Cookie consent
Cookie consent is the permission website visitors must give under Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) before information is stored on or read from their device — unless this is strictly necessary for the service they requested.
The rule is in Section 25(1) TDDDG (until May 2024: TTDSG). It applies not only to cookies but to any storage on or access to the end device — including comparable technologies such as local storage or tracking pixels. Consent is measured by the standards of the GDPR.
Section 25(2) TDDDG has exactly two exceptions: when the sole purpose is transmitting a message over a public telecommunications network, or when storage is strictly necessary for the provider to deliver a digital service explicitly requested by the user — typically a shopping cart.
Analytics tools, advertising pixels and embedded third-party content therefore generally require prior consent. If only strictly necessary cookies are used, the exception applies — then no consent is required.
What to look out for
- Record all cookies, scripts and embedded services on the website — including fonts, maps and videos from third parties.
- For each entry check: strictly necessary for the requested service — or subject to consent?
- Load consent-based services only after consent, not on page load.
- Make rejecting as easy as accepting and keep the choice changeable at any time (recommendation).
- Describe the cookies and services used in the privacy policy.
Common mistakes
- Tracking starts on page load before the visitor has decided anything.
- Fonts, videos or maps are loaded directly from the third party without checking whether consent is required.
- The banner only offers “Accept”, rejection is hidden.
- “Legitimate interest” is cited as a substitute — but Section 25 TDDDG only knows consent or one of the two exceptions.
Frequently asked questions
Only if you store or read information on visitors’ devices that is not strictly necessary — e.g. for analytics, advertising or embedded third-party content. With strictly necessary cookies only, no consent is required.
It is the same law: the TTDSG was renamed TDDDG in May 2024. The cookie rule remains unchanged in Section 25.
No. It covers any storage of information on the end device and any access to it — including via local storage, pixels or comparable technologies.
Legal basis: Section 25(1) and (2) TDDDG · Art. 6(1)(a) GDPR · As of