In August 2021, noyb had filed several complaints against news sites using unlawful ‘Pay or OK’ systems with German data protection authorities (DPAs). Despite the fact that only about 3 to 10% of people want tracking for personalised advertising, these systems lead to consent rates of more than 99%. Almost four years after the filing of the complaints, the DPAs of North Rhine-Westphalia and Hesse still haven’t managed to issue a decision on the merits. Quite the opposite: In order to avoid finally deciding the case, the DPA of North-Rhine Westphalia has even issued a 12-page decision that it cannot decide yet. Today, noyb took both authorities to court for their year-long inactivity.
Background to ‘Pay or OK’. In August 2021, noyb filed two GDPR complaint against the ‘Pay or OK’ banners on the news sites faz.net and t-online.de. At the time, the complainant (and all other users) had to decide whether to allow the websites to process and distribute their personal data for ad tracking or to take out a paid subscription in order to have their privacy respected. The GDPR explicitly requires that consent must be “freely given”. Nevertheless, more than 99.9% of users agree to tracking when faced with ‘Pay or OK’ systems – even though only 3 to 10% of people actually actually want to be tracked for personalised advertising. In the meantime, even the EU Commission has considered that this approach is illegal in a case against Meta.
Max Schrems, Honorary Chairman of noyb: “Your privacy and data protection rights should not have a price tag. When 99.9% agree to something, but only 3% actually want it, it is clear that they had no free and genuine choice. Unfortunately, such obvious inactivity seems like pure political unwillingness to enforce the GDPR against media companies.”
“Non-decision” of NRW. After the DPA of North Rhine-Westphalia had confirmed the receipt of the complaint against t-online.de in August 2021, noyb didn’t receive any substantial updates for a while. In November 2022, more than one year after the confirmation, the authority then contacted noyb to say that it had seen the complaint on noyb’s website – but never received it. noyb quickly replied with the DPA’s acknowledgment of receipt it had sent out the year before. This was followed by an exchange of numerous written submissions and multiple attempts by noyb to finally obtain a decision. In May 2025, the DPA then finally issued a decision saying that it cannot issue a decision yet – almost four years after the complaint was filed.
Jonas Breyer, lawyer representing the complainant: “It is a shame that the data protection authorities of North Rhine-Westphalia and Hesse still did not issue a decision on the content after almost four years. And this isn't an isolated case. One wonders what these authorities are doing with the tax payers money.”
German efficiency – a myth? The Hessian data protection authority didn’t issue a decision in the case against faz.net either. It justified this by citing the complexity of the case and the possibility that new guidelines could be introduced in the future. But these potential uncertainties did not hinder the DPA of Lower Saxony to issue a decision about a similar complaint already in 2023. Although Germany is renowned for its allegedly strict position towards data protection, the reality is that its DPAs are largely toothless and increasingly see themselves as “business enablers”. According to a noyb analysis of EDPB statistics between 2018 and 2023, only 1.26% of cases before all German DPAs have led to a fine. The Hesse DPA, for example, has only ordered 115 corrective measures in 2024, despite receiving 3,839 complaints.
Felix Mikolasch, Data Protection Lawyer at noyb: “It is obvious that “pay or OK” systems do not offer the option of “ freely given” consent. Despite this, the data protection authorities in Hesse and North Rhine-Westphalia appear to have no interest whatsoever in applying the GDPR consistently. This is highly questionable."
Lawsuit against the authorities. The complainant in the cases against t-online and faz.net has now filed two lawsuit with the Administrative Courts of Wiesbaden and Düsseldorf, respectively. If the action is successful, the authorities would have to decide and uphold the initial complaints.
The complainant is represented by Jonas Breyer from Breyer Legal.
