Skip to content
News·noyb - European Center for Digital RightsEN
Export

Years of inactivity in “Pay or OK” cases: noyb sues German DPAs

Forced Consent & Consent Bypass In August 2021, noyb had filed several complaints against news sites using unlawful ‘Pay or OK’ systems with German data protection authorities (DPAs).

Full text

Forced Consent & Consent Bypass In August 2021, noyb had filed several complaints against news sites using unlawful ‘Pay or OK’ systems with German data protection authorities (DPAs). Despite the fact that only about 3 to 10% of people want tracking for personalised advertising, these systems lead to consent rates of more than 99%. Almost four years after the filing of the complaints, the DPAs of North Rhine-Westphalia and Hesse still haven’t managed to issue a decision on the merits. Quite the opposite: In order to avoid finally deciding the case, the DPA of North-Rhine Westphalia has even issued a 12-page decision that it cannot decide yet. Today, noyb took both authorities to court for their year-long inactivity. “Pay or OK” Complaints from 2021Background to ‘Pay or OK’. In August 2021, noyb filed two GDPR complaint against the ‘Pay or OK’ banners on the news sites faz.net and t-online.de. At the time, the complainant (and all other users) had to decide whether to allow the websites

How it connects

C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… CJEU ·Fourth Chamber Mar 7, 2024 Controllers IP Address Personal Data
C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Personal Data Automated Decision-Making
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers
SAN 3154/2026 National court annuls DPA sanction against KFC Spain over website privacy information In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website.… Jul 16, 2026 Supervisory Authorities Personal Data Recipient
473833 The DPA imposed an €8 million administrative fine on Apple (the controller) in 2022 (CNIL - SAN-2022-025) The DPA found that Apple used identifiers stored on users’ devices to enable personalized advertising in the App Store without first obtaining valid user consent, as required by… CE - 473833 ·Supreme Administrative Court Oct 10, 2025 Material scope (GDPR) Personal Data Controllers