German Court Rules Online Medication Sales Require Explicit Data Consent

The Bundesgerichtshof's decision enforces GDPR compliance for platforms like Amazon, protecting sensitive health data and consumer rights.

The Bundesgerichtshof (BGH) has ruled that online platforms selling medications, such as Amazon, must obtain explicit consumer consent for data collection and processing to comply with GDPR.
The decision, announced on March 27, 2025, upholds earlier rulings by the Oberlandesgericht Naumburg and aligns with European and national regulations, including the Pharmacy Operations Ordinance.
The European Court of Justice (ECJ) previously clarified that personal information used in online medication sales, like names and delivery addresses, qualifies as sensitive health data under GDPR.
The ruling applies to non-prescription, pharmacy-only medications, such as certain painkillers, which constitute over 20% of the online pharmaceutical market in Germany.
The court emphasized that the requirement for consent safeguards consumer rights, allowing individuals to control how their sensitive health data is shared in the marketplace.