Private individuals are now increasingly sending "cease-and-desist letters" to website operators because of the alleged lack of consent for the integration of cookies and/or web fonts in the webpage.

Their aim is to assert claims for damages under the GDPR. Usually, they demand to pay compensation for immaterial damages in the low-appearing amount of EUR 100.00 and request website operators to remedy the alleged data protection violation immediately.

If the accusation is true, the "issuer of the cease-and-desist letter" currently has the law on its side. If cookies from Google Analytics or Google Fonts (in dynamic integration) are set before the website visitor has accepted the cookies via the cookie banner, or if the visitor is not even asked, a data protection violation has taken place. Such shortcomings are easily traceable by inspecting the source code of the website. They also entitle to damages, at least according to the judgement of the Regional Court of Munich (judgement of 22.01.2022, AZ 3 O 17493/20), in which the court awarded damages of EUR 100.00 to a data subject based on the unlawful use of Google Fonts. This judgement is presumably also the trigger for the "wave of cease-and-desist letters" and is regularly cited by the issuers.

Nevertheless, payment should not be made in response to such a letter without prior legal advice. It cannot be assumed with certainty that the senders are always real persons. Additionally, there is a risk that a payment will be followed by further claims for damages potentially asking for a higher sum of compensation. Instead, it should be checked without any delay whether consent is required or whether the use of Google tools is not perhaps even expected by the website visitor. If consent is required but not collected beforehand, this constitutes an infringement of the GDPR that must be remedied by adjusting the integration of cookies to be placed after the visitor's consent is collected, in order to avoid further "cease-and-desist letters".

Whether or not to react depends on whether the letter comes from a serious source, i.e. a real person, or whether the origins are dubious, e.g. where the letter might be part of an automated mass communication.

Indicators of seriousness may be:

• The letter comes from a lawyer representing the data subject.
• The letter contains attachments and evidence to support the accusation.
• The letter is sent by post.
• The spelling and layout of the letter give a serious impression.
• The sender is known by name and address.
• The sender is from the European Union.

Special thanks to Lewin Rexin, legal trainee in our team, for his assistance in the preparation of this article.