Cookie Banner 2026: Implementing Section 25 TDDDG + Art. 6 GDPR correctly

1. § 25 TDDDG vs. Art. 6 GDPR — what applies when?

Short answer: For every cookie and every comparable tag, two separate tests apply in Germany: § 25 TDDDG decides on access to the terminal equipment, Art. 6 GDPR on the subsequent processing of the data obtained. Both stages need their own legal basis.

The governing law in Germany is the TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz); the cookie rule is set out there in § 25. According to the guidance on digital services of the Conference of German Data Protection Authorities (v1.2, November 2024, para. 6), § 25 TDDDG corresponds in substance to its predecessor provision; what changed was the terminology ('digital services' instead of 'Telemedien').

Two-stage test:

1. Stage 1 — § 25 TDDDG: May I store or read anything on the user's terminal equipment at all? Under § 25(1) TDDDG, the storage of information in the end user's terminal equipment and access to information already stored are permitted only if the end user has consented on the basis of clear and comprehensive information; information and consent must follow the requirements of the GDPR. Without consent, only the two cases of § 25(2) TDDDG remain: where the sole purpose is carrying out the transmission of a message, or where access is strictly necessary in order to provide a digital service expressly requested by the user.
2. Stage 2 — Art. 6 GDPR: If so, may I process the data afterwards? Art. 6(1) GDPR permits processing only if at least one of six lawful bases is met: consent (a), contract or pre-contractual measures (b), legal obligation (c), vital interests (d), public interest or official authority (e), legitimate interests (f). Point (f) does not apply to processing carried out by public authorities in the performance of their tasks.

Both stages must have separate legal bases. § 25 allows only two routes: technical necessity or consent. Legitimate interest (Art. 6(1)(f)) is NOT sufficient for § 25. Where consent is the route, Art. 6(1)(a) GDPR comes into consideration as the legal basis at stage 2.

2. ECJ + BGH: what has been decided

Short answer: Five leading decisions shape banner practice: ECJ C-673/17 Planet49 (pre-ticked checkbox ineffective), Federal Court of Justice (BGH) I ZR 7/16 Cookie II (opt-in mandatorily transposed into German law), ECJ C-252/21 Meta-Bundeskartellamt (personalised advertising not 'necessary for a contract'), Higher Administrative Court of Lüneburg (OVG Lüneburg) 14 LA 1/24 (visually highlighted 'Accept' button as a dark pattern) and ECJ C-446/21 Schrems advertising (targeting restrictions for sensitive data).

Two things follow from this for the configuration. First, the default setting: all categories requiring consent start deactivated (default off, ECJ C-673/17 Planet49). Second, the special case of sensitive data: under Art. 9(1) GDPR, the processing of data revealing, for example, ethnic origin, political opinions or religious beliefs, as well as the processing of health data or data concerning sex life, is prohibited in principle; exemptions are set out in Art. 9(2) GDPR, among them explicit consent. Advertising targeting that addresses such characteristics or infers them from profiles therefore needs a separate assessment.

3. 7 banner obligations in 2026

Short answer: In 2026, a cookie banner must meet seven obligations: banner before every non-essential tag, equal choice (accept/reject equally large and prominent), granular category selection, transparent display of purpose/provider/third-country transfer/storage period per cookie, withdrawal as easy as consent (Art. 7(3) GDPR), demonstrable consent logging (Art. 7(1) GDPR) and re-consent when the tag set changes.

1. Show the banner before every non-essential tag — not a single non-essential tag may fire before the selection; verify this in a fresh browser profile without existing cookies (audit point 1). Why: § 25(1) TDDDG places consent before the storing and reading itself; whether the data is evaluated later is a separate question under Art. 6 GDPR. Reference: § 25(1) TDDDG
2. Equal choice: accept/reject equally large, equally coloured, same contrast. Why: Visually highlighting the 'Accept' button has been objected to as a dark pattern (OVG Lüneburg 14 LA 1/24, see section 2). Test step: both options on the same level, same area, same contrast.
3. Granular: categories (statistics / marketing / external media) selectable individually. Why: Information and consent must follow the requirements of the GDPR under § 25(1) TDDDG — a blanket approval across all categories cannot be controlled by the user, only accepted. Reference: § 25(1) TDDDG
4. Transparency: purpose, provider, third-country transfer, storage period visible per cookie. Why: § 25(1) TDDDG makes consent dependent on clear and comprehensive information; the safeguard for the third-country transfer additionally belongs in the documentation (section 8). Reference: § 25(1) TDDDG
5. Withdrawal as easy as consent (Art. 7(3) GDPR) — practice recommendation: a re-open link in the footer. Why: The data subject may withdraw at any time, and the withdrawal must be as easy as giving consent; the lawfulness of processing carried out up to the withdrawal remains unaffected. Reference: Art. 7(3) GDPR
6. Consent logging: who/when/which status — retain for 3 years (burden of proof). Why: Art. 7(1) GDPR requires the controller to be able to demonstrate the consent. Note: The retention period of 3 years is a practical recommendation derived from evidentiary needs — Art. 7(1) GDPR requires demonstrability but sets no time limit. Reference: Art. 7(1) GDPR
7. Re-consent after 6-12 months or when the tag set changes. Note: This too is a practical rhythm, not a statutory time limit — there is no statutory period of validity for consent (see the FAQ for the classification). Independent of the rhythm is the triggering event: if the tag set changes, the old information no longer covers the new situation — consent must then be obtained afresh (§ 25(1) TDDDG).

4. Dark patterns that become expensive

Short answer: Authorities and courts sanction five typical dark patterns: a highlighted consent button, a cookie wall without an equivalent alternative, hidden rejection, tracking based on legitimate interest, scrolling as consent. The compliant alternative is given for each pattern.

• 'OK' button in colour + 'More options' as a grey link — conflicts with the equal-choice principle (section 3, obligation 2); on visual highlighting as a dark pattern see section 2. Instead: both options as equivalent buttons on the first level.
• Cookie wall without a pay alternative — EDPB Opinion 08/2024, ineffective. Instead: a genuinely equivalent alternative with a transparent price.
• Hidden rejection behind several clicks — conflicts with the equal-choice principle (section 3, obligation 2); for the fine range see section 9. Instead: 'Reject' at the same click depth as 'Accept'.
• 'Legitimate interest' for tracking — § 25 TDDDG requires consent, not legitimate interest. Instead: obtain consent or remove the tag; without consent, only the two exemptions of § 25(2) TDDDG remain.
• 'By continuing to scroll' you consent — no active act, ineffective. Instead: wait for an active selection; until then no non-essential tag loads.

5. Tools comparison (DACH market)

Short answer: The table compares five banner tools offered in the DACH region: Borlabs Cookie, Cookiebot, Usercentrics, Iubenda and Real Cookie Banner. It gives the entry price, server location (with a self-hosting note where available), TCF 2.2 support (only Cookiebot and Usercentrics) and a usage recommendation for each tool. Whether a tool carries your obligations is additionally decided by three points below the table.

The price and feature details in this table reflect the status of the previous version of this article (as at 2 May 2026) — terms change, so check them with the provider before making a selection.

Irrespective of the product, three points decide whether the tool carries your obligations: demonstrability (can it be evidenced per user, point in time and category what was consented to?), processing on your behalf (does the provider process data on your behalf?) and the third-country element (where does the data flow, and under which safeguard?). What this entails in terms of documentation and contractual obligations is set out in section 8.

6. 12-point banner audit

Short answer: The audit examines banner delivery, equality of choice, transparency per cookie, withdrawal, consent storage and tag manager configuration in twelve points. Two points are knock-out criteria: if a tag loads before the selection (point 1) or the tag manager default is not set to denied (point 10), the rest of the configuration has no effect.

1. Does the banner appear BEFORE every marketing tag?
2. Is 'Reject' as prominent as 'Accept'?
3. Are granular categories (at least 3) selectable?
4. Per cookie: are provider, purpose and storage period visible?
5. Is the third-country transfer (USA, UK) communicated explicitly?
6. Is there a re-open link in the footer ('Cookie settings')?
7. Is the consent stored in the CMP (practice: 3 years, classification in section 3)?
8. Is re-consent logic provided for as a practical rhythm of 6-12 months (no statutory time limit, classification in section 3)?
9. Is the banner testable on mobile (equal choice in portrait)?
10. Tag manager integration: default = denied?
11. Is Google Consent Mode v2 implemented?
12. Is the privacy notice linked and visible?

Check points 1 and 10 first — the test step in a fresh browser profile is described in section 3, obligation 1; the provision behind it is § 25(1) TDDDG. Points 7 and 8 are questions of proof and rhythm (classification in section 3). Practical rhythm (recommendation, no statutory time limit): repeat the audit quarterly and additionally on an event basis as soon as a tag, a service provider or a category is added.

7. Austria: § 165 TKG 2021 instead of § 25 TDDDG

Short answer: § 25 TDDDG does not apply in Austria — access to terminal equipment is governed there by § 165 TKG 2021, which likewise requires opt-in for tracking cookies. The GDPR applies directly in both countries; Art. 6, Art. 7 and Art. 9 GDPR apply there unchanged. What differs is the national superstructure: the permitting provision, the supervisory authority and the supplementary national penalty provisions.

The following table gives the relevant provision for each jurisdiction.

Newsletter dispatch is not part of the banner — in Austria it is governed by Art. 6 GDPR and § 174 TKG 2021 (unsolicited messages), with consent or double opt-in. Practical recommendation for sites serving both jurisdictions: keep the banner configuration uniform, but document the permitting provision and the competent authority separately for each country.

8. Documentation: what the supervisory authority wants to see

Short answer: The banner is only the visible half. What must additionally be demonstrable is the consent itself (Art. 7(1) GDPR), the operation in the record of processing activities (Art. 30 GDPR), the contract with the service provider where it processes on your behalf (Art. 28 GDPR), the timely response to data subject requests (Art. 12(3) GDPR) and — if your tracking setup is likely to result in a high risk — the data protection impact assessment itself (Art. 35(1) GDPR).

• Proof of consent: Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented Art. 7(1) GDPR. That is the statutory root of the consent log from section 3.
• Entry in the record of processing activities: The cookie banner is one of the typical processing activities of an SME. Among the items to be included are categories of recipients, third-country transfers together with the safeguard (standard contractual clauses, Data Privacy Framework, binding corporate rules), envisaged erasure periods and the reference to the technical and organisational measures concept — details in the article Creating a record of processing activities.
• Processing on your behalf: Where the consent management platform or the analytics tool processes personal data on your behalf, you may only work with processors providing sufficient guarantees Art. 28(1) GDPR, and you need a contract with the minimum content under Art. 28(3) GDPR — subject matter, duration, nature and purpose of the processing, types of data, categories of data subjects, obligations and rights of the controller.
• Data subject requests: If someone asks about their consent data, the time limit of Art. 12(3) GDPR applies: without undue delay and in any event within one month of receipt; an extension by two months where the request is complex or where there are numerous requests, but only with notification including the reasons within the first month.
• Check the impact assessment: Whether your tracking setup triggers a data protection impact assessment is decided by Art. 35(1) GDPR (likely high risk) on the basis of the standard examples in paragraph 3 — systematic and extensive evaluation of personal aspects producing legal effects, processing on a large scale of special categories, systematic monitoring of a publicly accessible area on a large scale.

In supervisory proceedings, the order of review in our experience follows a recurring pattern (practical observation, not an official requirement): record of processing activities, then processor contracts, then the technical and organisational measures concept, then the data protection impact assessment. Anyone who has built the banner cleanly but documented it nowhere already falls down at the first step.

9. Fine range and competence

Short answer: Which fine range applies depends on the type of infringement. Infringements of the principles of processing, of the legal bases and of the conditions for consent (Art. 5, 6, 7, 9 GDPR) as well as of data subject rights (Art. 12 to 22 GDPR) fall under Art. 83(5) GDPR — up to EUR 20 million or 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. Infringements of obligations under, among others, Art. 25 to 39 GDPR — including processing on behalf, the record and the impact assessment — fall under Art. 83(4) GDPR with up to EUR 10 million or 2 %.

Alongside Art. 83 GDPR, the TDDDG contains its own administrative offence: anyone who, contrary to § 25(1) sentence 1 TDDDG, stores information or accesses information commits an administrative offence (§ 28(1) no. 13 TDDDG); the fine is up to EUR 300,000 (§ 28(2) TDDDG). What matters in practice is the design of the banner: no storing or reading before consent, 'Reject' equivalent to 'Accept', and a demonstrable consent log (sections 3 and 6).

In Germany, competence for non-public bodies — that is, for company websites — lies with the authority competent under Land law (§ 40(1) BDSG). The Federal Commissioner for Data Protection (BfDI) is competent only for federal public bodies and certain providers of telecommunications services (§ 9(1) BDSG). In Austria, the Austrian Data Protection Authority (Datenschutzbehörde) is established as the national supervisory authority under Art. 51 GDPR (§ 18(1) DSG) and also decides on the administrative penalties under § 62 DSG.