German DPAs face court action over 'Pay or OK' inactivity

Privacy advocacy group noyb has filed lawsuits against two German data protection authorities on June 17, 2025, over their prolonged failure to act on complaints about unlawful "Pay or OK" consent systems. The cases target authorities in North Rhine-Westphalia and Hesse, marking nearly four years since the initial complaints were filed in August 2021.

The lawsuits challenge the authorities' handling of complaints against news websites faz.net and t-online.de, which implemented consent banners requiring users to either accept tracking for personalized advertising or pay for ad-free access. Max Schrems, Honorary Chairman of noyb, characterized the situation as revealing "pure political unwillingness to enforce the GDPR against media companies."

Summary

Who: Privacy advocacy group noyb filed lawsuits against data protection authorities in North Rhine-Westphalia and Hesse, with Jonas Breyer from Breyer Legal representing the complainant.

What: Legal action challenges the authorities' nearly four-year failure to decide complaints about "Pay or OK" consent systems used by news websites faz.net and t-online.de that achieve 99%+ consent rates despite only 3-10% of users wanting personalized advertising.

When: Lawsuits filed June 17, 2025, following original complaints from August 2021 and a May 2025 "non-decision" from North Rhine-Westphalia stating it could not yet decide.

Where: Administrative Courts in Wiesbaden and Düsseldorf will hear cases against Hesse and North Rhine-Westphalia authorities respectively, with implications for German GDPR enforcement.

Why: The authorities' inaction prevents resolution of fundamental questions about consent validity under GDPR, allowing potentially unlawful practices to continue while undermining public confidence in data protection enforcement against media companies.

Statistical disparities raise consent validity concerns

The complaints center on fundamental questions about consent validity under the General Data Protection Regulation (GDPR). Research data shows that while only 3 to 10 percent of people actually want tracking for personalized advertising, "Pay or OK" systems achieve consent rates exceeding 99 percent. This dramatic disparity between user preferences and banner responses forms the core of noyb's legal argument.

According to the GDPR, consent must be "freely given" to be legally valid. The near-universal acceptance rates despite minimal actual desire for personalized advertising suggests users face coercive choices rather than genuine alternatives. The European Commission has previously indicated that such approaches may violate legal standards in cases involving Meta.

North Rhine-Westphalia's procedural complications

The North Rhine-Westphalia authority's handling of the t-online.de complaint reveals significant administrative dysfunction. After confirming receipt of the complaint in August 2021, the authority provided no substantial updates for over a year. In November 2022, more than 15 months after confirmation, officials contacted noyb claiming they had seen the complaint on the organization's website but never received it directly.

Noyb responded by providing the authority's own acknowledgment of receipt from the previous year. This exchange initiated numerous written submissions and multiple attempts by noyb to obtain a decision. The process culminated in May 2025 with the authority issuing a 12-page decision stating it could not yet make a decision - nearly four years after the original filing.

Jonas Breyer, the lawyer representing the complainant, expressed frustration with the authorities' performance: "It is a shame that the data protection authorities of North Rhine-Westphalia and Hesse still did not issue a decision on the content after almost four years."

Yield: How Google Bought, Built, and Bullied Its Way to Advertising Dominance

A deeply researched insider’s account of Google’s epic two-decade campaign to dominate online advertising by any means necessary.

Order Now

Hesse authority cites complexity for delays

The Hessian data protection authority has similarly avoided making substantive decisions in the case against faz.net. Officials justified their inaction by citing case complexity and potential future guideline developments. However, this reasoning appears undermined by the fact that Lower Saxony's data protection authority successfully decided a similar complaint in 2023.

The disparity in response times and decisiveness among German authorities highlights significant inconsistencies in GDPR enforcement across the country. While Germany maintains a reputation for strict data protection standards, practical enforcement appears substantially weaker than public perception suggests.

German enforcement statistics reveal broader issues

Analysis of European Data Protection Board statistics between 2018 and 2023 reveals that only 1.26 percent of cases before all German data protection authorities have resulted in fines. This enforcement rate appears notably low compared to the volume of complaints and the potential scope of violations across digital services.

The Hesse Data Protection Authority's 2024 performance illustrates this enforcement gap. Despite receiving 3,839 complaints during the year, the authority ordered only 115 corrective measures. Felix Mikolasch, Data Protection Lawyer at noyb, noted the authorities' apparent lack of interest in consistent GDPR application.

The contrast becomes more stark when examining recent enforcement actions by other European authorities. Belgium imposed a €100,000 fine on a telecommunications company for delayed responses to data access requests. Swedish authorities fined health companies 45 million kronor for transferring sensitive data to Meta through tracking pixels. Dutch authorities have been particularly active, with Kruidvat receiving a €600,000 penalty for unlawful tracking cookies.

Business enabler mentality challenges enforcement

The enforcement patterns suggest German authorities increasingly view themselves as "business enablers" rather than privacy protectors. This orientation may explain the reluctance to take decisive action against established media companies using questionable consent mechanisms.

The trend concerns privacy advocates who argue that effective data protection requires consistent enforcement regardless of the violating entity's profile or industry sector. Recent ICO guidance in the UK demonstrates that regulators can provide clear frameworks for "consent or pay" models while maintaining strict compliance requirements.

Administrative court proceedings commence

The complainant has now filed lawsuits with Administrative Courts in Wiesbaden and Düsseldorf respectively. Success in these actions would compel the authorities to decide the original complaints and potentially establish precedents for future enforcement activities.

The legal proceedings represent a significant escalation in the ongoing debate over consent mechanisms in digital advertising. Previous noyb litigation against Hamburg authorities over DER SPIEGEL's consent banners demonstrates the organization's systematic approach to challenging inadequate enforcement.

Industry implications extend beyond German borders

The cases carry implications far beyond German borders. European trade groups recently defended "consent or pay" models in submissions to the European Data Protection Board, arguing for recognition of economic necessities in digital publishing.

Meanwhile, technical infrastructure continues evolving around consent mechanisms. Google's recent removal of non-personalized ad controls from AdSense settings forces publishers toward standardized consent frameworks like the IAB Transparency and Consent Framework.

Belgian courts have clarified IAB Europe's responsibilities within the TCF framework, limiting joint controllership to TC String processing while maintaining GDPR violation findings and a €250,000 fine. These developments underscore the complex technical and legal landscape surrounding digital consent.

Technical compliance requirements remain unclear

The current enforcement vacuum creates uncertainty for publishers attempting to implement compliant consent systems. French authorities have ordered corrections to misleading cookie banners, while Hesse authorities have ruled that abandoned cart emails constitute illegal advertising without explicit consent.

These scattered enforcement actions across different jurisdictions and violation types highlight the need for consistent guidance and decisive action from German authorities. The current delays in the "Pay or OK" cases prevent the development of clear legal precedents for publishers and users alike.

The administrative court cases against North Rhine-Westphalia and Hesse authorities may finally force decisions that provide needed clarity. However, the nearly four-year delay has already undermined public confidence in German data protection enforcement and allowed potentially unlawful practices to continue unchecked.

Representation and next steps

Jonas Breyer from Breyer Legal represents the complainant in both administrative court actions. The proceedings will determine whether the authorities must finally decide the substance of the original complaints rather than continuing indefinite delays.

The cases highlight fundamental questions about regulatory accountability in data protection enforcement. While the GDPR provides strong legal frameworks for privacy protection, effective implementation requires authorities willing to make difficult decisions against powerful industry interests.

Timeline

• August 2021: noyb files GDPR complaints against faz.net and t-online.de for "Pay or OK" systems
• August 2021: North Rhine-Westphalia DPA confirms receipt of t-online.de complaint
• November 2022: North Rhine-Westphalia DPA claims never receiving complaint despite previous confirmation
• 2023: Lower Saxony DPA issues decision on similar complaint, demonstrating feasibility
• May 2025: North Rhine-Westphalia DPA issues "non-decision" stating it cannot decide yet
• June 17, 2025: noyb files lawsuits against both authorities in administrative courts
• Related: August 2024 noyb lawsuit against Hamburg DPA over DER SPIEGEL consent banners
• Related: January 2025 European trade groups defend consent or pay models to EDPB
• Related: May 2025 Belgian court ruling on IAB Europe's TCF responsibilities