Cookie banners under German law: when you need one and what it must look like
Many websites show a cookie banner because "everyone does", and many of those banners are both unnecessary and unlawful: unnecessary because the site uses nothing that needs consent, and unlawful because rejecting is hidden or tracking runs before the click. This article explains when you really need a banner on a site aimed at German visitors, what courts require, and how you can often avoid it altogether.
When you need a banner at all
The rule is Section 25 TDDDG (called TTDSG until May 2024), Germany's implementation of the EU ePrivacy Directive. It covers not just cookies but any storing or reading of information on the device: local storage, tracking pixels, fingerprinting. Without consent this is only allowed when strictly necessary to provide a service the user explicitly asked for.
Rule of thumb:
- No consent needed: shopping cart, login session, language preference, storing the banner choice itself, protecting a form from abuse.
- Consent needed: Google Analytics and similar cookie-based analytics, advertising and remarketing pixels, embedded YouTube videos or Google Maps that set cookies on load, many chat widgets.
- If your site uses nothing from the second group, you don't need a banner. You still need a privacy policy.
What a compliant banner must do
Pre-ticked boxes are not consent. The Court of Justice of the EU (Planet49, C-673/17, 2019) and Germany's Federal Court of Justice (Cookie-Einwilligung II, I ZR 7/16, 2020) both ruled this. Consent must be active, free and informed, and given before the services load.
On 19 January 2024 the Higher Regional Court of Cologne (6 U 80/23) objected to a banner that offered only "Accept" and "Settings" on the first layer: without an equivalent reject option on the first layer, users are steered towards consent. An "X" labelled "Accept & close" was not valid consent either. The ruling is final.
That gives these requirements:
- "Reject all" sits on the first layer, as large and as visible as "Accept all".
- No consent-based service loads before the click, including the tag manager that would load it.
- Purposes and providers are named clearly, with details on the second layer.
- Withdrawing is as easy as consenting, for example via a permanent "Cookie settings" link in the footer (Article 7(3) GDPR).
- Legal notice and privacy policy stay reachable; the banner doesn't cover them.
- Choices are logged so you can prove consent.
The most common mistakes
When we audit websites we keep seeing the same patterns:
- The banner exists, but Google Analytics or the Meta Pixel fire on the first page view.
- "Reject" is a grey text link while "Accept" is a coloured button.
- YouTube videos are embedded directly instead of with a two-click solution.
- A website update added a plugin that was never registered in the consent tool.
- The banner lists services removed long ago and misses new ones.
Consent management services (PIMS): the end of banners?
Since 1 April 2025 Germany's Consent Management Ordinance (EinwV) has regulated recognised services where users store their consent choices centrally; recognition is granted by the Federal Data Protection Commissioner. Using them is voluntary for website owners. Until such services are widely used, your own banner remains the norm.
Going without a banner: the better route
Many business websites can avoid a banner entirely. Fonts and icons are self-hosted, maps and videos load only after a click on a preview image, and instead of Google Analytics a cookieless analytics tool measures visits without storing anything on the device. That processing still belongs in the privacy policy but needs no banner.
The side effects: no banner spoiling the first impression, faster load times, and complete visitor numbers instead of only the people who clicked accept.
Frequently asked questions
- Is a notice saying "This site uses cookies, OK" enough?
- No. A notice without a way to reject is not consent. Either you only use strictly necessary technology and need no banner, or you obtain real consent with an equivalent reject option.
- Does this apply to B2B websites?
- Yes. Section 25 TDDDG makes no distinction between consumers and business customers; it protects the device of every visitor.
- How do I recognise a good consent tool?
- It technically blocks services until consent, offers "Reject all" on the first layer, logs choices and ideally stores data in the EU. Test it in the Network tab: no tracking requests should appear before the click.
Sources
Send us your website address. We check what loads before consent and tell you whether to fix the banner or drop it entirely.
Have my cookie banner checked