Cookieless Marketing Future 2026+: 5 GDPR-Compliant Strategies

Main article: Cookie banner § 25 TDDDG — the requirements for the cookie banner under § 25 TDDDG and Art. 6 GDPR at a glance.

Germany / Austria: The permissive rule for storing information on terminal equipment and accessing it is set nationally — in Germany § 25(1) TDDDG (supervision: the competent state data protection authority), in Austria § 165 TKG 2021 (supervision: the Austrian Data Protection Authority (Datenschutzbehörde), § 18(1) of the Austrian Data Protection Act (DSG)). Both implement Art. 5(3) of Directive 2002/58/EC. The substantive standard for consent is identical in both countries, because it follows directly from the GDPR (Art. 6(1)(a), Art. 7 GDPR).

Legal framework: § 25 TDDDG and Art. 6 GDPR

Each of the five strategies has to pass two separate assessments — one does not replace the other. In Germany, § 25 TDDDG first decides whether anything may be stored in the terminal equipment or read from it at all; only afterwards does Art. 6(1) GDPR decide on the subsequent processing of the personal data.

§ 25(1) TDDDG permits the storage of information in the end user's terminal equipment and access to information already stored there only if the end user has consented on the basis of clear and comprehensive information; information and consent have to be provided in accordance with the GDPR. § 25(2) TDDDG requires no consent in two cases: where the sole purpose is carrying out the transmission of a message, or where access is strictly necessary in order to provide a digital service expressly requested by the user. This stage therefore knows only two routes: technical necessity or consent. A legitimate interest under Art. 6(1)(f) GDPR does not carry it — relying on it is a recurring audit finding with banners.

Since 14 May 2024 the statute has been called the TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz); the substance of § 25 is unchanged compared with the previous version. The second stage follows from Art. 6(1) GDPR: processing is lawful only if at least one of the six legal grounds is met — consent, contract, legal obligation, vital interests, public interest or legitimate interest.

Austria: § 165 TKG 2021 instead of § 25 TDDDG

In Austria, § 165 TKG 2021 takes the place of § 25 TDDDG and likewise requires an opt-in for tracking cookies; supervision there lies with the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG). This article sets out assessment steps 1 and 2 for Germany only; for Austria, the wording of § 165 TKG 2021 has to be applied. Steps 3 to 5 follow directly from the GDPR and apply identically in both countries.

1. Pirsch / Plausible (cookieless analytics)

Cookieless analytics starts at the first assessment stage: server-side counting without cookies. According to the providers, Pirsch hosts in Germany, Plausible in the EU. Whether a setup can do without consent is not decided by the product category, but by the case-by-case assessment under § 25(1) TDDDG: what matters is solely whether information is stored in the terminal equipment or read from it. Check this specifically for your installation — a practical route: open the browser developer tools, look under Application or Storage to see whether cookies, localStorage or sessionStorage are set, add the provider's statements on storage in the terminal equipment, and record the result with a date in the record of processing activities. Matomo is typically run self-hosted — what has to be assessed is then your own installation, not a provider's. For Fathom, the hosting location must be clarified before use; the assessment standard is the same.

That does not remove the second stage — on the order of assessment, see above. Web analytics belongs in the record of processing activities as a processing activity in its own right: with purpose, categories of data subjects and of data, recipients, envisaged erasure periods and a reference to the concept of technical and organisational measures (Art. 30(1) GDPR). In practice, the legal basis is kept as an additional field, because it is not named in Art. 30(1) but follows from the Accountability requirement in Art. 5(2) GDPR.

If consent is chosen as the basis, the controller must be able to demonstrate that consent was given (Art. 7(1) GDPR), and withdrawal must be as easy as giving consent (Art. 7(3) GDPR). If another ground is chosen instead, that choice has to be reasoned for each purpose and recorded in the record of processing activities.

2. Server-side tracking via GTM

A server-side setup shifts the data processing, not the assessment standard. With a server-side tag manager, the data runs via your own server instead of going directly from the browser to the tool providers. That reduces losses caused by ad blockers and gives you more control over the data flow. As long as information is stored in the terminal equipment or read from it, the first stage remains applicable; by its wording, § 25(1) TDDDG refers solely to the storage of information in the terminal equipment and to access to information already stored there — the provision contains no criterion concerning the location of the evaluating server. The object to be assessed here is different from analytics: whether the server-side setup sets its own cookie via your domain or places an identifier in localStorage. The result is documented as described above.

In practice, server-side tracking leads to an additional contractual layer. Anyone having the server operated by a service provider may only work with Data Processors providing sufficient guarantees of appropriate technical and organisational measures (Art. 28(1) GDPR). The data processing agreement must set out the subject matter and duration, the nature and purpose of the processing, the type of data, the categories of data subjects and the obligations and rights of the controller (Art. 28(3) GDPR).

Two points come up regularly in audits: Third Country transfers together with their safeguards must appear in the record of processing activities — in practical experience, a missing Third Country reference for US tools is one of the frequent record-keeping errors — and the Third Country transfer must be communicated explicitly in the banner. For the tag manager integration, the check point is that the default state of all consent signals is "denied" — see section 5 on this.

3. First-party customer data platform (CDP)

A CDP bundles profiles — and with them the obligations. An in-house data platform takes the place of tracking via third-party providers; tools used for this include Segment or RudderStack (open source). Before use, it must be clarified for the specific platform where processing takes place and who acts as a Data Processor: if a Third Country is established, the transfer and the safeguards belong in the record of processing activities, and the same data processing agreement under Art. 28(1) and (3) GDPR applies as with the server-side tag manager. For every purpose for which data is combined, a separate ground under Art. 6(1) GDPR has to be determined; the purpose belongs in the record of processing activities as mandatory information (Art. 30(1) GDPR), while the legal basis is added — as above — as a practice field.

Two leading decisions limit the room for manoeuvre here. In C-252/21 (Meta/Bundeskartellamt, 2023) the CJEU held that "necessary for the performance of a contract" is to be interpreted narrowly — on that basis, personalised advertising is not necessary for a contract. In C-446/21 (Schrems advertising, 2024) it held that sensitive data may not be inferred from advertising profiles; such data is in any event subject to the general prohibition on processing in Art. 9(1) GDPR, with narrow exceptions.

Beyond a certain depth, the platform itself becomes subject to assessment: a data protection impact assessment is required in particular for a systematic and extensive evaluation of personal aspects producing legal effects, for processing on a large scale of special categories of data, or for systematic monitoring of publicly accessible areas on a large scale (Art. 35(1) and (3) GDPR). In Germany, the obligation to designate a data protection officer under § 38(1) of the German Federal Data Protection Act (BDSG) applies, alongside the threshold of as a rule at least 20 persons constantly engaged in automated processing, also irrespective of the number of persons — namely where processing operations are subject to a data protection impact assessment, or where data is processed commercially for the purpose of transfer, of anonymised transfer or for purposes of market or opinion research. Austria has no additional numerical threshold; the designation obligation follows there directly from Art. 37 GDPR.

4. Contextual targeting

Context-based delivery shifts the connecting factor from the person to the page. Delivery follows the content of the page requested, not characteristics of the person; no tracking of the person takes place. That defuses exactly the question on which person-related advertising legally turns: under CJEU C-252/21, personalised advertising cannot be based on "performance of a contract" (Art. 6(1)(b) GDPR), and for access to terminal equipment § 25(1) TDDDG requires consent, for which a legitimate interest is not sufficient.

The assessment standard does not fall away as a result, it merely becomes shorter. In practice it is worth looking at three delivery components, which have to be assessed as to whether they place information in the terminal equipment or read it: frequency capping (in so far as it uses a counter per device), click and view measurement via pixels with an identifier, and A/B tests of the creative. Where that is the case, § 25(1) TDDDG remains applicable and consent is therefore required, unless one of the two exceptions in § 25(2) TDDDG applies. If, by contrast, neither a counter nor an identifier is placed in the terminal equipment or read from it, this stage is not engaged — the finding has to be documented for each campaign setup. Where personal data is processed, the second stage applies in addition.

In substance, the limit in Art. 9(1) GDPR applies here too: sensitive characteristics — such as health, religious or philosophical beliefs, sexual orientation — are subject to the general prohibition on processing with narrow exceptions; under CJEU C-446/21 they may in particular not be inferred from advertising profiles. The purpose of every campaign processing operation belongs in the record of processing activities as mandatory information (Art. 30(1) GDPR); the legal basis is added — as above — as a practice field.

5. Google Consent Mode v2

Consent Mode v2 is the technical implementation of a consent decision, not a substitute for it. The default state of all consent signals is "denied". With consent, complete data is transmitted; without consent, only aggregated and modelled data is transmitted, the lawfulness of which continues to follow the order of assessment set out above.

The validity of the consent itself continues to be governed by § 25(1) TDDDG and the GDPR. It requires clear and comprehensive information and an active step: a pre-activated checkbox is not consent (CJEU C-673/17, Planet49, 2019); the Federal Court of Justice (BGH) adopted this line into German law with I ZR 7/16 (Cookie II, 2020). "Accept" and "Reject" must be equally prominent — a visually emphasised accept button was assessed as a dark pattern by the Higher Administrative Court of Lüneburg (OVG Lüneburg) (14 LA 1/24, 2025). The categories must remain individually selectable, and withdrawal must be as easy as giving consent (Art. 7(3) GDPR), in practice via a re-open link in the footer.

For evidence, Art. 7(1) GDPR applies: the controller must be able to demonstrate that consent was given. There is no statutory validity period for consent; the Datenschutzkonferenz (conference of the German data protection supervisory authorities) likewise names no fixed period in its guidance on digital services (Orientierungshilfe Digitale Dienste, v1.2, November 2024, para. 63), referring to EDPB Guidelines 05/2020 (para. 110) — consent has to be obtained afresh where the specific case changes, and a re-consent after 6 to 12 months is a practice rhythm. As a practice recommendation — not as a statutory period — consent logging over 3 years has become established.

For every row of the following table the following applies: as soon as there is access to the terminal equipment and neither of the two exceptions in § 25(2) TDDDG applies, consent under § 25(1) TDDDG is required.

Documentation and evidence in the event of a supervisory enquiry

In the event of a supervisory enquiry, the record of processing activities comes first; in audit practice the data processing agreement, the concept of technical and organisational measures and the data protection impact assessment follow. The enquiring body is, in Germany, the data protection supervisory authority competent for non-public bodies under state law (§ 40(1) BDSG), and in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG). Art. 30(4) GDPR requires the record to be made available "on request"; the expectation of transmission within 1 to 2 weeks is an empirical value from practice, not a period set by the provision. Keep the documents complete in advance, therefore, rather than producing them only on request — anyone unable to deliver on the record has no basis for the remaining layers.

The concept of technical and organisational measures is not a buzzword here but a document in its own right: it contains the general description of the technical and organisational measures under Art. 32(1) GDPR. Only the reference to it appears in the record of processing activities — one central concept for all processing operations, not a separate one per processing activity; copying the content of those measures into the record instead of referring to it is one of the frequent record-keeping errors. The concept is assessed by whether it fits the risk situation of the documented processing operations.

The exception in Art. 30(5) GDPR is of little help here: it applies only cumulatively — fewer than 250 employees and no risk to the rights and freedoms of data subjects and no regular processing and no special categories under Art. 9 or criminal-law data. The official wording refers to "a risk", not to a high risk; the "high risk" threshold applies only to the data protection impact assessment under Art. 35(1) GDPR. Personnel data, CRM and newsletters are regular processing operations — which means the exception is almost never applicable in practice.

Market assessments: what remains to be watched in 2026

The following points are market and future assessments, as at the original version (2 May 2026) unless stated otherwise. They are not legal statements; the legal classification is given with each of them.

• Google Privacy Sandbox / Topics API: not yet final, to be watched in 2026/27. That changes nothing about the order of assessment: as long as information is stored in the terminal equipment or read from it, § 25(1) TDDDG remains applicable.
• Cookie banner effort: tools that neither store information in the terminal equipment nor read it from there do not require consent under § 25(1) TDDDG — the banner becomes leaner by these tools. Whether that is the case is decided by the assessment for each tool; for the subsequent processing, Art. 6(1) GDPR remains decisive.
• Digital Omnibus: On 19 November 2025 the European Commission proposed simplifying the digital legal framework, amending among others the GDPR and the ePrivacy Directive (procedure 2025/0360(COD)). As at 17 August 2026 no legal act was in force; until the legislative procedure has been completed, the existing legal framework continues to apply unchanged — the provisions named above remain decisive in their applicable version.

In practice this means: set a review date for these points and, on every change, check only two questions — does anything change as to whether information is stored in the terminal equipment or read from it (§ 25(1) TDDDG), and does the legal ground for the subsequent processing change (Art. 6(1) GDPR)? Until then, the order of assessment set out above remains applicable unchanged. As a practice rhythm — not as a statutory period — the same cadence suggests itself as is customary for the record of processing activities anyway: a quarterly review, plus an ad hoc review for new tools or new Data Processors. Next editorial review of this section: fourth quarter of 2026.