Cookie consent in Germany: § 25 TDDDG explained

What is the German cookie law?

Germany transposed Article 5(3) of the ePrivacy Directive late. For years the old Telemedia Act assumed an opt-out, until the Federal Court of Justice ruled in Cookie-Einwilligung II (28 May 2020, I ZR 7/16), after the CJEU's Planet49 judgment, that advertising cookies need active consent. The legislator then adopted the TTDSG of 23 June 2021, in force since 1 December 2021. On 14 May 2024 the Digitale-Dienste-Gesetz of 6 May 2024, which implements the EU Digital Services Act, renamed it the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). The cookie rule kept its number and its content.

§ 25(1) TDDDG says that storing information in a user's terminal equipment, or accessing information already stored there, is only allowed if the user has consented on the basis of clear and comprehensive information, and that information and consent follow the GDPR. § 25(2) gives two exceptions: storage or access whose sole purpose is the transmission of a message over a public network, and storage or access that is strictly necessary for the provider to deliver a digital service the user has expressly requested.

The rule is technology neutral. The authorities read it to cover cookies, local storage, pixels and fingerprinting, and it applies whether or not personal data is involved. What happens with the data afterwards is a separate question under the GDPR.

Who enforces it?

There is no single cookie regulator. For private websites and apps, the data protection authority of the federal state where the company sits is competent, for example the Bavarian BayLDA, the Berlin BlnBDI or the Lower Saxony LfD. The Federal Commissioner (BfDI) supervises § 25 only for telecom providers and federal public bodies. The authorities coordinate through the Datenschutzkonferenz (DSK), whose guidance for providers of digital services, the OH Digitale Dienste, is the reference text. Its current version 1.2 dates from November 2024.

What must a cookie banner do in Germany?

The DSK guidance sets out the conditions for valid consent under § 25:

• Consent requires an active act. Continuing to browse, or browser settings that accept cookies, are not consent.
• If the first layer has a button that consents to several purposes, the first layer must also describe each of those purposes concretely. "We use cookies to improve your experience" is too vague.
• The option to refuse must be shown as an equivalent alternative, comparable in size, color, contrast and font. A reject option hidden in the running text, placed outside the banner or practically unreadable does not count.
• A button labeled "Settings or reject" that opens a second layer is not enough next to an Accept button.
• If the banner covers the content and cannot simply be ignored, consent is generally not freely given when refusing costs more clicks or attention than accepting.

The Administrative Court of Hanover confirmed this reading in its judgment of 19 March 2025 (10 A 5385/22). A news publisher's banner offered only "Accept all" and "Settings" on the first layer. The court upheld the Lower Saxony authority's order: when there is an "Accept all" option, a clearly visible "Reject all" option must be on the first layer too, and banners must not be designed to steer users toward consent. It also held that Google Tag Manager needs consent. Our Reject all guide covers the design side.

The DSK does not set a fixed period for asking again. The general rule is that a refusal must be respected, and that withdrawing consent must be as easy as giving it.

Are pay or consent models allowed in Germany?

Yes, under conditions. In a resolution of 22 March 2023, the DSK accepted that tracking can be based on consent when the alternative is a tracking-free subscription, even a paid one, provided the paid option gives equivalent access to essentially the same service for a usual market price. Visitors who choose the tracking option must still be able to consent purpose by purpose, and subscribers who give no extra consent may only receive strictly necessary storage.

Do analytics cookies need consent in Germany?

Usually yes. Unlike France, Germany has no authority-backed exemption for audience measurement. The DSK guidance deliberately gives no list of tools that are exempt, because "reach measurement" covers anything from a simple page counter to detailed behavioral analysis. A count of page views from server logs without personal data, or a simple counting pixel of the site itself that collects nothing else, may fall within the strictly necessary exception. Third-party analytics with identifiers, such as a standard Google Analytics setup, needs consent.

What are recognized consent management services?

§ 26 TDDDG lets independent services store a user's consent decisions and pass them to websites, so that people are not asked again on every site. The details are in the Einwilligungsverwaltungsverordnung (EinwV) of 6 February 2025, in force since 1 April 2025. The services must have no economic interest in the consents they manage and are recognized by the BfDI. Websites may integrate them but are not obliged to.

How much are the fines in Germany?

A breach of § 25 is an administrative offense under § 28(1) no. 13 TDDDG, punishable by a fine of up to 300,000 euros. The processing of personal data that follows an unlawful cookie, such as profiling for advertising, is assessed under the GDPR, with fines up to 20 million euros or 4% of worldwide turnover. In practice, German authorities have acted mostly through orders and court cases, such as the Hanover case above, rather than published cookie fines. Consumer associations and competitors can also sue under German competition and consumer law.

How does Cookiequiet fit German rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Accept all and Reject all sit on the first layer with the same size and weight by default, and visitors whose browser asks for German get the banner in German. Every choice goes into a consent log with its date and banner version. Geo-targeting is free on every plan; see pricing.