Cookie Banners and Consent in Germany: The TDDDG in 2026
Section 25 TDDDG explained: when you need consent in Germany, when no banner is required, what cookieless analytics changes and how fair consent design looks.
by Alexander HerlingPublished Updated 6 min read
If you run a website aimed at users in Germany, cookie consent is governed by a specific national law on top of the GDPR. We first wrote about the topic in 2020, shortly after the German Federal Court of Justice ruled on cookie consent. The rules have since settled: the TTDSG introduced a clear statutory rule in December 2021, and since 14 May 2024 the law has been called the Telecommunications Digital Services Data Protection Act, or TDDDG. Its key provision is Section 25. This article explains what it means for your site, whether you are a German business or an international company serving German customers.
Note: This article is a general overview and not legal advice. For a binding assessment of your website, please consult a lawyer specialising in data protection law.
From Planet49 to the TDDDG
The timeline in brief:
| Date | Event |
|---|---|
| October 2019 | The Court of Justice of the EU rules in Planet49 that a pre-ticked checkbox is not valid consent. |
| May 2020 | The German Federal Court of Justice applies this to German law (Cookie Consent II). |
| December 2021 | The TTDSG enters into force; Section 25 explicitly regulates access to user devices. |
| May 2024 | Renamed TDDDG alongside the new Digital Services Act implementation law. Section 25 is unchanged in substance. |
| April 2025 | A regulation sets out recognised consent management services. Using them is voluntary. |
Section 25 implements Article 5(3) of the EU ePrivacy Directive, so other EU countries have comparable rules. Details and enforcement practice differ from country to country, though.
What Section 25 TDDDG covers
Section 25 is not limited to cookies. It applies to any storage of information on the user's device and any access to information already stored there. That includes local storage, session storage, IndexedDB, tracking pixels that read identifiers and fingerprinting techniques that query device properties.
As a rule, this requires consent. There are two exceptions:
- The sole purpose is to transmit a communication over a network.
- The storage or access is strictly necessary for the provider to deliver a digital service explicitly requested by the user.
The second exception is the one that matters in practice. "Strictly necessary" is read narrowly: being useful or commercially sensible is not enough.
Keep two layers apart: Section 25 governs device access. If personal data is processed as a result, that processing also needs a legal basis under the GDPR.
When you do not need a banner
You only need a banner if you need to ask for consent. Typically exempt:
- Session cookies for login and shopping cart
- Storing a language or region the user has chosen
- Security features such as form abuse protection, where genuinely necessary
- The cookie that stores the consent decision itself
A site that only uses such storage, loads no third-party content unprompted and self-hosts its fonts can do without a banner. Many company websites can be built this way. GDPR transparency duties still apply: your privacy notice must list the storage you use.
Load embedded videos, maps or social media posts only after a click (a "two-click" solution). That way no data flows to third parties before the user wants it to.
Cookieless analytics: fewer banners, not a free pass
Many analytics tools advertise that they work without cookies. That can reduce the need for consent but does not remove it automatically. What matters is how the tool works:
| Method | Assessment |
|---|---|
| Server log analysis with no script in the browser | No device access under Section 25; GDPR basis required |
| Script that only reports the page view, storing no identifier and reading no device properties | Considered consent-free by some, but opinions differ |
| Fingerprinting from screen size, fonts, browser features | Device access; usually requires consent |
| Classic tracking with cookies or advertising IDs | Requires consent |
The German Data Protection Conference (DSK), the body of German supervisory authorities, takes a fairly strict line in its guidance for digital service providers. If you want to drop the banner, check your tool's configuration closely and document your reasoning. For Google advertising, note that since March 2024 Google has required Consent Mode v2 for personalised ads in the European Economic Area.
Rules for fair consent design
Where consent is required, it must be freely given, informed, unambiguous and specific. For the design that means:
- Rejecting as easy as accepting. An equivalent "Reject" button on the first layer, not hidden in settings. Supervisory authorities expect this, and German courts, including the Munich Regional Court, have objected to banners without an equivalent reject option.
- No pre-ticked boxes. Optional categories are off by default.
- No visual nudging. A bold "Accept" next to a faint "reject" text link is considered unlawful steering.
- No tracking before the decision. Scripts load only after consent.
- Plain-language purposes. Instead of "marketing cookies", say what happens and which providers are involved.
- Withdrawal at any time. A permanent link, for example in the footer, reopens the settings.
- Accessible. The banner must work with a keyboard, focus and contrast must be right, and it must not permanently cover content.
Practical questions from our projects
Multilingual sites: Consent applies to the website, not to a language. If a user switches language, they do not need to consent again. If they have not decided yet, the banner appears in the selected language.
New services: If you add a new service that requires consent, you need fresh consent for it. Good consent tools ask specifically for the new purpose.
Proof: You must be able to demonstrate consent. Consent tools log the time, the banner version and the options chosen.
Inventory: Check regularly which cookies and storage your site actually sets. The browser developer tools (the "Application" or "Storage" panel) show this reliably. New embeds creep in quickly.
Risks
Missing or invalid consent can lead to fines from supervisory authorities. In Germany, competitors can also send formal cease-and-desist letters (Abmahnungen). In October 2024 the Court of Justice of the EU ruled that the GDPR does not prevent competitors from bringing such claims, which largely settled a long-running question.
At EU level there has been ongoing discussion about simplifying the cookie rules, for instance by giving more weight to browser-level settings. The European Commission proposed changes in its "Digital Omnibus" in November 2025, which are still being negotiated. Until such changes actually take effect, Section 25 TDDDG remains the benchmark in Germany.
What you can do now
List every storage mechanism and third-party service on your site and ask of each one: is it strictly necessary for the service the user requested? Whatever remains needs consent or can be replaced. Often the site can be rebuilt so that the banner becomes much smaller or disappears entirely. Agencies can put the technical foundations in place but cannot give legal advice, so involve a qualified lawyer for the legal review. For the technical side, we are glad to help: get in touch.
Frequently asked questions
Do I need a cookie banner if I only use strictly necessary cookies?
No. Storage that is strictly necessary for the service the user requested does not require consent, so no banner is needed. You still have to describe it in your privacy notice.
Is cookieless analytics automatically exempt from consent?
No. Section 25 TDDDG covers any storage of, or access to, information on the user's device, not just cookies. Whether a specific tool needs consent depends on how it works and how it is configured.
Does the reject button have to be on the first layer?
German data protection authorities and several courts expect rejecting to be as easy as accepting. In practice that means an equivalent reject button on the first layer of the banner.