Anyone who surfs the Internet essentially has to constantly deal with cookies. You accept or reject - and decide to what extent the whole thing. But sometimes cookies are stored on their devices without the prior consent of website users. If the cookies do not come from the operator of the respective website themselves, the question of liability arises. The Federal Court of Justice (BGH) in Karlsruhe has now addressed this issue.
What's it about?
A plaintiff is demanding damages from a technology and analysis company that, according to the BGH, provides cookies on other companies' websites. The question is whether the defendant company is liable if these cookies are stored on their devices without the users' prior consent.
What are cookies?
Cookies are small files that are stored on a user's online device while surfing. Because these files often contain unique identifiers, websites can use them to recognize their visitors. A browser can therefore remember a login or the contents of a virtual shopping cart. Above all, cookies make personalized advertising possible.
How have courts decided so far?
The lower courts found the plaintiff right in the main point. While the Frankfurt am Main regional court awarded him the full amount of 1,500 euros in damages, the Frankfurt am Main Higher Regional Court (OLG) found 100 euros to be sufficient. This was primarily because the plaintiff intentionally and consciously caused the cookies to be set.
In the opinion of the Higher Regional Court, the storage of cookies on the plaintiff's end devices without his consent constitutes a violation of the Telecommunications Digital Services Data Protection Act (TDDDG). The defendant company must ensure that the website operator gives it the user's consent before storing cookies on their device. This dutiful action was omitted.
How does this work technically?
The company stores the cookies on the users' devices even without their consent as soon as the corresponding request is triggered by a program code on the website visited, according to the OLG ruling. In addition, it accesses the information read out.
How do both sides argue?
With the appeal to the Federal Court of Justice, the company wants to ensure that the lawsuit is completely dismissed. The lawyer argued in the oral hearing that the website operators were responsible for obtaining consent. They designed the pages and the consent buttons. The company has no influence on this and cannot meaningfully control it given millions of customer websites.
The plaintiff's lawyer responded that the company could not rely on a contractual obligation from customers to obtain consent. It has to ensure this itself. Especially since it can be technically solved that cookies are only set when they are available. Otherwise no cookies will be allowed to be set. The protection of privacy should not suffer.
How does the BGH see this?
According to a preliminary assessment, the first civil senate follows the OLG's decision on many points - but it is critical of it when it comes to liability. The court in Frankfurt may have to examine again to what extent the defendant company is responsible for setting the cookies. Therefore, the case could be remanded, said presiding judge Thomas Koch. The Senate wants to decide on this at a later date. (Af. I ZR 5/26)
What is the relevance of the case?
According to lawyer Laura Dereje from the commercial law firm CMS, the judgment is particularly relevant for providers of analysis and tracking services: “If the BGH confirms the opinion of the Frankfurt Higher Regional Court, contractual assurances from the website operators alone will probably not be sufficient in the future.” Rather, additional technical and organizational measures would be required to prevent cookies from being set without consent.
From Dereje's perspective, it remains to be seen whether lawsuits from end users will become more likely. You would have to provide a well-founded explanation of the storage of cookies and the circumstances surrounding them. The plaintiff obtained a private report specifically for this purpose. In addition, it is unclear whether there is any entitlement to compensation in the event of mass and automated violations. According to the expert, the BGH is currently having this clarified by the European Court of Justice in another case.
What changes are being planned at the political level?
In November 2025, the EU Commission proposed reducing the pop-up of cookie banners. Instead of repeatedly agreeing to or rejecting the use of cookies, internet users should be able to save their cookie settings on their own device, according to the proposal. This setting would then be automatically transmitted to the sites. If you never or always want to accept cookies, you would usually only have to do this once per device.
Will the proposal be implemented?
Before the change in the law can come into force, the European Parliament and the Council of EU states must take a position on it. Both institutions are still working on the extensive legislative proposal, which also provides for changes to other digital laws. Due to initial reactions from the capitals, consumer advocates fear that EU countries could oppose the new proposal for dealing with cookies.
