The German Federal Court of Justice (Bundesgerichtshof aka BGH) published a ruling, which is interesting in two ways. First, it says a consent usually does not expire over time. And secondly, it is possible for marketers to obtain consent for several channels with only a single checkbox. In the light of the strict jurisdiction, this may come as a surprise to some.
In the past, several German courts have ruled that unused opt-ins can expire. No matter if we are talking about 1.5 years, or 3.5, or 4 years, those decisions were met with incomprehension among experts: a consent must be valid until revoked. Other courts ruled in turn that there’s no expiration if an opt-in is used regularely.
Now, the BGH (judgment of 1.2.2018 – file number III ZR 196/17) has put its foot down:
“Directive 2002/58/EC and § 7 UWG do not provide for a time limit on consent once given. As a result, this agreement – as well as consent pursuant to § 183 BGB – does not in general expire solely as a result of the lapse of time”
(freely translated, emphasis by me). Gone are the days of legal uncertainty as to whether the opt-in can still be used, are they?
Well, as is often the case, this must not be generalised. In the next sentence, the Court reduces the scope to the individual case in question: The opt-in text in dispute already set a limited period of consent validity and, in addition, consent was given when a contract was closed. I. e. it was about a customer or an ex-customer relationship. Thus, interest can be assumed more likely than e. g. when it comes to consents, which have been given in a prize draw.
It remains to be seen how the GDPR affects this. The ICO suggests
“[t]here is no set time limit for consent. How long it lasts will depend on the context. You should review and refresh consent as appropriate”.
Apart from legal considerations, whether contacting someone after years of inactivity provides a good user experience is another matter…
Even more interesting is another aspect of the BGH ruling. The question of whether an opt-in for several channels can be combined in one checkbox, or whether it needs one separate checkbox per channel, has long been controversial.
The opt-in text underlying the judgment was as follows:
“I would like to be informed and advised personally about new offers and services of T. GmbH by email, phone, SMS or MMS”
(freely translated, emphasis by me). The court decided that this is a valid specific indication. A separate consent for each channel is not required.
It would be different though, if the text included other explanations or references than the specific declaration of consent. For example, “I would like to be informed by email and I also want to secure my chance of winning the prize” does not yield a valid opt-in.
It’s also worth noting that the ICO suggest something different:
“[T]o comply with PECR [organisations] should provide opt-in boxes to obtain specific consent for each type of electronic marketing they want to undertake (eg automated calls, faxes, texts or emails)”.
“If you want individuals to consent to direct marketing, you should have a separate unticked opt-in box for this, prominently displayed”.
I’d agree that it is best practice to leave a choice… Nevertheless, the judgement is a ray of light, as it leaves the decision to the marketer.