By country

Cookie Policy Generator Germany

GDPR plus BDSG, the TDDDG cookie rules, the Impressum duty and a live Abmahnung industry.

Generate your cookie policy Read the cookie policy guide

§ 25 TDDDG is the operative German cookie rule and it applies to any storage or access on a device, not just cookies. The Datenschutzkonferenz guidance sets the bar for what the banner has to look like, and the policy has to describe the banner you actually run.

Germany is the strictest practical market in the EU, not because GDPR reads differently there but because three extra layers sit on top. The Bundesdatenschutzgesetz fills the GDPR opening clauses, the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, formerly TTDSG) governs cookies in § 25, and the Digitale-Dienste-Gesetz carries the Impressum duty in § 5.

Enforcement is also decentralised. Sixteen state authorities plus the federal commissioner supervise different sectors, and they coordinate through the Datenschutzkonferenz rather than acting as one body. Guidance that is settled in one Land is sometimes still contested in another.

The distinctive German risk is private enforcement. Competitors and Abmahnvereine send cease-and-desist letters with cost demands over a missing Impressum, an unlawfully embedded Google Font or a cookie banner without a same-level reject button. That happens on a timescale of weeks, long before any regulator would act.

What a cookie policy in Germany has to cover

The § 25 TDDDG basis, distinguished from the GDPR basis for the processing that follows
A per-cookie table in German with provider, purpose, category and duration
Reject at the same level as accept, with no pre-ticked boxes and no consent by scrolling
Self-hosted versus remote assets, since remote loading is itself the disclosure that matters
Consent lifetime and the permanent settings link

How Germany actually moves personal data

Google Fonts and other remote assets

A Munich court held that loading Google Fonts from Google’s servers transmits the visitor’s IP address without a basis. Self-hosting fonts, maps and scripts is now the German default, and the policy should say which assets are self-hosted.

Employee data under § 26 BDSG

German employment processing has its own basis and its own limits, and works council co-determination applies to any tool capable of monitoring performance - which includes most analytics and ticketing systems.

Payment by Rechnungskauf and SEPA direct debit

Buy-now-pay-later and invoice purchase are dominant in German e-commerce and involve creditworthiness checks by SCHUFA or Creditreform, which is a disclosure and an Article 22 question at the same time.

Consent records under § 25 TDDDG

The burden of proving consent sits with you, and German courts have been willing to look at the actual banner implementation rather than the policy’s description of it.

Newsletter double opt-in

German case law effectively requires confirmed opt-in with a logged confirmation email. Single opt-in lists are the ones that generate Abmahnungen.

Third parties the draft will ask you about

Stripe · Klarna · PayPal · SCHUFA · DHL · Hetzner · IONOS · Matomo · CleverReach · Datev

The rules that apply

GDPR + BDSG

The BDSG carries German rules on employee data (§ 26), video surveillance, and the threshold at which a Datenschutzbeauftragter becomes mandatory.

§ 25 TDDDG

Consent before storing or accessing information on a device, with a narrow strictly-necessary exemption. This is the German cookie rule, and it is not GDPR.

§ 5 DDG - Impressum

A complete legal notice with company form, register number, VAT ID, managing directors and a contact route. Missing it is the most-abmahnt defect on the German web.

Mandatory data protection officer

Required where twenty or more people are constantly engaged in automated processing, or where processing needs a DPIA - a far lower bar than the GDPR default.

Widerrufsbelehrung

Distance-selling cancellation instructions in the statutory form. Getting the wording wrong extends the cancellation window from fourteen days to twelve months.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

The German checklist

Publish a complete Impressum
Company name and legal form, address, contact, register court and number, VAT ID, and the person responsible for editorial content where you publish one.
Self-host every third-party asset you can
Fonts, icon sets, maps and analytics. Anything that phones home before consent is a live risk.
Check the DPO headcount threshold
Count everyone who regularly handles personal data automatically - including part-timers and contractors.
Use the statutory cancellation wording
Copy the model Widerrufsbelehrung and model withdrawal form rather than rewriting them.
Log double opt-in confirmations
Keep the confirmation email, timestamp and IP for every subscriber; it is the evidence that ends a marketing complaint.

Where this usually goes wrong

No Impressum, or an incomplete one

It must be reachable in two clicks from every page and carry the register court, register number, VAT ID and representative. This is the single most common cause of a German cease-and-desist letter.

Loading fonts, maps or scripts from US servers before consent

Each remote asset transmits an IP address. German courts have awarded damages for exactly this, and the fix - self-hosting - is cheaper than the letter.

A cookie banner where reject is a text link

Under § 25 TDDDG the German authorities expect reject at the same level as accept. The DSK guidance is explicit.

Not appointing a Datenschutzbeauftragter when the headcount rule bites

Twenty people regularly processing personal data by automated means triggers the duty regardless of company size, and the appointment must be notified to the state authority.

Wrong Widerrufsbelehrung wording

The cancellation instruction is prescribed almost word for word. A paraphrase extends the withdrawal period to a year and is independently actionable.

Frequently asked questions

Do I need a German-language privacy policy?

If you address the German market, yes in practice. Transparency under Article 12 requires plain, intelligible language for the audience, and German courts have treated English-only notices aimed at German consumers as failing that test.

What is an Abmahnung?

A formal cease-and-desist letter, usually from a competitor or an association, demanding you stop a practice and pay their legal costs. It is a private enforcement mechanism with no regulator involved, and it moves in weeks.

Is Google Analytics legal in Germany?

It can be, with consent obtained before the tag fires, IP anonymisation configured, a processor agreement in place and a documented transfer assessment. What is not defensible is loading it on page one before any consent.

When do I need a Datenschutzbeauftragter?

When twenty or more people are constantly engaged in automated processing of personal data, or when your processing requires a DPIA, or when you process for commercial transfer or market research. The threshold is German, not GDPR.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.