Justice: BGH is negotiating cookie storage - that's what it's about

Anyone who surfs the Internet basically has to constantly deal with cookies. You accept, reject - and decide to what extent the whole thing. But sometimes cookies are stored on their devices without the prior consent of website users. If the cookies do not come from the operator of the respective website themselves, the question of liability arises. The Federal Court of Justice (BGH) is devoting itself to this today (9:00 a.m.).

What's it about?

A plaintiff is demanding damages from a technology and analysis company that, according to the BGH, provides cookies on other companies' websites. The question is whether the defendant company is liable if these cookies are stored on their devices without the users' prior consent. However, according to the information, the parties are arguing about whether, to what extent and for what analysis purpose the defendant used cookies on the plaintiff's end devices.

What are cookies?

Cookies are small files that are stored on a user's online device while surfing. Because these files often contain unique identifiers, websites can use them to recognize their visitors. A browser can therefore remember a login or the contents of a virtual shopping cart. Above all, cookies make personalized advertising possible.

How have courts decided so far?

The lower courts found the plaintiff right in the main point. While the Frankfurt am Main regional court awarded him the full amount of 1,500 euros in damages, the Frankfurt am Main Higher Regional Court (OLG) found 100 euros to be sufficient. This was primarily because the plaintiff intentionally and consciously caused the cookies to be set.

In the opinion of the Higher Regional Court, the storage of cookies on the plaintiff's end devices without his consent constitutes a violation of the Telecommunications Digital Services Data Protection Act (TDDDG). The defendant company must ensure that the website operator gives it the user's consent before storing cookies on their device. This dutiful action was omitted.

How does this work technically?

The company stores the cookies on the users' devices even without their consent as soon as the corresponding request is triggered by a program code on the website visited, according to the OLG ruling. In addition, it accesses the information read out.

When can a ruling from the BGH be expected?

With the appeal to the BGH, the technology and analysis company wants to ensure that the lawsuit is completely dismissed. The first civil senate in Karlsruhe is unlikely to make a judgment on this today. This will probably only happen in a few weeks or months. (Af. I ZR 5/26)

What is the relevance of the case?

According to lawyer Laura Dereje from the commercial law firm CMS, the judgment is particularly relevant for providers of analysis and tracking services: “If the BGH confirms the opinion of the Frankfurt Higher Regional Court, contractual assurances from the website operators alone will probably not be sufficient in the future.” Rather, additional technical and organizational measures would be required to prevent cookies from being set without consent.

From Dereje's perspective, it remains to be seen whether lawsuits from end users will become more likely. End users would have to provide a well-founded explanation of the storage of cookies and the circumstances surrounding them, for which the plaintiff specifically obtained a private report. In addition, it is unclear whether there is any entitlement to compensation in the event of mass and automated violations. According to the expert, the BGH is currently having this clarified by the European Court of Justice in another case.

What changes are being planned at the political level?

In November 2025, the EU Commission proposed reducing the pop-up of cookie banners. Instead of repeatedly agreeing to or rejecting the use of cookies, internet users should be able to save their cookie settings on their own device, according to the proposal. This setting would then be automatically transmitted to the sites. If you never or always want to accept cookies, you would usually only have to do this once per device.

Will the proposal be implemented?

Before the change in the law can come into force, the European Parliament and the Council of EU states must take a position on it. Both institutions are still working on the extensive legislative proposal, which also provides for changes to other digital laws. Due to initial reactions from the capitals, consumer advocates fear that EU countries could oppose the new proposal for dealing with cookies.