Federal government wants to curb cookie banners – with pointless regulation

The federal government wants to regulate cookie banners on the Internet. With the help of consent management services, users should be able to permanently consent to the use of cookies and manage them. However, the plan raises questions because the corresponding regulation has problems in every respect.

Cookie banners appear almost every time a website is accessed. Users are asked whether they want to agree to text files being stored on their device. These so-called cookies contain personal data that website operators can use for advertising purposes.

The problem: Many providers use cookie banners to encourage as many users as possible to give their consent. These are often misleading, prevent further browsing or contain insufficient information about data processing.

For example, the option to reject cookies is not always available on the first page. Sometimes you have to click or scroll through to find the option. For years, there has been discussion about how website operators can process data in a legally compliant manner while at the same time ensuring consumer rights.

Cookie-Banner: Federal government wants to improve Internet

The federal government has therefore set itself the goal of reducing cookie banners in order to improve the user experience on the Internet. This is stated in a new regulation by the Federal Ministry for Digital Affairs and Transport (BMDV), which the federal government passed on September 4, 2024. However, the Bundestag and Bundesrat still have to agree.

According to the draft, so-called consent management services are intended to be a user-friendly alternative. Users should be able to permanently consent to the use of cookies and manage them. The plan: The economy should develop corresponding services for consent management – for example in the form of browser plug-ins.

These should be able to remember the cookie settings for individual websites and communicate these to the operators if necessary. The user interface of such consent management services should be transparent and understandable in order to be able to understand settings.

In addition, users should be able to choose the services freely. To ensure all of this, the Federal Data Protection Commissioner should examine and approve the services. But the plan raises questions because the new regulation seems pointless.

Cookie regulation is a problem at every turn

The biggest problem: website operators do not have to accept user decisions made via consent management services. This is because the regulation (Section 19 EinwV-E) stipulates that they can ask for consent again at any time if users do not want to give their consent by default.

In concrete terms, this means that anyone who does not want providers to continue to track their data in order to use it for advertising purposes will probably continue to receive annoying cookie banners. This not only means that there is no incentive for users to use consent management services, but also for businesses to develop them in the first place.

In a statement, the Federal Association of Consumer Organizations (vzbv) is therefore demanding that the regulation stipulate that website operators must comply with users' decisions – especially if they do not consent. In this case, providers should refrain from further queries for a certain period of time, for example six months.

Cookie banner: loophole for website operators

It is also unclear who would have an interest in developing consent management services. The regulation does provide that such services may be offered for a fee. However, if website operators are not necessarily required to comply with users' decisions, the willingness to pay is likely to be low.

The regulation also leaves a loophole (Section 20 EinwV-E) that would allow website operators to refuse consent management services. They would have to give an “objective reason” for doing so, but it doesn't get any more specific than that. Providers could, for example, argue that they do not use certain technologies.

To ensure that users can truly freely choose consent management services, the regulation would have to guarantee that website operators are not allowed to exclude the services in principle.

Also interesting: