Edip Kilinc is the founder of Webwavers. Together with his team, he develops websites, brands, and digital presences for ambitious companies – with over 250 completed projects, and honored with awards including the German Design Award 2026.
Cookie banners are usually justified with the GDPR. However, the relevant standard in Germany is § 25 TDDDG – the Digital Services Data Protection Act, which replaced the TTDSG in 2024.
The difference is practically relevant: Section 25 requires consent for any access to information in the user's terminal equipment – regardless of whether personal data is processed in the process. This affects cookies, but also local storage, fingerprinting, and the reloading of scripts that read out information.
The GDPR applies after that: it regulates what may be done with the collected data.
This leads to a common misconception: a service that allegedly does not collect personal data is not automatically exempt from consent. The decisive factor is whether it accesses the terminal equipment.
The exception is specified in Section 25 (2): technically strictly necessary to provide the service requested by the user.
Cookie banners are usually justified with the GDPR. However, the relevant standard in Germany is § 25 TDDDG – the Digital Services Data Protection Act, which replaced the TTDSG in 2024.
The difference is practically relevant: Section 25 requires consent for any access to information in the user's terminal equipment – regardless of whether personal data is processed in the process. This affects cookies, but also local storage, fingerprinting, and the reloading of scripts that read out information.
The GDPR applies after that: it regulates what may be done with the collected data.
This leads to a common misconception: a service that allegedly does not collect personal data is not automatically exempt from consent. The decisive factor is whether it accesses the terminal equipment.
The exception is specified in Section 25 (2): technically strictly necessary to provide the service requested by the user.
Cookies and comparable technologies without which the service does not function are technically necessary. These typically include:
Session cookies, which maintain a login or a shopping cart.
The cookie that stores the consent decision – otherwise, a request would have to be made with every page view.
Language settings chosen by the user.
Security functions such as protection against form abuse.
Load balancing on the server.
Not technically necessary are: statistics and reach measurement, marketing and advertising, embedded videos from third-party providers, map services, fonts from external servers, chat windows, social media integrations, and A/B testing tools.
The most common mistake in practice: statistics services are classified as necessary because they are important to the operator. However, necessary refers to the service that the user has requested – not to the interest of the operator.
The requirements arise from the GDPR and case law. Six points:
Equal choice. Rejecting all must be on the same level as accepting all – not only after a click on settings.
Identical design. Both buttons should be of comparable size, color, and prominence. A gray reject link next to a green accept button is vulnerable to challenge.
No pre-selection. Boxes for non-essential purposes are unchecked by default.
No continuing to click as consent. Scrolling or navigating further does not constitute consent.
Withdrawal possible at any time, just as easily as giving consent. A permanent link in the footer is common.
Information before the decision. What purposes, what providers, what storage duration, third-country transfer yes or no.
What is not permitted: showing the banner only after scripts have already been loaded. This happens more often than one might think and is the error with the largest surface area for attack.
The most effective measure is not a better banner design, but fewer services requiring consent.
Three steps:
1. Inventory. Open the developer tools in the browser, network tab, and see which external connections your page establishes. For most websites, the list is longer than expected – fonts, maps, videos, icons, analysis tools, a forgotten chat tool.
2. Delete. For each service, the question is: Do we really need this? A map service on the contact page can be replaced by an image with a link. An embedded video can be replaced by a preview image that only loads after a click.
3. Replace. Integrate fonts locally instead of from an external server. Replace statistics with a tool that does not require access to the end-user device – this is possible with some providers and can then be used without consent.
Anyone who only uses technically necessary technologies does not need a consent banner. That means the fastest website, the best user experience, and the smallest attack surface.
The legal perspective often overshadows the economic one. A banner has measurable costs.
Bounces. A banner that covers half the page on the first visit leads to drop-offs – especially on smartphones and especially for visitors from ads you have paid for.
Data gaps. Those who decline are not counted. Depending on the industry, rejection rates are well into the double-digit range. Your statistics then only represent a segment – which must be kept in mind when making decisions based on these figures.
Loading time. Many consent tools are loaded early and block the rendering.
This leads to the same advice as above: the fewer services requiring consent, the smaller the banner, the lower the loss. A banner that only asks for three purposes is accepted more frequently than one with forty providers in a list.
A consent banner is not a set-it-and-forget-it setup.
With every change to the website, check whether new external services have been added. An embedded video, a new form tool, a font change – any of these can alter the legal obligations.
Once a quarter, check the connections that are actually loaded, both before and after consent is given. The most common finding: something is already loading prior to consent.
Check the storage duration of the consent. Six to twelve months is common, after which consent is requested again.
The documentation. Consent must be verifiable – which version of the banner, which purposes, when.
For individual case assessments – especially regarding third-country data transfers and the classification of specific services – specialist legal counsel is advisable. This article does not replace it.
