Cookie Consent Is Not Email Consent: What Marketing Teams in Germany and the EU Need to Separate

Guest article by Deniss Danilciks, Managing Director, Teloro GmbH / Legalano.

Marketing teams often use the word "consent" as if it described one universal permission. In practice, a visitor can accept marketing cookies and still not have agreed to receive promotional emails. A person can subscribe to a newsletter while refusing analytics cookies. And a CRM can contain a valid email address without giving the sender permission to use that address for advertising.

For companies operating in Germany and the European Union, these distinctions matter because different rules govern browser storage, personal-data processing and direct marketing by email. The operational challenge is therefore not simply collecting a "yes", but keeping the right permission attached to the right purpose throughout the marketing stack.

Three permissions that marketing teams should not merge

A typical marketing setup may involve at least three separate questions:

1. May the website store or access non-essential information on the user's device? This is the area in which cookie consent and consent-management platforms operate.

2. May the company process personal data for a particular purpose? This is governed by the GDPR and depends on the applicable legal basis.

3. May the company send advertising by email? In Germany, this is governed in particular by Section 7 of the German Act Against Unfair Competition (UWG), alongside the GDPR and the European ePrivacy framework.

These questions can overlap, but the answer to one does not automatically answer the others. A robust compliance process therefore records them separately.

1. Cookie consent concerns access to the user's device

In Germany, Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG) generally requires consent when information is stored on or accessed from a user's terminal equipment, unless an exception applies, such as where the operation is strictly necessary to provide a service expressly requested by the user.

A consent-management platform such as Kukie.io is designed for this layer of the stack: detecting and managing cookies and scripts, applying region-specific consent logic and keeping records of consent choices.

This is important for analytics, advertising pixels, embedded services and other technologies that may access information on a browser or device. But clicking "Accept marketing cookies" is not the same legal act as entering an email address and agreeing to receive a newsletter.

2. GDPR consent is purpose-specific

Under the GDPR, personal-data processing requires a legal basis. Consent is one possible basis under Article 6(1)(a), but it is not the only one. Where a controller relies on consent, Article 7 also requires the controller to be able to demonstrate that the data subject consented.

This creates an important operational rule: a consent record should describe what the person agreed to, not simply that "consent = true".

A weak consent record

{
"email": "person@example.com",
"consent": true
}

A more useful consent record

{
"email": "person@example.com",
"purpose": "email_marketing",
"source": "newsletter_form",
"statement_version": "newsletter-v4",
"timestamp": "2026-09-21T08:42:16Z",
"status": "active"
}

The second structure is easier to audit because it connects the person, purpose, collection point, wording and time of the decision. Depending on the system, additional evidence may include a double-opt-in confirmation, form URL, campaign identifier or proof of the wording displayed at the time.

3. German email marketing has an additional UWG layer

For advertising by electronic mail, German law is particularly strict. Section 7(2) UWG treats advertising by electronic mail without the recipient's prior express consent as an unreasonable nuisance.

One important distinction is frequently missed in B2B marketing: the UWG rule for email is not the same as the rule for telephone advertising. Section 7 differentiates between the channels. The statute expressly refers to at least presumed consent for certain B2B telephone calls, while electronic mail is generally tied to prior express consent unless the statutory existing-customer exception applies.

That means a publicly visible business email address, a LinkedIn profile, attendance at a trade fair or the fact that a person is a managing director does not by itself create a general permission to send promotional email.

The existing-customer exception is narrow

Section 7(3) UWG contains an exception for certain marketing emails to existing customers. The exception only works when all statutory conditions are satisfied. In simplified terms:

• the company obtained the email address in connection with the sale of a product or service;

• the address is used to advertise the company's own similar products or services;

• the customer has not objected; and

• the customer was clearly informed, both when the address was collected and in each subsequent use, that they can object at any time without costs beyond the basic transmission tariff.

This should be treated as a defined workflow condition, not as a broad "existing customer = marketing allowed" flag.

Why cookie consent should not automatically update CRM email permission

Modern stacks often connect a consent platform, website forms, customer-data platforms, a CRM and an email service provider. Technically, it is tempting to reduce these systems to one global consent status. That shortcut creates ambiguity.

Consider this sequence:

1. A visitor accepts marketing cookies.

2. The visitor downloads a white paper and enters an email address.

3. The form includes no separate newsletter consent.

4. The lead is synchronised to the CRM.

5. An automation interprets "marketing consent = yes" and enrolls the lead in a promotional sequence.

The original cookie decision may have permitted certain tracking technologies. It does not automatically prove consent to promotional email. If the systems share one generic consent property, the CRM can silently transform a browser-level choice into an email-marketing permission that was never actually obtained.

A practical consent architecture for marketing teams

The safest architecture is not necessarily complex. It simply avoids collapsing different permissions into a single field.

Five controls that prevent most workflow failures

1. Use purpose-specific fields

Avoid a generic field called "consent". Distinguish cookie categories, newsletter subscription, sales outreach permission and any other processing purpose that matters to the organisation.

2. Keep the collection source

Store where the permission came from: checkout, newsletter form, webinar registration, customer account, event form or another source. This makes later verification much easier.

3. Version the consent wording

If the wording on a form changes, retain the version that applied when a person submitted it. A timestamp without the corresponding wording may be insufficient to explain what the person actually agreed to.

4. Synchronise withdrawals, not just opt-ins

Marketing systems often focus on pushing new subscriptions downstream. The reverse direction is equally important. An unsubscribe, withdrawal or advertising objection should propagate to every system capable of triggering another message.

5. Maintain a suppression layer

Deleting a recipient from one campaign is not always enough. If the same address can be re-imported by another sales tool, integration or enrichment workflow, the organisation needs a reliable suppression mechanism that prevents renewed advertising.

Cookie tracking after an email click creates another consent boundary

Email campaigns often lead back to landing pages containing analytics, advertising pixels or retargeting technologies. At that point the email-marketing workflow intersects again with cookie and device consent.

A recipient may validly receive an email and still refuse optional tracking on the landing page. Conversely, a visitor may accept analytics or advertising cookies without subscribing to marketing email. The systems should be able to respect both decisions simultaneously.

This is one reason consent-management and email-compliance processes should integrate operationally without being treated as legally interchangeable.

What evidence should companies preserve?

When consent or an exception is relied upon, marketing teams should be able to reconstruct the path that led to the message. Useful evidence can include:

• the recipient address;

• the exact purpose for which permission was obtained;

• date and time;

• the source URL or collection channel;

• the consent statement shown at that time;

• double-opt-in confirmation where used;

• withdrawals and objections;

• suppression-list status; and

• where the existing-customer exception is relied upon, the underlying customer relationship and the conditions supporting that exception.

This is also the point at which operational products such as Legalano become relevant from the receiving side: unwanted advertising emails can only be assessed reliably when the message, sender, recipient, previous relationship and available evidence are documented rather than reduced to a screenshot or an assumption about consent.

A simple decision flow before a marketing email is sent

1. Is the message advertising? Determine whether its purpose directly or indirectly promotes products, services or the sender's commercial activity.

2. Which jurisdiction applies? Do not apply a US opt-out model automatically to German or EU recipients.

3. What permits the email? Identify the actual consent record or verify that every condition of an applicable statutory exception is met.

4. Has the recipient objected or unsubscribed? Check the suppression layer before every send.

5. Can the organisation prove the path? Keep the source, timestamp, wording and relevant workflow records.

6. What happens after the click? Apply the appropriate cookie and tracking choices on the landing page independently from the email permission.

The key takeaway

Consent management works best when it preserves distinctions rather than hiding them. Cookie consent answers whether certain technologies may access information on a user's device. GDPR compliance asks whether personal data may be processed for a defined purpose and on what legal basis. German email-marketing law adds its own requirements for advertising by electronic mail.

The practical goal is therefore not a universal green "consent" flag. It is a traceable chain of permissions, purposes, objections and evidence from the first website interaction to the CRM and the final email send.

Frequently Asked Questions

Official sources

• German Act Against Unfair Competition (UWG), Section 7

• TDDDG, Section 25 - protection of privacy in terminal equipment

• General Data Protection Regulation (GDPR), including Articles 6 and 7

• ePrivacy Directive, Article 13 - unsolicited communications

This article provides general information and does not constitute legal advice. The assessment of a specific campaign depends on the facts, the recipients, the applicable jurisdiction and the exact workflow.