Data protection breaches are no longer just a matter for supervisory authorities: competitors and associations may pursue them under the UWG.
Legal framework
- GDPR: Art. 6 (legal basis), Art. 7 (consent), Art. 9 (health data), Art. 12–14 (information), Art. 21 (objection to direct marketing)
- § 25 TDDDG: consent for cookies unless strictly necessary
- § 7 UWG: consent for e-mail and consumer phone marketing; § 7a documentation
Case law
- BGH, 28 May 2020, I ZR 7/16 – pre-ticked boxes are no valid cookie consent
- BGH, 27 March 2025, I ZR 222/19, I ZR 223/19 and I ZR 186/17 – competitors and associations may pursue GDPR breaches under the UWG
Case examples
Tracking before consent
Marketing pixels fire before the user clicks the cookie banner. Breach of § 25 TDDDG, actionable by competitors.
Health data in the shop
An online pharmacy uses order data for newsletters about medicines without explicit consent. Art. 9 GDPR breach.
