Law · 7 November 2026 · 5 minute read
§ 25 TDDDG: cookies and tracking in Germany
§ 25 TDDDG (formerly TTDSG) regulates cookies and scripts: when consent is needed, which exceptions apply and what this means for analytics tools.
Anyone running a website in Germany comes across § 25 TDDDG when it comes to cookies. In everyday speech the provision is often still called the „TTDSG paragraph“ and is the reason cookie banners exist. This article explains what it regulates, when it applies, which exceptions there are and what it means for analytics and marketing scripts.
From TTDSG to TDDDG
The rule has applied since 1 December 2021 and was initially contained in the Telecommunications Telemedia Data Protection Act (TTDSG). Since 14 May 2024 the law has been called the Telecommunications Digital Services Data Protection Act (TDDDG). The renaming has not changed the content of § 25. You can find the law on gesetze-im-internet.de.
What § 25 para. 1 requires
According to its wording, storing information in the end user's terminal equipment, or accessing information already stored there, is permitted only if the end user has consented on the basis of clear and comprehensive information. Information and consent must comply with the GDPR.
Three things are important:
- It concerns the device, not the link to a person. The rule applies even if no personal data arises in the end. The legal basis for the later processing is a second question. How the two steps of the assessment fit together is explained in Visitor identification and GDPR: a sober assessment.
- It concerns more than cookies. The browser's local storage (localStorage, sessionStorage) is also storage in the terminal equipment. A script reading out device information can be an access.
- Consent must be active. The CJEU decided this for cookies as early as 2019. A pre-ticked box is not enough (CJEU, C-673/17, Planet49).
The exceptions in paragraph 2
You do not need consent in two cases:
- Transmission of a message (no. 1). The sole purpose is the transmission of a message over a public telecommunications network.
- Strictly necessary (no. 2). The storage or access is strictly necessary for the provider to supply a digital service expressly requested by the user.
The second exception is interpreted narrowly. The Data Protection Conference, the association of the German supervisory authorities, has collected examples in its guidance for telemedia. According to it, what the website itself needs in order to function can generally go ahead without prior consent, such as a shopping basket, a login or storing the cookie decision. A balancing of interests under Art. 6(1)(f) GDPR does not turn a tracking script into a strictly necessary function. The authorities generally do not see audience measurement and statistics as falling under it. That is the supervisory line; a court may rule differently in an individual case.
Consequences for analytics and marketing scripts
For practice there is a simple rule of thumb: as soon as a script puts something in the browser or reads something out of the browser that is not needed to display the page, you need consent beforehand.
| Tool | Access to the device? | Consent under § 25 |
|---|---|---|
| Fonts and images from your own server | No | Not needed |
| Shopping basket cookie | Yes, but necessary | Not needed (no. 2) |
| Web analytics with cookie or device identifier | Yes | Generally needed |
| Advertising and retargeting pixels | Yes | Needed |
| Heatmaps and mouse recording | Yes | Generally needed |
Technically this means: the script may load only after the visitor has agreed to the relevant category. A banner that merely informs and loads the scripts immediately anyway does not meet the rule. What this looks like when installing via a tag manager is described in the help article on consent in the tag manager. You can read more about mouse videos in Session replay and data protection: using mouse recordings properly.
What is at stake in the event of violations
Anyone who stores or accesses contrary to § 25 para. 1 sentence 1 commits an administrative offence under § 28 para. 1 no. 13 TDDDG. Under § 28 para. 2 the fine can be up to 300,000 euros. In addition, the processing can have its own consequences under the GDPR. This is monitored by the data protection supervisory authorities.
How Austria and Switzerland handle it
The rule goes back to the ePrivacy Directive (Art. 5(3)). Austria implements it in § 165 para. 3 TKG 2021, more on this in Cookies in Austria: § 165 TKG 2021. Switzerland takes a different path, which you can read about in Website tracking in Switzerland: revDSG and FMG.
Frequently asked questions
Does § 25 TDDDG also apply to server logs? No, not to what the server receives anyway when a page is requested. The provision applies to storing on the device and to access to what is stored there. Whether an IP address at the time of the request falls under the GDPR is a separate question, which IP address and GDPR: is it personal data? deals with.
Do I need consent for pure audience measurement? In the view of the German supervisory authorities, generally yes if the device is accessed in the process. Audience measurement is not regarded as strictly necessary.
Is it enough to shorten the cookie lifetime? No. The lifetime does not change the question of whether something is stored or read. The purpose of the access is decisive.
