The essentials
- Consent comes first: nothing non-essential may be stored or read before the visitor agrees.
- It is not only about cookies: local storage, pixels and fingerprinting are covered too.
- Pre-ticked boxes and banners that make refusing harder than accepting do not give valid consent.
The rule
Section 25(1) of the Telecommunications Digital Services Data Protection Act (TDDDG, called TTDSG until May 2024) requires the end user's consent before information is stored on their terminal equipment or information already stored there is accessed. It implements Article 5(3) of the ePrivacy Directive. Consent must meet the GDPR standard: freely given, specific, informed and unambiguous.
What it covers
Cookies, but not only: local storage, pixels that read device information, and fingerprinting techniques fall under the same rule, whether or not personal data is involved. The European Data Protection Board described this technical scope in its Guidelines 2/2023.
The exceptions
Section 25(2) exempts storage or access that is needed to transmit a message, or strictly necessary for a service the user explicitly asked for: a shopping cart, a login session, a security feature. Audience measurement, advertising and most embedded third-party content are not covered by these exceptions in the authorities' reading.
What valid consent is not
- A pre-ticked box (Court of Justice of the EU, Planet49, C-673/17, 2019; German Federal Court of Justice, Cookie-Einwilligung II, I ZR 7/16, 2020).
- Cookies set before the visitor has answered the banner.
- A banner where refusing takes more effort than accepting, which the German supervisory authorities (DSK) and the EDPB treat as an obstacle to free consent.
How to check a site
Load the page as a first-time visitor, without touching the banner, and look at what was set and what was called. Anything beyond the strictly necessary is a finding. Then refuse, reload, and check that nothing non-essential appears.
Checklist
- Load each important page (home, checkout, contact) without answering the banner: only strictly necessary cookies and requests.
- Refuse, reload: still nothing non-essential, and the choice is remembered.
- Check that refusing is as easy and visible as accepting, on the first layer.
- No pre-ticked categories in the settings layer.
- Every purpose and vendor named in the banner and the cookie policy.
Sources
- § 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), formerly TTDSG.
- Article 5(3) of Directive 2002/58/EC (ePrivacy Directive).
- CJEU, 1 October 2019, Planet49, C-673/17.
- BGH, 28 May 2020, Cookie-Einwilligung II, I ZR 7/16.
- EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive.
- EDPB Guidelines 05/2020 on consent under Regulation 2016/679.
General information, not legal advice. Have your specific situation reviewed by your DPO or counsel.