In short: Section 25 of Germany's TDDDG says you may only store or read information on a visitor's device (cookies, local storage, identifiers, fingerprinting) after they have consented, unless that access is strictly necessary for a service they asked for. It applies to any website or app with an establishment in Germany or offering services there, whatever the size of the business. Violations can be fined up to €300,000, GDPR sanctions can come on top, and German courts have already struck down banners without an equal Reject all option.
TDDDG: what is it?
The TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) is the German law on data protection and privacy in telecommunications and digital services. It was signed on 23 June 2021 and entered into force on 1 December 2021 under its original name, TTDSG. A law of 6 May 2024 renamed it TDDDG with effect from 14 May 2024, replacing the old term "telemedia" with "digital services". Its content on cookies did not change, and the text was last amended in March 2026.
For website owners, one provision matters above all: section 25, "protection of privacy in terminal equipment". It is Germany's transposition of Article 5(3) of the EU ePrivacy Directive, the rule that sits behind cookie banners across Europe. Since December 2021, the consent requirement has been written plainly into a dedicated German statute.
Territorial scope
Section 1(3) TDDDG applies the law to all companies and persons that have an establishment in Germany or provide services there. A website run from France, Spain or outside the EU that targets German visitors falls within its reach for those visitors. If you sell to German customers, translate your site into German or run campaigns aimed at Germany, assume section 25 applies to you.
Who does the TDDDG apply to?
Section 25 is addressed to anyone who stores information on, or accesses information from, an end user's device. In practice that means:
- Website operators of every size, from a freelancer's portfolio to a large e-commerce platform. There is no threshold based on revenue or traffic.
- App publishers, since mobile apps read device identifiers, advertising IDs and other data stored on the phone.
- Providers of connected devices and software that read or write information on terminal equipment, for example through update functions.
- Public bodies running websites or apps.
It does not matter whether the cookies are your own or set by a third party you embed. If a marketing pixel, video player or chat widget on your page writes to the visitor's browser, you as the operator need to make sure consent has been obtained.
A key point that surprises many teams: section 25 is not limited to personal data. The German supervisory authorities (the DSK, the conference of federal and state data protection authorities) stress that consent is required for storing or reading information on a device regardless of whether that information identifies a person. The GDPR then applies on top whenever personal data is processed.
What the TDDDG requires for cookies and consent
The rule: prior opt-in consent
Section 25(1) TDDDG states that storing information on a user's device, or accessing information already stored there, is only permitted if the user has consented on the basis of clear and comprehensive information. The second sentence adds that the information and the consent must comply with the GDPR. That brings in all the GDPR conditions for valid consent: freely given, specific, informed, unambiguous and given by a clear affirmative act. Pre-ticked boxes, silence or simply continuing to browse do not count.
According to the DSK guidance, the scope is broad. It covers:
- cookies, of course, but also local storage and session storage objects;
- reading device identifiers, advertising IDs and similar data on mobile devices;
- browser fingerprinting where a script actively reads device properties (screen resolution, fonts, system version) and sends them to a server.
Timing matters too: consent must be given before the access happens. Setting tracking cookies on the first page load and asking afterwards is not allowed.
The two exemptions
Section 25(2) lists only two cases where no consent is needed:
- the sole purpose is carrying out the transmission of a message over a public telecommunications network (mainly relevant to telecom providers);
- the storage or access is strictly necessary for the provider of a digital service to deliver a service expressly requested by the user.
The DSK reads the second exemption narrowly. Examples that can qualify include security cookies that detect repeated failed login attempts, a shopping cart cookie once the visitor has actually added an item, and a cookie that simply stores the user's consent choice without a unique ID. A cookie used for several purposes is only exempt if every one of those purposes is strictly necessary.
Reach measurement is the grey zone. The DSK explicitly refuses to say that analytics is exempt in general: third-party measurement tools usually collect far more than a page count, and only a precisely defined, minimal configuration could be assessed as not requiring consent. If you use a typical analytics or advertising tool, plan on asking for consent.
Two layers: TDDDG first, then GDPR
The DSK describes a two-step check. Section 25 TDDDG governs the access to the device (setting or reading the cookie). The subsequent processing of any personal data obtained must then have its own legal basis under Article 6 GDPR. For marketing and tracking, that basis will almost always be consent too, which is why a single banner usually collects both.
Information, duration and renewal
To be "informed", the DSK says users must learn who accesses their device, in what form, for what purpose, how long the cookies last and whether third parties can access them. They must also be told that withdrawing consent later does not affect access that already took place.
Neither the TDDDG nor the GDPR sets a fixed lifetime for consent. The DSK points out that consent always relates to a specific case: when you add new cookies or new third-party services, the previous consent no longer covers them and you must ask again.
Withdrawal and proof
Withdrawing consent must be as easy as giving it (Article 7(3) GDPR). The DSK rejects withdrawal only by email, letter or contact form, and also rejects making users dig through a privacy policy. A permanently visible link or icon that reopens the consent settings is the approach it describes as workable.
You also have to be able to prove that consent was validly obtained. The DSK says this does not require long-lived tracking IDs: you should document the process you implemented, how choices are stored and read, the technical flow, and the information shown at the time of consent. It recommends keeping old banner texts and configurations so you can show what users actually saw.
Recognised consent management services
Section 26 TDDDG and the Consent Management Ordinance (EinwV), in force since 1 April 2025, create "recognised consent management services" that store users' choices centrally. The BfDI handles recognition and recognised the first service in October 2025. Using such services is voluntary for website operators (section 18(1) EinwV), so your own banner remains necessary.
A TDDDG-compliant cookie banner
German guidance and case law give a fairly precise picture of what a banner must do. On the first layer, the DSK expects in most cases:
- the concrete purposes of the processing;
- whether individual profiles are created and enriched with data from other websites;
- whether data is processed outside the EEA;
- how many controllers the data is disclosed to.
Third-party providers must be named individually. Saying that data is shared with "partners" is not enough.
While the banner is displayed, no consent-requiring scripts may run and no content from third-party servers that needs consent may load. Checkboxes must not be pre-ticked, and the banner must not block access to the legal notice (Impressum) or privacy policy.
Buttons
The DSK says a reject option on the first layer is required whenever visitors must interact with the banner to keep using the site, and notes that this is the case for most banner designs. Both German courts that have ruled on the point agreed: rejecting must be as easy as accepting. If your first layer has "Accept all", it needs an equally visible "Reject all".
Prohibited dark patterns
The DSK accepts some design freedom but says nudging becomes unlawful once consent is no longer free or informed, often through several design features combined. The courts have condemned:
- a reject path hidden on a second layer while "Accept all" sits on the first;
- a settings button barely distinguishable from the background;
- an "X" close icon that actually means "Accept and close";
- misleading headings such as promising an "optimal user experience" without mentioning consent;
- repeatedly showing the banner to push users into accepting;
- hiding the right to withdraw or the third-country transfers below the fold.
For a step-by-step design, see our guide to a GDPR-compliant cookie banner and the overview of cookie dark patterns that regulators prohibit. Both apply directly to banners shown to German visitors.
Penalties and enforcement
Under section 28(1) no. 13 TDDDG, anyone who intentionally or negligently stores or accesses information contrary to section 25(1) commits an administrative offence. It can be fined up to €300,000. Because the subsequent processing of personal data falls under the GDPR, authorities can also act under the GDPR's own, much higher sanction regime.
Enforcement is split. According to the BfDI, private companies are mostly supervised by the state data protection authorities, while section 28 TDDDG makes the BfDI responsible where telecom providers or federal authorities are involved. Consumer associations can also sue in the civil courts.
Real cases
- Hanover Administrative Court, 19 March 2025 (10 A 5385/22). The Lower Saxony data protection commissioner had issued an order against a regional media company. The court confirmed it: the banner offered only "Accept all" and "Settings" on the first layer, made rejecting much harder, repeated itself to push consent, never used the word "consent", hid the number of partners, and only showed withdrawal rights and third-country transfers after scrolling. The court held the consents invalid under the TDDDG and the GDPR. (LfD Niedersachsen press release 08/2025)
- Cologne Higher Regional Court, 19 January 2024 (6 U 80/23). A consumer association sued the operator of an ad-financed news portal. The court ordered it to stop using a banner with no equivalent reject option on the first layer and with an "X" labelled "Accept & Close", finding the design misleading and the consents not freely given under section 25(1) and the GDPR. (judgment on NRWE)
Compliance checklist
- Audit every cookie, storage object and script on your site, including those set by embedded third parties.
- Classify each one as strictly necessary for a requested service, or consent-required. Be strict: analytics and marketing tools belong in the second group.
- Block consent-required scripts and third-party content until the visitor opts in.
- Put "Reject all" next to "Accept all" on the first layer, with the same size, colour weight and number of clicks.
- Show the required first-layer information: purposes, profiling, transfers outside the EEA, and the number of recipients, with third parties named individually.
- Never pre-tick categories and never treat scrolling or closing the banner as consent.
- Add a permanent link or icon that reopens the consent settings so visitors can withdraw as easily as they agreed.
- Keep proof: consent records, the banner text and configuration shown at the time, and a description of your technical setup.
- Ask for consent again whenever you add new cookies or third-party services.
- Check the GDPR basis for any personal data you process after the cookie is set.
How FlowConsent helps you comply with the TDDDG
FlowConsent covers the technical side of section 25 for websites with German visitors. Scripts are blocked before consent, so nothing consent-required fires on the first page load. The automatic scan finds the cookies and services on your site, so you know exactly what your banner has to cover (see how to set services and legal bases). Every choice is recorded and you can export proof of consent at any time with the proof report. Google Consent Mode v2 is built in, data is hosted in Europe, and setup takes about ten minutes. Run our free scanner to see what your site sets today, then create your account: it is free up to 25,000 sessions per month.
Further reading
The articles below go deeper into the topics this page touches on. Start with the seven conditions for valid GDPR consent, since section 25 borrows them directly, then see how to keep proof of cookie consent and how to run a full cookie audit on your site.