DE EU member state

Cookie consent rules in Germany

What TDDDG § 25 and the German data protection authorities (DSK) expect from your cookie banner: when you need consent, how the reject option should look, and what has been enforced.

Sources checked 28 October 2026. Not legal advice.

Cookie law

Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), § 25 — renamed from TTDSG in May 2024

Banner languages

German

Maximum fine

Up to €300,000 for unlawful storage or access under § 28 TDDDG — plus separate GDPR fines where personal data is involved.

What the rules say

  • § 25 protects any information on a visitor's device — whether or not it is personal data.
  • Consent isn't needed only for transmission, or for storage strictly necessary for a service the visitor explicitly requested.
  • If accepting takes one click on the first layer, rejecting must generally be possible there too, without extra effort.
  • Legitimate interest under the GDPR cannot replace the consent § 25 requires.
  • There's no blanket analytics exemption — necessity is judged for the actual tool and purpose.

How PrivacyPill handles this

  • Nothing optional runs before a choice. Google tags start with Consent Mode v2 set to denied; other scripts marked with data-pp-category wait until their category is allowed.
  • Equal first-layer buttons. "Accept all" and "Reject non-essential" sit side by side with the same weight, and a settings button lets visitors withdraw consent at any time.
  • Consent per purpose. Analytics, marketing and functional cookies can be allowed separately in the preferences panel.
  • Languages. The banner ships in German, so you're covered.
  • Proof of consent. Every choice is logged pseudonymously with the banner version, exportable as CSV.
Set up your banner

Frequently asked questions

Sources

This page summarises official sources checked on 28 October 2026. It isn't legal advice; regulators update guidance, so follow the links for the current text.

Rules in nearby countries

All countries