On 1 December the German Telecommunications and Telemedia Data Protection Act, the TTDSG, comes into force. For most website owners it changes less in substance than the noise suggests. It still changes enough to justify a serious look at your banner.
What applies from 1 December
The heart of it fits into one section. If you store information on a user's device, or read information already stored there, you need consent. Whether that information is personal data no longer matters. There are two exceptions: transmitting a message, and whatever is strictly necessary to deliver a service the user has explicitly asked for.
The idea is not new. The ePrivacy Directive has said this for years, and in 2020 the Federal Court of Justice spelled it out for Germany in the Planet 49 case. What is new is that it now sits cleanly in German law. Anyone still arguing from the old Telemedia Act loses that argument.
What strictly necessary means, and what it does not
The shopping cart may remember what you put in it. The session cookie that keeps you logged in may be set. So may the language preference the user has just switched themselves.
Not necessary: audience measurement, as soon as it writes anything to the device, and yes, that includes tools you host yourself. Marketing pixels. A/B testing tools. Embedded third-party video players that drop cookies the moment the page loads. All of that needs consent before it loads. Not after.
Rejecting has to be as easy as accepting
Consent only works if it is freely given. A banner where Accept all is a large coloured button and rejection is a grey link in the fine print is not a choice, it is a funnel. Pre-ticked boxes have been dead since Planet 49. A banner you can only get rid of by agreeing, because there is no second path, is not a choice either.
The rule of thumb we work with is unglamorous. On the first layer, one click has to be enough to refuse, exactly as one click is enough to accept. If your banner cannot do that, this is not a problem for some day in the future. It is a job for this week.
What this means for analytics and marketing
You will see less. Depending on your audience, a substantial share of visitors will refuse, and those visitors disappear from your reports. That hurts, especially when budgets hang off those curves.
The obvious reflex is to keep tuning the banner until the acceptance rate looks healthy again. We think that is the wrong road, and not only for legal reasons. Consent obtained by pressure is not consent, and the numbers it produces are not worth much either.
Why clean consent makes your data more honest
That sounds backwards, but it matches our experience. Once you know you are only measuring part of your traffic, you stop treating absolute numbers as truth. You start reading ratios and movements instead, and you lean on the data you already hold cleanly: enquiries, orders, revenue. None of that needs a single cookie.
The side effect is a more honest conversation in marketing. Anyone judging a campaign purely by sessions was rarely measuring the thing that mattered anyway.
The banner is the symptom
What bothers us about the whole debate: everyone talks about the banner, almost nobody about what sits underneath it. The banner is simply the bill for a website that pulls in forty things nobody can still account for.
So we work in the other direction. First, remove everything that serves no purpose: the map widget nobody uses, the font loaded from a foreign server, the third tracking tool left over from an agency phase three years ago. What remains is usually so little that the banner can be small and honest. How we build sites that load lightly from the start is part of our web development.
Frequently asked questions
Do I need fresh consent from every visitor on 1 December?
If your existing consent already meets the requirements, meaning it was active, informed and given separately per purpose, you can build on it. If it came from a pre-ticked box or a mere notice banner, it will not hold.
Does this apply if I host my analytics myself?
As soon as something is written to or read from the device, yes. Who operates the tool is beside the point. Measurement that works purely from server-side log data falls outside the rule.
Is a notice saying that continued browsing implies agreement enough?
No. Scrolling is not consent. That was already true before, and the TTDSG does not improve it.
If you are unsure whether your banner holds up, we will look at it with you before somebody else does. A conversation, with no obligation and no sales pressure.
This article is part of our knowledge hub Online marketing.