A simple notice saying “By continuing to use this site, you agree to cookies” is unlawful in Germany. Under the TDDDG (formerly TTDSG), storing or reading any information on a user's device requires prior informed consent (opt-in).

Technically necessary versus optional cookies

Without prior consent (Section 25(2) TDDDG), only strictly necessary elements (unbedingt erforderlich) may be set: session cookies for a shopping basket, authentication tokens, interface language choice and the cookie that stores the consent banner settings. All marketing, statistics and tracking scripts (GA4, Meta Pixel, Hotjar) require voluntary opt-in.

Banner requirements: rejecting must be as easy as accepting

German courts and supervisory authorities object to manipulative designs (dark patterns). Rejecting must be as easy as accepting: a “Reject” button (Ablehnen) belongs on the first layer of the banner next to “Accept all” (Alle akzeptieren) and must not be lost beside it. You must not hide the option to reject in the settings or use pre-ticked checkboxes.

Integrating a consent management platform (CMP)

To comply with the law, businesses usually use specialised consent management platforms (Usercentrics, Cookiebot, Borlabs Cookie for WordPress or CookieYes). The platform must block JavaScript tags until the user has made a choice and keep records of consent (consent log) with the policy version and a timestamp.

Google Consent Mode v2 and server-side analytics

For websites using Google Ads, support for Google Consent Mode v2 is important. It passes the ad_user_data and ad_personalization parameters to the advertising services. In advanced mode, requests without cookies are still sent to Google when a user refuses consent; German supervisory authorities take a critical view of this. Basic mode, in which Google tags are not loaded until consent is given, is the safer choice.

What to check

  • Make sure “Reject” is as easy to reach as “Accept”.
  • Block analytics and pixels until the visitor explicitly clicks to consent.
  • Let users change or withdraw their consent at any time.
  • Implement a CMP that keeps an audit log of consents.

Example situation

An online shop replaces its bright green “Accept” button and hidden rejection link with two equivalent choice buttons, avoiding objections from the consumer advice centre (Verbraucherzentrale) during a TDDDG compliance check.

Next step

A lawful consent banner technically blocks scripts until the user chooses and offers a fair interface without manipulation.

Official information on this topic

Checklists and examples are organisational recommendations. Requirements depend on the procedure, the city and your situation; check them with the relevant office before you act. Please discuss legal and tax questions with an authorised professional.

This article was prepared with the help of AI. The example illustrates the approach and does not describe a client case.