Cookie Consent Requirements in Germany

What the Law Says

Germany enforces EU cookie law through national implementation and case law, prioritizing user autonomy and transparency.

Under Art. 5(3) of the ePrivacy Directive (implemented via § 25 of the German Telemedia Act – TMG), storing or accessing information on a user’s device (e.g., cookies) requires prior, freely given, specific, and informed consent — unless strictly necessary for service provision. The GDPR (DSGVO) applies as the overarching legal basis, requiring consent to meet Art. 4(11) and Art. 6(1)(a) standards: unambiguous, revocable, and documented.

The German Federal Court of Justice (BGH) confirmed in its landmark 'Planet49' ruling (BGH, Judgment of 28 May 2020 – I ZR 7/16) that pre-ticked checkboxes are invalid, and consent must be actively given. Further, the Bavarian DPA (BayLDA) and other state authorities (e.g., LfDI Baden-Württemberg) have issued guidance stating that ‘cookie walls’ (blocking access without consent) generally violate GDPR principles of fairness and necessity.

Statutory Text

Consent must be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s wishes.

— DSGVO, Art. 4(11)

Statutory Text

Pre-ticked boxes do not constitute valid consent under the GDPR.

— ECJ, C-673/17 Planet49, para. 67

What to Do

Sources

Related Questions