# KHO - KHO:2026:65

- Type: Case Law
- Source: KHO
- Date: 2026-09-02
- Original: https://gdprhub.eu/index.php?title=KHO_-_KHO:2026:65
- Canonical: https://overview.legal/posts/353649
- Topics: Cookies, Telecommunications, Direct Marketing, Consent, Controllers

## Summary

The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive. Consent given to the use of cookies on its website was not freely given, as rejecting non-essential cookies was significantly more difficult than accepting all cookies. English Summary. Facts. A media company (the controller) employed a two-layer mechanism to request user consent for the use of cookies on the website of a language news magazine owned by the

## Full text

The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive. Consent given to the use of cookies on its website was not freely given, as rejecting non-essential cookies was significantly more difficult than accepting all cookies. English Summary. Facts. A media company (the controller) employed a two-layer mechanism to request user consent for the use of cookies on the website of a language news magazine owned by the controller. The first layer of the mechanism primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the mechanism for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highli

## Cited law provisions (9)

### GDPR — gdpr-art-1-par-1-en

This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

### GDPR — gdpr-art-2-par-2-en

This Regulation does not apply to the processing of personal data:

### GDPR — gdpr-art-4-par-11-en

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

### GDPR — gdpr-art-7-par-3-en

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

### GDPR — gdpr-art-7-par-4-en

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

### GDPR — gdpr-art-94-par-2-en

References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation.

### GDPR — gdpr-art-2-en

Material scope

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-7-en

Conditions for consent

---
Generated by overview.legal · https://overview.legal/posts/353649 · 2026-09-03