On August 3, 2011, the German Parliament received a new Bill from the Federal Council of German States (Bundesrat) proposing a revision of the German Telemedia Act (Telemediengesetz). As part of the revision, the Bill proposes to transform the cookie consent requirement of the revised European E-Privacy Directive. While it is doubtful that the Federal Council Bill will get the necessary votes in Parliament, the initiative forces the German Government to take action.
Initially, the Government had decided to leave the issue of cookie consent aside and wait for the outcome of ongoing discussions on the practical solutions for implementation. It did not include a provision on cookie consent when it proposed the Government Bill on the general transformation of the European Telecoms Package on March 2, 2011.
The explanatory notes of the Government Bill referred to ongoing discussions on a European level and stated that the Government wanted to wait with the legislative implementation of the cookie consent requirement. Meanwhile, the German Government has engaged in an intensive discussion with German industry groups on a localized implementation of the IAB Europe self regulatory measures intended to provide users more control over cookies and behavioural advertising. The discussion is still ongoing.
The initiative of the Federal Council is now putting the Government under pressure to accelerate the process. The Government Bill on the implementation of the Package is already in Parliament and subject to ongoing negotiations in the Parliament Committee for Economic Affairs. It might get its final vote by the Parliament already before the end of this year. In order to introduce a provision on cookie consent in this process, the Government announced in its comments on the Federal Council Bill that it will provide the Parliament with a proposal to add such a provision in the Government Bill.
The Government might follow the approach of the Federal Council and propose an implementation close to the wording of Article 5 (3) of the Directive. Neither the wording proposed by the Federal Council nor its explanatory notes elaborate on the question of the validity of consent by browser settings as contemplated in Recital 66 of the E-Privacy Directive. This raises concerns as to whether browser settings will be regarded as sufficient to establish that a user has consented.
Another area of concern regarding the Bill is that the privacy provisions in the Telemedia Act usually refer to “personal data”, but the proposed provision on the consent requirement for cookies refers to “data” only. This might make the provision applicable to situations where the data is not personalized. The consent requirement in the E-Privacy Directive also refers to “information” in general, but the Directive as a whole is limited to the protection of personal data. In contrast, the German Telemedia Act contains general provisions on online-services and is not just a privacy law.
The troubling part of this course of events is that the final wording of the final provision on cookie consent in Germany may come as a surprise to the internet industry as the text is likely to be made public no earlier than one or two days before the final Parliament vote. The Federal Council would still have to sign off on the final Bill, but for most laws this is just a formality. The new provision would then come into effect one day after the publication of the law in the public journal, unless the Parliament sets a later date.