DSGVO stands for Datenschutz-Grundverordnung, the German name of the European Union's General Data Protection Regulation (GDPR). It is the same regulation, Regulation (EU) 2016/679, with the same articles and the same fines, published in German. What makes data protection in Germany different is the national law around it: the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), section 25 of the TDDDG for cookies, and regulators and courts that read both strictly.
If your website has visitors in Germany, the DSGVO applies to you whether or not your company is German. The rest of this page covers what Germany adds on top, and where it differs from other EU countries on the privacy laws by region map.
DSGVO and GDPR are one law with two names
There is no separate German regulation. An EU regulation applies directly in every member state, so the DSGVO is the GDPR as Germans write it, and "Art. 6 DSGVO" means Article 6 GDPR.
The GDPR does leave room for national rules through its opening clauses, and Germany used them in the BDSG, which applies alongside the regulation. Where the GDPR offered a choice, Germany sometimes stayed with the default: the age at which a child can consent to an online service on their own is 16, because Germany did not lower it under Article 8.
| Topic | GDPR on its own | What German law adds |
|---|---|---|
| Data protection officer | Required for core activities involving large-scale monitoring or special category data (Article 37) | Also required when at least 20 people regularly process personal data by automated means (section 38 BDSG) |
| Employee data | Member states may set more specific rules (Article 88) | Section 26 BDSG, whose main clause is in doubt since 2023 (see below) |
| Fines | Up to €20 million or 4% of worldwide annual turnover | The same fines, plus criminal offences for some unauthorised disclosure of personal data (section 42 BDSG) |
| Age of digital consent | 16, member states may lower it to 13 | 16, unchanged |
| Cookies and similar technologies | Not covered by the GDPR itself | Section 25 TDDDG, which implements Article 5(3) of the ePrivacy Directive |
The BDSG decides when you need a data protection officer
The GDPR asks for a data protection officer (DPO) in a few situations, mostly large-scale monitoring and special category data. Section 38 BDSG goes further. A controller or processor must appoint one as soon as it regularly employs at least 20 people in the automated processing of personal data, and regardless of headcount when it carries out processing that needs a data protection impact assessment or trades in personal data.
The 20 people are counted across the organisation, not per team. Agencies, online shops with a customer service desk and software companies reach the threshold sooner than many expect. The GDPR side of the question is covered in the guide to whether you need a DPO.
Employee data after the CJEU's 2023 ruling
Section 26 BDSG was Germany's main rule for processing employee data, allowing it where necessary for hiring, carrying out or ending an employment relationship. In case C-34/21 of 30 March 2023, the Court of Justice of the EU held that a national rule only counts as a "more specific rule" under Article 88 GDPR if it meets the conditions of Article 88(2), and that national rules which do not must be disregarded.
The case concerned a Hesse provision worded almost exactly like section 26(1) BDSG. Since then, section 26(1) has widely been treated as an uncertain legal basis on its own, and Article 6 GDPR is the safer reference. For a website owner this matters mainly for job application forms and HR tools.
Section 25 TDDDG is the German cookie rule
The GDPR says little about cookies. In Germany, the rule is section 25 of the TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), which was called the TTDSG until it was renamed on 14 May 2024. The renaming changed nothing in substance.
Section 25(1) allows storing information on a visitor's device, or reading information already stored there, only after the visitor has consented on the basis of clear and comprehensive information, and that consent must meet the GDPR's standard. It applies whether or not the information is personal data. Section 25(2) exempts storage that is strictly necessary for a digital service the visitor has expressly asked for. The TDDDG article covers banner design in more detail.
What counts as strictly necessary
German regulators read the exemption narrowly. Analytics cookies such as _ga from Google Analytics are not strictly necessary, and in March 2025 the Administrative Court of Hanover (case 10 A 5385/22) held that even loading Google Tag Manager needs consent under section 25.
Settings the visitor chooses are treated differently. The German data protection authorities' guidance for digital services accepts that storing a non-identifying value such as a chosen language or a dark background can be strictly necessary, so functional cookies of that kind can work without consent as long as they carry no unique ID.
German regulators expect refusing to be as easy as accepting
Germany has no single regulator for the private sector. Each of the 16 federal states (Länder) has its own data protection authority, and they coordinate through the Datenschutzkonferenz (DSK), the conference of the federal and state authorities.
The DSK's guidance for providers of digital services (version 1.2, November 2024) is blunt about banner design. A banner that offers "Accept all" next to a button that only leads to "Settings" or "Details" regularly fails to collect valid consent, because the two options do not end the decision with the same effort. Where a banner blocks the content, visitors must be able to refuse with no more clicks than it takes to accept. A refusal button must be clearly labelled, and a "Settings or reject" button that opens another layer does not count.
In practice that means an Alle ablehnen (Reject all) button on the first layer, comparable in size, colour and contrast to Alle akzeptieren (Accept all).
Courts let people claim damages for losing control of their data
Fines come from the state authorities, but courts shape the risk too. On 18 November 2024, Germany's Federal Court of Justice (BGH) ruled in case VI ZR 10/24, about the Facebook scraping incident, that even a brief loss of control over personal data caused by a GDPR breach can be non-material damage under Article 82 GDPR. No misuse of the data and no further harm needs to be shown, and the court saw no objection to compensation of around €100 for the loss of control alone in that case.
Small amounts per person add up in mass claims, which is why German companies take Article 82 seriously. The second private route is the formal warning letter, the Abmahnung, which competitors and certain associations can send for data protection failures, with legal costs attached.
Steps for a website with German visitors
For most sites the German layer comes down to a short list:
- Count the people who regularly process personal data by automated means and appoint a DPO if the count reaches 20.
- Find every cookie and script on your pages and sort out which ones are strictly necessary under section 25(2).
- Show a banner with Reject all on the first layer, as easy to use as Accept all, and block everything else until the visitor chooses.
- Keep consent separate from the legal basis for the processing that follows it, which is still Article 6 GDPR.
- Publish a Datenschutzerklärung (privacy policy) in German if you target German visitors, naming the legal basis for each processing activity.
If you use Google Analytics or Google Ads, two separate requirements meet. German law requires prior consent before the tags run. Google requires Google Consent Mode v2 for its advertising and measurement features in the EEA, which passes that consent on to Google.
Short answers about the DSGVO
Does DSGVO only apply to German companies?
No. Like the GDPR, which it is, the DSGVO applies to any organisation that offers goods or services to people in Germany or monitors their behaviour, wherever the organisation is based.
Is Google Analytics legal under DSGVO in 2026?
It can be used with prior consent under section 25 TDDDG, collected before any Google Analytics script runs. Google Consent Mode v2 is Google's own requirement for its ads and measurement features in the EEA, not a legal condition, but it is how the consent reaches Google.
What is the TDDDG?
The TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) is the German law that implements the ePrivacy Directive. Its section 25 requires consent before storing or reading information on a visitor's device, except where strictly necessary. It was called the TTDSG until May 2024.
Can I use a cookie wall in Germany?
Not as a plain wall. The DSK's guidance says a banner that blocks content must let visitors refuse with no more clicks than accepting. Models that offer a paid, tracking-free subscription instead of consent are assessed separately, in a DSK decision of 22 March 2023.
Do I need a German language privacy policy?
If you target German visitors, your privacy policy must be clear and understandable to them, and in practice that means a German version of the document.
What happens if I ignore DSGVO?
State authorities can impose fines of up to €20 million or 4% of worldwide annual turnover. Visitors can also claim damages under Article 82 GDPR, and competitors can send formal warnings (Abmahnungen) with legal costs attached.
Check your banner against the German reject rule
The first thing a German regulator looks at is whether refusing is as easy as accepting and whether trackers wait for the choice. The free GDPR compliance scanner checks one page for the consent banner, the cookies and trackers set before a choice and the privacy policy.
