German cookie consent under the TDDDG and DSGVO

A German website needs opt-in consent before it sets any cookie that is not strictly necessary. The rule is Section 25 of the TDDDG (the law called the TTDSG until May 2024), and the GDPR, known in German as the DSGVO, governs the personal data those cookies collect. For a business website, the data protection authority of the federal state where the business is based enforces both, not the federal commissioner (BfDI). Fines under the TDDDG reach EUR 300,000, and GDPR fines go far higher.

How German cookie law works: TDDDG and DSGVO

Germany does not rely on a single statute for cookie regulation. Two laws operate in tandem: the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, renamed from the TTDSG in May 2024) and the Datenschutz-Grundverordnung (DSGVO), the German name for the EU General Data Protection Regulation. The GDPR applies directly, and the Bundesdatenschutzgesetz (BDSG) supplements it in Germany.

Section 25 of the TDDDG transposes Article 5(3) of the ePrivacy Directive into German law. It governs the act of storing or reading information on a user's device: cookies, local storage, fingerprinting scripts and similar technologies. The DSGVO then applies to any personal data collected through those technologies.

The practical effect: you need a legal basis twice. Section 25 TDDDG covers the placement of the cookie. The DSGVO covers what you do with the data it collects.

Section 25 TDDDG: the core consent rule

Section 25(1) TDDDG states that storing information on, or retrieving information from, an end user's terminal equipment is only permitted with that user's consent, given on the basis of clear and comprehensive information. Consent must meet the standard of the GDPR: freely given, specific, informed and unambiguous.

Section 25(2) provides a narrow exemption. Cookies are allowed without consent only when they are strictly necessary to provide a service explicitly requested by the user. A session cookie that keeps a shopping cart alive qualifies. An analytics cookie like _ga or a marketing pixel like _fbp does not.

The exemption mirrors the ePrivacy Directive almost word for word. German courts and regulators interpret it strictly. In a judgment of 19 March 2025 (10 A 5385/22), the Administrative Court of Hanover held that loading Google Tag Manager itself needs consent under Section 25.

The Planet49 ruling and its impact

The landmark CJEU judgment in Case C-673/17 (Planet49) originated from a German referral. In October 2019, the Court of Justice ruled that pre-ticked checkboxes do not constitute valid consent for cookies, regardless of whether the cookies process personal data. The German Federal Court of Justice (BGH) confirmed this in its own follow-up decision in May 2020.

Planet49 settled a long-standing ambiguity in German law. Before the ruling, some operators relied on implied consent or browser settings as a legal basis. That argument is now closed.

The BGH decision also clarified that cookie consent requirements apply to all types of stored information, not just personal data. If your site drops a tracking identifier onto a visitor's device, you need opt-in consent regardless of how you classify the data downstream.

State authorities enforce cookie rules for websites

Germany's enforcement is unusually fragmented, and the BfDI is not the authority most website owners deal with.

The Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) is the federal data protection commissioner. Under Section 29 TDDDG, the BfDI supervises Section 25 only where telecommunications providers or federal public bodies store or read information on a device. The Bundesnetzagentur (Federal Network Agency) has no role in Section 25.

For every other website, including any business, shop or blog, one of the 16 state data protection authorities for the private sector is in charge: the one in the federal state where the business is based. They enforce both Section 25 TDDDG and the DSGVO, from Bavaria's BayLDA to Hamburg's HmbBfDI. The Datenschutzkonferenz (DSK), the joint body of the federal and state authorities, publishes shared guidance to reduce inconsistency.

The consent management ordinance (EinwV) since April 2025

The Einwilligungsverwaltungsverordnung (EinwV), an ordinance under Section 26 TDDDG signed on 6 February 2025 (BGBl. 2025 I Nr. 32), has applied since 1 April 2025.

The EinwV introduces a framework for recognised consent management services, which the BfDI recognises. The idea: a user sets cookie preferences once through a recognised service, and those preferences are passed to every participating website. The goal is to reduce so-called "cookie fatigue", the endless repetition of cookie banners across different sites.

Participation is voluntary. No website is required to integrate a recognised consent management service. But the ordinance signals Germany's regulatory direction: standardised, user-centric consent flows.

What your cookie banner must include

The DSK's current guidance for websites is the Orientierungshilfe für Anbieter:innen von digitalen Diensten (November 2024). Combined with TDDDG and DSGVO requirements, your banner must meet these criteria:

• An Accept button and a Reject button of equal visual prominence on the first layer

• Clear information about which cookie categories are used and why

• Granular controls allowing users to consent to individual categories (analytics, marketing, functional) rather than only an all-or-nothing choice

• No pre-ticked checkboxes for non-essential cookies

• A link to your full cookie policy with details on each cookie, its provider, purpose and retention period

• An accessible method to withdraw consent at any time, as easy as granting it

Reject buttons hidden behind a "Manage preferences" link, or styled in a less visible colour, risk being treated as a dark pattern. German state authorities have explicitly warned against such designs.

German visitors read the banner in German, so the button labels matter. The terms you will see on German banners:

Einwilligung

Consent, the word Section 25 TDDDG uses.

Alle akzeptieren

Accept all.

Alle ablehnen

Reject all, which belongs on the first layer.

Einstellungen

Settings, the layer with the category choices.

TDDDG fines and DSGVO penalties

TDDDG violations under Section 25 carry a maximum fine of EUR 300,000. This applies specifically to the act of placing or reading cookies without valid consent.

DSGVO violations, such as processing personal data collected through cookies without a legal basis, attract fines up to EUR 20 million or 4% of global annual turnover, whichever is higher. Cookie-specific enforcement in Germany often takes the form of warnings and orders rather than headline fines, but the legal ceiling remains high.

Supervisory authorities also expect verifiability (Nachweisbarkeit): under Article 7(1) GDPR, you must be able to demonstrate that consent was obtained, when it was given and what the user agreed to. Consent logs are not optional.

Compliance checklist for German cookie rules

Use this checklist to audit your site against TDDDG and DSGVO requirements.

1. Scan your website: identify every cookie and tracking technology. Tools like the Kukie.io cookie scanner detect cookies automatically, including third-party scripts.

2. Classify each cookie: strictly necessary (PHPSESSID, your consent cookie), analytics (_ga, _pk_id), marketing (_fbp, _gcl_au) or functional.

3. Block non-essential cookies before consent: no analytics or marketing cookies may fire until the user opts in. Use Google Consent Mode v2 for GA4 and Google Ads, and remember the Hanover ruling on Tag Manager itself.

4. Build a clear banner: equal Accept and Reject buttons, granular category toggles, no pre-ticked boxes and clear information on each category.

5. Store consent records: log the timestamp, consent choices and banner version for each visitor. Retain these records for as long as you may need to prove consent.

6. Allow easy withdrawal: a persistent link in your footer or a revisit button that lets visitors change their preferences without navigating away.

7. Apply geo-detection: if you serve visitors in Germany alongside other countries, configure your banner to apply opt-in rules for German visitors.

8. Review quarterly: re-scan your site to catch new cookies introduced by third-party scripts or CMS updates.

How the TDDDG relates to the EU ePrivacy framework

The TDDDG is Germany's national transposition of Article 5(3) of the ePrivacy Directive (2002/58/EC). Every EU member state has its own version: France has CNIL guidelines, Italy follows the Garante's cookie rules, and the Netherlands applies AP guidance. The core obligation, opt-in consent for non-essential cookies, is the same across borders, but enforcement intensity and specific guidance vary by country.

For a broader comparison, see the cookie consent laws by country overview or the global compliance hub.

German cookie rules in short answers

See which cookies your German site sets before consent

If you are not sure which cookies your site sets, start with a scan. Kukie.io detects and categorises every cookie it finds, shows German visitors a banner with Accept and Reject on the first layer and records each choice in the Consent Log.

Start free