.
• Code audit can map reviewed data ingestion and onward-sharing routes, which helps list the purposes a consent would need to name.

In the repository

• Check that each optional purpose in sign-up has its own setting, and that defaults are the most privacy-protective option.

In the browser and network

• Walk through sign-up and confirm a user can finish it while refusing every optional purpose.

With the people responsible

• Ask whether the consent text names the services and partners that will use the data.

• vzbv case summary, 16 May 2025 (German)
• LG Berlin II judgment, 15 O 472/22 (PDF) (German)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It relies on the claimant’s summary of the judgment. It does not audit Google’s current sign-up flow. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: CNIL v Google, Bundeskartellamt v Meta, Focus Online