Using cookie banners correctly

The legal basis that is often confused

Cookie banners are usually justified with the GDPR. But the relevant law in Germany is § 25 TDDDG, the Telecommunications Digital Services Data Protection Act, which replaced the TTDSG in 2024.

The difference matters in practice: § 25 requires consent for any access to information on the user's device, regardless of whether personal data is processed in the process. This affects cookies, but also local storage, fingerprinting and loading scripts that read out information.

The GDPR comes into play after that: it governs what may be done with the collected data.

This leads to a common misconception: a service that supposedly doesn't collect personal data is not automatically exempt from consent. What matters is whether it accesses the device.

The exception is set out in § 25(2): strictly technically necessary to provide the service requested by the user.

The best banner

Cookie banners are usually justified with the GDPR. But the relevant law in Germany is § 25 TDDDG, the Telecommunications Digital Services Data Protection Act, which replaced the TTDSG in 2024.

The difference matters in practice: § 25 requires consent for any access to information on the user's device, regardless of whether personal data is processed in the process. This affects cookies, but also local storage, fingerprinting and loading scripts that read out information.

The GDPR comes into play after that: it governs what may be done with the collected data.

This leads to a common misconception: a service that supposedly doesn't collect personal data is not automatically exempt from consent. What matters is whether it accesses the device.

The exception is set out in § 25(2): strictly technically necessary to provide the service requested by the user.

What is allowed without consent

Technically necessary are cookies and comparable technologies without which the service doesn't work. These usually include:

Session cookies that keep a login or a shopping cart.

The cookie that stores the consent decision, otherwise you would have to ask again on every page view.

Language settings the user has chosen themselves.

Security features like protection against form abuse.

Load balancing on the server.

Not technically necessary are: statistics and audience measurement, marketing and advertising, embedded videos from third parties, map services, fonts from external servers, chat windows, social media embeds and A/B testing tools.

The most common mistake in practice: statistics services are classified as necessary because they are important to the operator. But necessary refers to the service the user requested, not to the operator's interest.

What a compliant banner looks like

The requirements follow from the GDPR and case law. Six points:

Equal choice. Reject all must be on the same level as Accept all, not only after a click on Settings.

Equal design. Both buttons in comparable size, color and prominence. A gray reject link next to a green accept button is legally vulnerable.

No preselection. Boxes for non-necessary purposes are empty by default.

Continuing to click is not consent. Scrolling or navigating further is not consent.

Withdrawal possible at any time, just as easily as giving consent. A permanent link in the footer is common.

Information before the decision. Which purposes, which providers, which storage duration, transfer to third countries yes or no.

What isn't permitted: showing the banner only after scripts have already loaded. This happens more often than you think and is the mistake with the greatest legal exposure.

The approach that solves most problems

The most effective measure is not better banner design, but fewer services that require consent.

Three steps:

1. Inventory. Open the developer tools in your browser, Network tab, and look at which external connections your site makes. For most websites, the list is longer than expected: fonts, maps, videos, icons, analytics tools, a forgotten chat tool.

2. Cut. For every service, ask: do we really need this? A map service on the contact page can be replaced with an image with a link. An embedded video with a preview image that only loads after a click.

3. Replace. Host fonts locally instead of loading them from an external server. Replace statistics with a tool that works without device access. With some providers, this is possible and can then be used without consent.

If you only use technically necessary technologies, you don't need a consent banner. That means the fastest website, the best user experience and the smallest legal exposure.

What a banner costs

The legal perspective often overshadows the economic one. A banner has measurable costs.

Bounces. A banner that covers half the page on the first visit leads to drop-offs, especially on smartphones and especially with visitors from ads you have paid for.

Data gaps. Anyone who rejects isn't counted. Depending on the industry, rejection rates are well into double digits. Your analytics then only show a slice, which needs to be kept in mind when making decisions based on these numbers.

Load time. Many consent tools are loaded early and block rendering.

This leads to the same advice as above: the fewer services that require consent, the smaller the banner and the lower the loss. A banner that only asks about three purposes is accepted more often than one with forty providers in a list.

What should be checked regularly

A consent banner is not a one-time setup.

With every change to the website, check whether new external services have been added. An embedded video, a new form tool, a font change: each of these can change your obligations.

Once a quarter, check the connections actually loaded, before and after consent. The most common finding: something already loads before consent.

Check the storage duration of consent. Six to twelve months is common, after which you ask again.

The documentation. Consents must be verifiable: which version of the banner, which purposes, when.

For assessing individual cases, especially with transfers to third countries and the classification of individual services, a review by a specialist lawyer makes sense. This article doesn't replace that.