> TTDSG or TDDDG? What the 2024 rename changed, what section 25 still requires for cookies, the key German rulings and what to update on your website now. > > Canonical: https://www.flowconsent.com/en/blog/ttdsg-tdddg-german-cookie-law [Regulation](https://www.flowconsent.com/en/blog?category=regulation) # TTDSG is now TDDDG: what changed in Germany's cookie law (2021 to 2026) By Roland Vekemans · Published 17 October 2026 · 7 min read In short The TTDSG and the TDDDG are the same German law. It entered into force on 1 December 2021 as the TTDSG and was renamed TDDDG on 14 May 2024, when the new Digitale-Dienste-Gesetz (DDG) replaced the Telemediengesetz (TMG). The cookie rule did not change: section 25 still requires prior consent before any information is stored on or read from a visitor's device, unless it is strictly necessary for a service the visitor requested. What did change since 2021 is the vocabulary, the official guidance, the case law on banners and the arrival of recognised consent management services. Many German privacy policies, cookie banners and contracts still cite "§ 25 TTDSG". That is not a compliance failure in itself, but it shows that a site has not been reviewed since 2024. This article walks through the history of the law, what the 2024 rename actually changed, what happened in guidance and court rulings since, and what to update on your website. For the rules every valid consent must meet, start with our guide to [the 7 requirements for valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements): section 25 borrows them directly. ## What was the TTDSG, and why is it now called TDDDG? TTDSG stands for Telekommunikation-Telemedien-Datenschutz-Gesetz, the German Telecommunications and Telemedia Data Protection Act. It was signed on 23 June 2021 and entered into force on 1 December 2021. It brought together privacy rules that were previously spread across the Telemediengesetz (TMG) and the Telecommunications Act, and it finally gave Germany an explicit transposition of Article 5(3) of the [ePrivacy Directive](https://www.flowconsent.com/en/laws/eprivacy-directive), the rule behind cookie banners across Europe. In May 2024, Germany adapted its laws to the EU Digital Services Act. The new Digitale-Dienste-Gesetz (DDG) replaced the TMG, and the term "telemedia" was replaced by "digital services" throughout federal law. The TTDSG was renamed accordingly: Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, or TDDDG, with effect from 14 May 2024. The name changed, the abbreviation became harder to pronounce, and the cookie provision stayed exactly where it was: section 25. That is why people still search for "TTDSG": most guidance, court rulings and banner texts were written under the old name and remain valid under the new one. Our page on the [TDDDG and section 25](https://www.flowconsent.com/en/laws/tdddg) covers the full legal detail. ## Before 2021: cookies under the TMG and the Planet49 ruling Before the TTDSG, German law had no clear cookie consent rule. Section 15(3) of the TMG allowed providers to create pseudonymous usage profiles for advertising and market research **unless the user objected**. Read literally, that was an opt-out model, which did not match the ePrivacy Directive. The courts closed the gap. In the Planet49 case, the Court of Justice of the EU ruled on 1 October 2019 (C-673/17) that storing cookies requires active consent and that a pre-ticked checkbox is not valid consent. The German Federal Court of Justice (BGH) then decided the case on 28 May 2020 (I ZR 7/16, "Cookie-Einwilligung II"). It read section 15(3) TMG in line with the Directive, so that consent was required for cookies used for advertising and market research. The result worked, but it rested on an interpretation that contradicted the wording of the statute. The TTDSG replaced that construction with a direct rule. ## What section 25 TDDDG says about cookies Section 25 is short. Paragraph 1 says that storing information on a user's terminal equipment, or accessing information already stored there, is only permitted if the user has consented on the basis of clear and comprehensive information. The information and the consent must comply with the [GDPR](https://www.flowconsent.com/en/laws/gdpr). Paragraph 2 lists two exceptions: 1. the sole purpose is transmitting a message over a public telecommunications network; 2. the storage or access is **strictly necessary** for the provider of a digital service to provide a service that the user has expressly requested. Three points are often missed: - **It is not limited to personal data.** Section 25 protects the device. Any information stored or read needs consent, whether or not it identifies someone. - **It is not limited to cookies.** Local storage, device identifiers and fingerprinting scripts that read device properties are covered too. - **It comes on top of the GDPR.** Section 25 governs access to the device. Any personal data processed afterwards needs its own legal basis under Article 6 GDPR. In practice, analytics, advertising and most third-party embeds need consent. Session cookies for a login or a shopping cart usually do not. Our article on [strictly necessary cookies](https://www.flowconsent.com/en/blog/strictly-necessary-cookies-examples) shows where the line sits, with real cookie names. ## What changed in May 2024, and what did not ### Same rule, new vocabulary The 2024 amendment replaced "Telemedien" with "digitale Dienste". In section 25(2), the exemption now refers to the "provider of a digital service" instead of the "provider of a telemedia service". The substance is identical: same conditions, same exemptions, same fines. ### The Telemediengesetz is gone The other visible change concerns the legal notice (Impressum). The obligation that used to be in section 5 TMG is now in section 5 DDG, with the same content. A German Impressum that still says "Angaben gemäß § 5 TMG" refers to a law that no longer exists. Lawyers and chambers of commerce recommend updating the reference, since outdated citations can attract warning letters. ### What did not move Section 25 kept its number. The fines in section 28 did not change: storing or accessing information contrary to section 25(1) is an administrative offence that can be fined up to €300,000, and GDPR fines can apply to the subsequent processing. Enforcement for private websites remains with the data protection authorities of the German states (Länder). ## 2024 to 2026: guidance, rulings and consent services The real changes for website owners came from outside the statute. ### Updated DSK guidance The DSK, the conference of German federal and state data protection authorities, published guidance on the TTDSG shortly after it entered into force. Version 1.2, published in November 2024 as guidance for providers of digital services, reflects the new terminology. It reads the "strictly necessary" exemption narrowly, refuses a blanket exemption for reach measurement and says a reject option on the first layer of the banner is required whenever visitors must interact with the banner to use the site. ### Court rulings on banner design Two decisions made the reject button concrete: - **Cologne Higher Regional Court, 19 January 2024 (6 U 80/23).** A consumer association sued a news portal whose banner had no equivalent reject option on the first layer and an "X" that meant "Accept & Close". The court found the consents were not freely given. - **Hanover Administrative Court, 19 March 2025 (10 A 5385/22).** The court confirmed an order of the Lower Saxony data protection commissioner against a media company whose banner offered only "Accept all" and "Settings", pushed users repeatedly and hid the number of partners. Both rulings apply the same test: rejecting must be as easy as accepting. Our overview of [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) lists the designs regulators in France and elsewhere have condemned for the same reasons. Not sure what your own site sets before anyone clicks? Check in 30 seconds which cookies your site drops with the [free cookie scanner](https://www.flowconsent.com/en/scan). ### Recognised consent management services Section 26 TDDDG provides for "recognised services for consent management": independent services where users store their choices once, and websites can read them. The implementing ordinance (Einwilligungsverwaltungsverordnung, EinwV) entered into force on 1 April 2025. The BfDI, the federal data protection commissioner, recognised the first service in October 2025. This does not remove cookie banners. Using a recognised service is voluntary for website operators, and visitors who do not use one still need to be asked. For most sites, nothing changes in practice yet. ## What to update on your website now If your site was set up under the TTDSG, a short review is enough: 1. **Replace "TTDSG" with "TDDDG"** in your privacy policy, cookie policy and banner texts. Keep the section number: § 25. 2. **Replace "§ 5 TMG" with "§ 5 DDG"** in your Impressum. 3. **Check the first layer of your banner.** "Reject all" should sit next to "Accept all", with the same visual weight and the same number of clicks. 4. **Scan your site again.** Tools added since 2021 (new pixels, chat widgets, video players) may set cookies that your banner does not cover. 5. **Confirm scripts are blocked before consent**, including on the first page load. 6. **Keep proof** of the consents you collect and of the banner text shown at the time. The same rules apply in other EU countries through their own ePrivacy transpositions, so a banner built for German visitors usually works across Europe. For the bigger picture, read our summary of [what changed for GDPR and cookies in 2026](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed). FlowConsent is one example of a consent banner built around these requirements: it blocks scripts until the visitor chooses and shows "Accept" and "Reject" with equal weight on the first layer. ## How FlowConsent handles TDDDG consent FlowConsent applies section 25 on the technical side for sites with German visitors. Scripts that need consent are **blocked before consent**, so nothing fires on the first page load. The automatic cookie scan detects the services on your site, and you assign each one a purpose and legal basis, keeping strictly necessary cookies separate from those that need opt-in (see [services and legal basis](https://www.flowconsent.com/en/doc/services-and-legal-basis)). Each choice is recorded and you can export proof of consent at any time. Google Consent Mode v2 is built in, data is hosted in Europe and installation takes about ten minutes. FlowConsent is free up to 25,000 sessions per month, then Pro costs €14.99 per month for up to 100,000 sessions. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fttdsg-tdddg-german-cookie-law) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fttdsg-tdddg-german-cookie-law) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is the difference between the TTDSG and the TDDDG? There is no difference in substance: they are the same law under two names. It entered into force on 1 December 2021 as the TTDSG and was renamed TDDDG on 14 May 2024, when Germany replaced the term telemedia with digital services. The cookie rule is still in section 25, so guidance, court rulings and banners built for the TTDSG remain valid. ### What does section 25 TDDDG say? Section 25 says that storing information on a user's device, or reading information already stored there, is only allowed with the user's consent, given on the basis of clear and comprehensive information that meets GDPR standards. There are two exceptions: transmitting a message over a public network, and access that is strictly necessary for a digital service the user expressly requested. It covers cookies, local storage and fingerprinting. ### Is the Telemediengesetz (TMG) still valid? No. The TMG was repealed on 14 May 2024 and replaced by the Digitale-Dienste-Gesetz (DDG), which implements the EU Digital Services Act in Germany. For website owners, the main practical effect is the legal notice: the Impressum obligation moved from section 5 TMG to section 5 DDG with the same content, so references to section 5 TMG should be updated. ### Does the TDDDG apply to websites outside Germany? It can. The TDDDG covers companies that have an establishment in Germany or provide services there. A shop in France, Spain or the United States that targets German visitors should apply section 25 to them. In practice, other EU countries apply the same ePrivacy rule through their own laws, so a banner that meets German requirements usually works across Europe. ### Do recognised consent management services replace cookie banners? No. Section 26 TDDDG and the EinwV ordinance, in force since 1 April 2025, allow users to store their consent choices with a recognised independent service, and the BfDI recognised the first one in October 2025. Using such a service is voluntary for website operators, and visitors who do not use one must still be asked, so your own banner remains necessary. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Regulation · 4 March 2026](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work) ### [What are cookies? Types of cookies, how they work and what the law requires](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work) [A clear definition of cookies, how they work, every type of cookie (by origin, duration and purpose), what happens when you accept or reject them, and what European law requires of websites.](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work) [Read the article ](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work)· [Regulation · 31 March 2026](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) ### [GDPR and cookies in 2026: what changed and what is coming](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) [Record fines, mandatory Consent Mode v2, Digital Omnibus, automated CNIL enforcement. The complete guide to cookie and GDPR compliance in 2026.](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed)· [Comparisons · 25 October 2026](https://www.flowconsent.com/en/blog/borlabs-cookie-alternative) ### [Borlabs Cookie alternative: 7 consent tools compared on price and features (2026)](https://www.flowconsent.com/en/blog/borlabs-cookie-alternative) [What Borlabs Cookie costs in 2026, why sites leave it, and seven Borlabs Cookie alternatives for WordPress and other platforms, with a switch plan that avoids any compliance gap.](https://www.flowconsent.com/en/blog/borlabs-cookie-alternative) [Read the article](https://www.flowconsent.com/en/blog/borlabs-cookie-alternative) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)