# Cookie consent in Germany: § 25 TDDDG explained > In Germany, § 25 of the TDDDG (called the TTDSG until May 2024) requires consent before anything is stored on or read from a user's device, unless it is strictly necessary for a digital service the user expressly requested. The data protection authorities' joint guidance and a 2025 court ruling say that when a banner has an Accept all button on the first layer, it needs an equally visible way to reject there too. There is no general exemption for analytics, and a breach of § 25 can be fined up to 300,000 euros, on top of GDPR fines for the processing that follows. Source: https://cookiequiet.com/laws/germany Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Providers of websites, apps and other digital services that store or read information on end users' devices in Germany - **Consent model:** Prior opt-in; information and consent follow the GDPR (§ 25(1) TDDDG) - **Cookie rule:** § 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), in force since 1 December 2021 as the TTDSG, renamed on 14 May 2024 - **Authority:** The data protection authority of each federal state for private websites; the BfDI for telecom providers and federal bodies; joint guidance by the DSK - **Maximum fine:** 300,000 euros for a breach of § 25 (§ 28(1) no. 13 and (2) TDDDG); GDPR fines up to 20 million euros or 4% for unlawful processing that follows - **Reject on first layer:** Yes when an Accept all button is there: DSK OH Digitale Dienste (version 1.2, November 2024) and Administrative Court of Hanover, 19 March 2025 (10 A 5385/22) - **Consent management services:** Recognized consent management services under § 26 TDDDG and the EinwV regulation, in force since 1 April 2025; using one is voluntary ## What is the German cookie law? Germany transposed Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) late. For years the old Telemedia Act assumed an opt-out, until the Federal Court of Justice ruled in Cookie-Einwilligung II (28 May 2020, I ZR 7/16), after the CJEU's Planet49 judgment, that advertising cookies need active consent. The legislator then adopted the TTDSG of 23 June 2021, in force since 1 December 2021. On 14 May 2024 the Digitale-Dienste-Gesetz of 6 May 2024, which implements the EU Digital Services Act, renamed it the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). The cookie rule kept its number and its content. § 25(1) TDDDG says that storing information in a user's terminal equipment, or accessing information already stored there, is only allowed if the user has consented on the basis of clear and comprehensive information, and that information and consent follow the [GDPR](/laws/gdpr). § 25(2) gives two exceptions: storage or access whose sole purpose is the transmission of a message over a public network, and storage or access that is strictly necessary for the provider to deliver a digital service the user has expressly requested. The rule is technology neutral. The authorities read it to cover cookies, local storage, pixels and fingerprinting, and it applies whether or not personal data is involved. What happens with the data afterwards is a separate question under the GDPR. ## Who enforces it? There is no single cookie regulator. For private websites and apps, the data protection authority of the federal state where the company sits is competent, for example the Bavarian BayLDA, the Berlin BlnBDI or the Lower Saxony LfD. The Federal Commissioner (BfDI) supervises § 25 only for telecom providers and federal public bodies. The authorities coordinate through the Datenschutzkonferenz (DSK), whose guidance for providers of digital services, the OH Digitale Dienste, is the reference text. Its current version 1.2 dates from November 2024. ## What must a cookie banner do in Germany? The DSK guidance sets out the conditions for valid consent under § 25: - Consent requires an active act. Continuing to browse, or browser settings that accept cookies, are not consent. - If the first layer has a button that consents to several purposes, the first layer must also describe each of those purposes concretely. "We use cookies to improve your experience" is too vague. - The option to refuse must be shown as an equivalent alternative, comparable in size, color, contrast and font. A reject option hidden in the running text, placed outside the banner or practically unreadable does not count. - A button labeled "Settings or reject" that opens a second layer is not enough next to an Accept button. - If the banner covers the content and cannot simply be ignored, consent is generally not freely given when refusing costs more clicks or attention than accepting. The Administrative Court of Hanover confirmed this reading in its judgment of 19 March 2025 (10 A 5385/22). A news publisher's banner offered only "Accept all" and "Settings" on the first layer. The court upheld the Lower Saxony authority's order: when there is an "Accept all" option, a clearly visible "Reject all" option must be on the first layer too, and banners must not be designed to steer users toward consent. It also held that Google Tag Manager needs consent. Our [Reject all guide](/guides/reject-all-button) covers the design side. The DSK does not set a fixed period for asking again. The general rule is that a refusal must be respected, and that withdrawing consent must be as easy as giving it. ## Are pay or consent models allowed in Germany? Yes, under conditions. In a resolution of 22 March 2023, the DSK accepted that tracking can be based on consent when the alternative is a tracking-free subscription, even a paid one, provided the paid option gives equivalent access to essentially the same service for a usual market price. Visitors who choose the tracking option must still be able to consent purpose by purpose, and subscribers who give no extra consent may only receive strictly necessary storage. ## Do analytics cookies need consent in Germany? Usually yes. Unlike France, Germany has no authority-backed exemption for audience measurement. The DSK guidance deliberately gives no list of tools that are exempt, because "reach measurement" covers anything from a simple page counter to detailed behavioral analysis. A count of page views from server logs without personal data, or a simple counting pixel of the site itself that collects nothing else, may fall within the strictly necessary exception. Third-party analytics with identifiers, such as a standard Google Analytics setup, needs consent. ## What are recognized consent management services? § 26 TDDDG lets independent services store a user's consent decisions and pass them to websites, so that people are not asked again on every site. The details are in the Einwilligungsverwaltungsverordnung (EinwV) of 6 February 2025, in force since 1 April 2025. The services must have no economic interest in the consents they manage and are recognized by the BfDI. Websites may integrate them but are not obliged to. ## How much are the fines in Germany? A breach of § 25 is an administrative offense under § 28(1) no. 13 TDDDG, punishable by a fine of up to 300,000 euros. The processing of personal data that follows an unlawful cookie, such as profiling for advertising, is assessed under the GDPR, with fines up to 20 million euros or 4% of worldwide turnover. In practice, German authorities have acted mostly through orders and court cases, such as the Hanover case above, rather than published cookie fines. Consumer associations and competitors can also sue under German competition and consumer law. ## How does Cookiequiet fit German rules? Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Accept all and Reject all sit on the first layer with the same size and weight by default, and visitors whose browser asks for German get the banner in German. Every choice goes into a consent log with its date and banner version. Geo-targeting is free on every plan; see [pricing](/pricing). ## Questions ### Is the TTDSG still in force? Yes, under a new name. Since 14 May 2024 the law is called the TDDDG, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz. The cookie consent rule is still § 25 and its content did not change. ### Does a German cookie banner need a Reject all button on the first layer? If the first layer has an Accept all button, yes. The DSK guidance requires an equivalent option to refuse, and the Administrative Court of Hanover ruled on 19 March 2025 that a clearly visible Reject all option must then be on the first layer. A Settings button that leads to a second layer is not enough. ### Can I use Google Analytics without consent in Germany? No. Germany has no general analytics exemption, and the DSK guidance does not exempt third-party analytics that uses identifiers. Only very limited measurement without personal data, such as counting page views from server logs, may fall under the strictly necessary exception. ### Who fines cookie breaches in Germany? For private websites, the data protection authority of the federal state where the company is established. The federal commissioner, the BfDI, is competent only for telecom providers and federal bodies. Fines for a § 25 breach reach 300,000 euros, and GDPR fines can be added for unlawful processing that follows. ## Sources - [TDDDG, § 25 (protection of privacy in terminal equipment), gesetze-im-internet.de](https://www.gesetze-im-internet.de/ttdsg/__25.html) - [TDDDG, § 28 (fines), gesetze-im-internet.de](https://www.gesetze-im-internet.de/ttdsg/__28.html) - [TDDDG, full text with history (in force 1 December 2021, renamed with effect from 14 May 2024), gesetze-im-internet.de](https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html) - [DSK, Orientierungshilfe der Aufsichtsbehörden für Anbieter:innen von digitalen Diensten (OH Digitale Dienste), version 1.2, November 2024](https://datenschutzkonferenz-online.de/media/oh/OH_Digitale_Dienste.pdf) - [DSK, Beschluss vom 22. März 2023: Bewertung von Pur-Abo-Modellen auf Websites](https://www.datenschutzkonferenz-online.de/media/pm/DSK_Beschluss_Bewertung_von_Pur-Abo-Modellen_auf_Websites.pdf) - [LfD Niedersachsen, press release 08/2025 of 20 May 2025 on the judgment of the Administrative Court of Hanover of 19 March 2025](https://www.lfd.niedersachsen.de/download/217974) - [Einwilligungsverwaltungsverordnung (EinwV) of 6 February 2025, BGBl. 2025 I Nr. 32, gesetze-im-internet.de](https://www.gesetze-im-internet.de/einwv/BJNR0200B0025.html)