A ruling by the Administrative Court (VG) of Hanover is causing a stir in the online marketing world: cookie banners must offer an equivalent “Reject All” option, and the popular Google Tag Manager (GTM) requires explicit consent. The decision of March 19, 2025 (case no. 10 A 5385/22) has massive implications for countless websites.
The Case: Cookie Banner of the Neue Osnabrücker Zeitung Under Scrutiny
The Lower Saxony data protection authority objected to the cookie banner used by the Neue Osnabrücker Zeitung. On the first layer of the banner there were only the options “Accept All” and “Settings.” A “Reject” button was missing. Only on a second layer could users restrict their selection. In addition, the newspaper used Google Tag Manager without prior consent. The company filed suit against the authority’s order.
The Judgment: An Equivalent “Reject” Button Is Mandatory!
The VG Hanover sided with the data protection authority. The design of the cookie banner was unlawful. The court’s reasoning is a clear rebuke to common practices:
Misleading design: By omitting a direct rejection option, users are nudged into giving broad consent just to make the banner disappear quickly and use the website.
Lack of transparency: On the first layer, it is not apparent to users that rejection is possible at all. This violates the requirement of voluntary and informed consent.
Equivalence of options: The option to refuse consent must be just as easy and prominently accessible as the option to grant it.
Second criterion: Google Tag Manager only with explicit consent
The court also found a clear legal violation in the use of Google Tag Manager (GTM). The court’s arguments strike at the core of many current website setups:
GTM is not technically necessary: GTM merely serves the convenience of the website operator to load other services (such as analytics or marketing tools). This is no added value for users and not technically necessary, since scripts could also be loaded in other ways, e.g., by custom code.
Access to end devices: GTM accesses users’ end devices by loading scripts and setting cookies. Under section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG), this access requires explicit prior consent.
No legitimate interest: The operator’s interest in easier tool management does not justify the use of GTM without consent. The operator’s interest does not outweigh users’ rights here.
Implications: What This Ruling Means for Your Website
Immediate action required for cookie banners: Check your consent tool. Is there a “Reject All” button on the first layer that is designed and placed the same as the “Accept” button? If not, there is urgent need for action.
Google Tag Manager must be behind the consent banner: GTM may only be loaded after the user has actively and in an informed manner agreed. Loading GTM based on “legitimate interest” is no longer tenable under this ruling.
Data protection authorities are competent: The court confirmed that data protection authorities are also responsible for enforcing section 25 TDDDG (which governs access to end devices). This increases the pressure on companies to comply.
FAQ: Cookie Banners & GTM – The Most Common Questions
What makes a cookie banner compliant? It must offer an equivalent and easily accessible option to accept and to reject on the first layer. Consent must be voluntary, informed, and unambiguous.
Why exactly does Google Tag Manager need consent? Because it accesses the user’s end device (section 25 TDDDG) and is not deemed technically necessary for the basic function of the website. Its primary function serves the operator’s convenience.
What is the difference between TDDDG and GDPR? The TDDDG specifically governs the protection of privacy on end devices (e.g., setting cookies). The GDPR governs the subsequent processing of personal data. Both laws interact here.
What are the consequences of non‑compliant banners? Supervisory authorities may issue orders that can restrict website operation, and fines may be imposed.
Conclusion: Urgent Need for Action for Website Operators
The decision of the VG Hanover is one of the most detailed and clearest on cookie‑banner design and Google Tag Manager. Website operators are strongly urged to review and adjust their current configurations to avoid legal risks.
