Ruling on cookie banner design: “Reject all” button becomes mandatory – what Joomla websites need to consider now

On 19 March 2025, the Verwaltungsgericht Hannover (Administrative Court of Hanover) handed down a landmark ruling concerning the design of cookie banners on websites. According to the ruling, website operators who offer an “Accept all” („Alle akzeptieren“) button must also provide an equivalent “Reject all” („Alles ablehnen“) button on the first layer of the banner. Otherwise, the consents obtained are invalid, which constitutes a breach of the General Data Protection Regulation (GDPR) and the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, German Telecommunications and Digital Services Data Protection Act) .(IT-Kanzlei Lutz Ravensburg, netz-der-moeglichkeiten.de, Niedersachsen Datenschutz)

Background to the ruling

The case was triggered by an order issued by the Lower Saxony State Commissioner for Data Protection (Landesbeauftragter für den Datenschutz Niedersachsen, LfD) against a media company based in Lower Saxony. The company had used a cookie banner that left users no real choice:(Niedersachsen Datenschutz, netz-der-moeglichkeiten.de)

• Rejecting cookies was considerably more cumbersome than accepting them.

• Users were pushed into giving consent by the banner reappearing again and again.

• The heading “optimal user experience” („optimales Nutzungserlebnis“) and the label “accept and close” („akzeptieren und schließen“) on the close button were misleading.

• The term “consent” („Einwilligung“) was missing entirely.

• The number of integrated partners and third-party services was not apparent.

• Information on the right to withdraw consent and on data processing in third countries outside the EU only became visible after scrolling .(Niedersachsen Datenschutz, BornCity, netz-der-moeglichkeiten.de)

The court found that users had not given informed, voluntary and unambiguous consent, as required by the GDPR.(Niedersachsen Datenschutz)

What this means for Joomla website operators

For operators of Joomla websites, this ruling means:

• Equivalent options: If there is an “Accept all” button, there must also be a “Reject all” button that is just as visible and accessible.

• Transparent information: Details of third-party providers, data processing in third countries and the right of withdrawal must be clearly visible without additional clicks or scrolling.

• Avoiding nudging: The design of the banner must not push users into consenting or make rejecting more difficult.(Ailance, SnarL.de)

Recommendations for Joomla agencies

Joomla agencies should support their clients in implementing cookie banners that comply with data protection law. This includes choosing suitable consent management tools that meet the current legal requirements. It is also important to design the banners so that they are transparent and user-friendly, without pushing users into giving consent.(Ailance)

Conclusion

The ruling of the Hanover Administrative Court sets clear standards for the design of cookie banners. Website operators are now called upon to review and adapt their consent mechanisms in order to meet legal requirements and strengthen users' trust.(Ailance, ifun.de)

Note: This article is for information purposes only and does not constitute legal advice.