The Lower Saxony data protection authority (LfD Niedersachsen) announced, on July 5, 2023, that it had completed its audit of the websites of five media companies, regarding the use of cookies and user tracking technologies for advertising purposes. 

Background to the audit

In particular, the LfD Niedersachsen explained that the audit revealed that the media websites used a very high number of first and third-party cookies and that the majority of these served to track users and to display personalized advertising.

Findings of the LfD Niedersachsen

Further to this, the LfD Niedersachsen noted that, in June 2021, it had concluded that none of the five websites complied with the legal requirements for the use of cookies and other tracking technologies. Specifically, the websites did not obtain valid consent for the placing of cookies, the design of the consent banners was misleading, and the information was inadequate or insufficiently differentiated. As such, the LfD Niedersachsen noted that the five media companies had been informed about their data protection failures in comprehensive evaluation letters.

Outcomes

Subsequently, the LfD Niedersachsen confirmed that the five media companies largely implemented the LfD Niedersachsen's demands with regard to regard to the data protection-compliant design of consent banners, including regarding the so-called pure subscription models, which in the meantime had also been subject to a comprehensive assessment by the German Data Protection Conference (DSK). However, the LfD Niedersachsen highlighted that it had sent final letters to the media companies outlining any remaining deficits in terms of data protection law and informing the same of its intention to carry out a follow-up audit in the future.

You can read the press release, only available in German, here.