In short and in plain language
This article is about whether your website needs a cookie banner. That is the notice that asks visitors for consent.
The cookie itself is not what counts. What counts is whether the site accesses the visitor's device. If that is not really needed, you need consent.
Content from other servers is often the reason. Fonts, maps and videos from outside servers pass on data as they load.
A banner with just one button is usually not enough. Saying no must be as easy as saying yes.
Often a site can do without a banner. Then it only loads its own files. You still need a privacy policy. We check what your site loads.
Many trade websites carry a cookie banner that has no business being there, and others are missing one that should be. Both have the same cause: the question of whether the business needs consent at all is rarely asked. It is answered before anyone has looked at what the site actually does. German law does not attach to the word cookie at all, but to a technical event. This article walks through the three questions that decide the matter, and shows the second route most businesses overlook: building the site so the question resolves itself.
Key takeaways
- It is not the cookie that triggers the duty, but the access to the visitor's device. Section 25 paragraph 1 TDDDG requires consent for every storage and every read-out that is not strictly necessary.
- Strictly necessary is meant narrowly: the access has to be needed for the service the visitor explicitly requested. The benefit to the business does not count at this point.
- Content embedded from third-party servers is a frequent trigger. Fonts, maps, videos and review widgets pass data to the outside server as they load, usually without anyone noticing.
- A banner with only one button will usually not hold. Rejecting has to be possible on the same level and with the same weight as accepting, and withdrawal has to be as easy as giving consent.
- The frugal route is often the more economical one: serve your own fonts, show the map as an image with a link, load videos only after a click. The privacy notice stays mandatory, the banner does not.
What the law actually requires
The decisive sentence sits in section 25 paragraph 1 of the German Telecommunications Digital Services Data Protection Act, TDDDG for short. It names neither cookies nor banners. It names two events: storing information in the terminal equipment of the end user, and accessing information already stored there. Terminal equipment is the visitor's device, meaning their phone, their tablet, their computer. By the wording, both are permitted only if the end user has consented on the basis of clear and comprehensive information (TDDDG). Anyone who has read that understands why arguing about individual cookie names misses the point: access is access, whatever the technology behind it is called.
Consent itself follows the General Data Protection Regulation. Its Article 4 point 11 requires a freely given, specific, informed and unambiguous indication of the data subject's wishes (GDPR). Four properties, each of which can sink a banner on its own. Whoever cannot refuse has not decided freely. Whoever does not know what for has not decided specifically. Whoever was not informed has not decided in an informed manner. And whoever merely closed a window has not expressed anything unambiguously.
The sentence it all turns on
What a breach costs is set out in section 28. Storing information or accessing information contrary to section 25 paragraph 1 sentence 1 is an administrative offence, with a fine of up to 300,000 euros (TDDDG). That figure is the theoretical ceiling, not what a trade business would expect to face. Complaints to the supervisory authority and cease-and-desist letters from competitors or associations are far more common in practice. Both cost time and nerves before they cost money.
Almost everyone is affected: 94 percent (Bitkom) of German trade businesses run their own website, and with 1,038,126 (ZDH) registered businesses in Germany that is a very large number of sites, each of which has to answer this question for itself. The good news is that for a lean trade website the answer is often no banner at all.
First question: does the site access the device
Access in the sense of the law is more than a cookie. What is meant is every write into the browser's storage and every read out of it. Cookies are only one of several forms. Alongside them sit the browser's local storage and session storage, where modern scripts keep their data, plus techniques that read out properties of the device to build a recognition value from them. For the legal consequence this makes no difference.
- A cookie is set, whether it lasts an hour or a year.
- A value is placed in, or read from, the browser's local storage or session storage.
- A script reads screen resolution, font list, time zone or graphics characteristics in order to recognise the device again.
- A file embedded from a third-party server sets a marker in the browser as it loads.
- A counting pixel is loaded that deposits an identifier in the browser or reads out an existing one.
What happens exclusively on the server is not covered. A web server usually writes a log line with the time, the address requested and the IP address. That is not access to the terminal equipment and therefore not a section 25 question but a GDPR question: it needs a legal basis, a deletion period and a paragraph in the privacy notice. How that paragraph and the legal notice belong together is set out in the article on the legal notice and privacy notice for trade sites.
Second question: is the access strictly necessary
Section 25 paragraph 2 number 2 TDDDG exempts access that is strictly necessary in order for the provider of a digital service to provide a digital service explicitly requested by the user (TDDDG). Two words carry that sentence. Strictly means: without the access the service does not run, not merely runs less well. Explicitly requested means: the visitor asked for it, not the business. What benefits the business is therefore still a long way from being necessary.
The German supervisory authorities have worked this through in their guidance for providers of digital services. An additional service such as a map section, a chat window or a form does not count as requested simply because someone opened the page (Datenschutzkonferenz). The request has to show itself in a further action, for instance a click on the preview. The overview below sorts the cases that occur often on trade websites.
| What happens on the page | Consent needed? | Why |
|---|---|---|
| Session marker protecting a submitted contact form against double sending | usually no | The visitor used the form explicitly; without the marker this very service does not run. |
| Marker for language or dark mode, set after the visitor clicks | usually no | The access serves only the function the visitor triggered themselves. |
| Shopping basket or login in a protected area | usually no | Without the link to the session there is no requested service. |
| Font pulled from an outside server when the page opens | included | The site can serve the font itself; the outside request is not strictly necessary for the service. |
| Map section that loads by itself when the page opens | included | The map is an additional service the visitor only requests through an action of their own. |
| Visitor measurement, even in shortened or anonymised form | included | Measurement serves the business's own analysis, not the service the visitor asked for. |
| Video loaded only after a click on the preview image | yes, but only at that point | The click is the action to which consent can be attached cleanly. |
Audience measurement is no special case
Third question: does the site load content from outside servers
A frequent trigger on trade websites is not an intention but a side effect. An embedded file loaded from an outside address reveals the visitor's IP address, the page requested and details about the browser to that outside server as it loads. This happens before anyone has clicked anything, and it happens even when the embedded element is not displayed at all.
Zu beachten ist, dass mit der Einbindung von Drittinhalten auf Webseiten regelmäßig eine Offenlegung personenbezogener Daten an Betreiber:innen des jeweiligen Drittservers verbunden ist.
The guidance names advertisements, fonts, scripts, city maps, videos and photos among the typical third-party content (Datenschutzkonferenz). On a trade website it is usually the same five suspects. They are rarely ordered on purpose; they arrive with a template or with an extension module.
- Fonts that do not sit on your own server but are fetched from an outside address when the page opens.
- A map section showing the company address that builds itself as the contact page loads.
- An embedded video with a reference project or a workshop tour that contacts the outside server during page load.
- A review widget that pulls the stars live from an outside server.
- A chat window or callback module that slides in at the bottom right and sets an identifier while doing so.
For each of these cases there are two routes. One is consent: the content loads only once the visitor has agreed. The other is a rebuild: the content comes from your own server, or is replaced by something that does the same job. For the service area a drawn map with the towns as text is often enough, as described in the article on showing your service area. The rebuild has a side benefit that is clearly noticeable on a phone: every removed outside connection saves a name lookup, a connection setup and a transfer, which directly helps the load time on mobile.
If a banner is needed: what it has to do
If something requiring consent remains after the three questions, the banner has to meet the GDPR requirements. A banner that merely looks the part is worse than none: it creates the appearance of a consent that is not valid, and documents the breach at the same time.
Equivalent choice
Rejecting has to sit on the same level as accepting, with comparable labelling and comparable weight. Where no equivalent options for action are offered, the requirements for valid consent are, in the view of the supervisory authorities, regularly not met (Datenschutzkonferenz).
Before the first access
Nothing requiring consent may load beforehand. A banner that appears while fonts and maps are already being fetched in the background arrives too late. The check for this is simple: record the network traffic in the browser before anything has been clicked.
Separated by purpose
Specific means one decision per purpose. Measurement, map and video are three purposes, not one. A blanket agreement to everything at once usually does not meet the specificity requirement.
Withdrawal by the same route
It shall be as easy to withdraw as to give consent (GDPR). Where consent is given directly while using a website, withdrawal has to be possible by that route as well (Datenschutzkonferenz). In practice that means a permanently reachable point that reopens the selection.
The cross in the corner is not agreement
The line of reasoning is older than the German judgment. As early as 2019 the Court of Justice of the European Union held that there is no valid consent where access is permitted by way of a pre-ticked checkbox which the user must deselect to refuse (CJEU). The same decision expressly counts information on the duration of the operation of cookies and on whether third parties may have access to them among the information to be given to the user (CJEU). A banner that only says we use cookies does not meet that.
The second route: the frugal site
For a trade business the rebuild is usually cheaper than the banner. A trade website rarely has functions that strictly require access to the device. It shows services, photos, ways to get in touch and a form. If all of that comes from your own server, the consent question disappears, and with it the banner, its upkeep and the sources of error attached to it.
- Serve fonts yourself instead of fetching them from an outside address on load. The difference is one file in your own directory and one line in the stylesheet.
- Show the map as an image with a caption and put an ordinary link underneath that opens the map service in a new tab. The visitor then decides for themselves.
- Give videos a preview image of your own and load them only after the click, with a short note on what the click will do.
- Take reviews over as text with date and source instead of embedding a widget that pulls the stars live.
- Run the enquiry form on your own site instead of embedding an outside form module; which fields make sense is shown in the article on enquiry form fields.
- Do without in-browser visitor measurement and evaluate the server logs that accrue anyway.
What doing without actually costs
The rebuild is not a loss of effect. A site without outside connections loads faster, fails less often because it depends on no outside service, and loses nothing in content. Conversely, a banner every visitor has to click away first is an obstacle in front of the actual message. That obstacle stands on the pages least able to bear it: emergency call-outs and urgent matters, where every additional click costs enquiries. The article on the most common mistakes on trade websites collects further stumbling blocks of this kind.
Withdrawal, records and the privacy notice
Anyone obtaining consent takes on three follow-up duties. The first is withdrawal: it has to be as easy as giving consent (GDPR), so it must remain reachable through a permanently visible point, not through an email to the business. The second is the record: the business has to be able to show that consent was given and to what extent. The third is the description: the privacy notice has to name the embedded services individually, together with purpose and recipient.
- The time of consent, to the minute.
- Which purposes were agreed to and which were refused.
- Which version of the consent text was displayed at that time.
- By which route withdrawal is possible and when it took place.
- How long the records themselves are kept and when they are deleted.
Since 2025 there has been a further legal framework for this. Section 26 TDDDG provides for recognised consent management services, and the German consent management regulation of 6 February 2025 fills it out; it entered into force on 1 April 2025 (EinwV). For the individual trade business little changes at first: recognition is a procedure for providers of such services, not a duty for site operators. It relieves nobody of checking for themselves which accesses take place at all.
What a business can check itself
Taking stock needs no purchased tool, only the browser and half an hour. Every common browser ships with developer tools that show which addresses a page contacts and what sits in storage. What matters is that the check happens in a fresh private window, so old markers do not distort the result, and that you look before the first click.
- Open a private window and start the developer tools before the page loads.
- In the network tab, look for addresses that are not your own domain. Note every outside address, together with the page it appears on.
- In the storage tab, check which cookies and which local storage entries exist after the bare page load, without anything having been clicked.
- Repeat the exercise for every type of page: home page, one service page, the contact page, the references. The contact page is typically the most conspicuous.
- Decide per finding: serve it yourself, load it only after a click, or obtain consent.
{
"page": "/services/heating/",
"outside_servers": [
"Font is fetched from an outside address when the page opens",
"Map section builds itself on load"
],
"browser_storage": [
"Session marker of the enquiry form",
"Identifier of the visitor measurement"
],
"consent_needed": true,
"decision": "Serve the font ourselves, map as an image with a link, remove the measurement",
"check_again_on": "2026-10-01"
}At the end you have one list per type of page. It is the basis for the conversation with the agency and at the same time the record that a check took place. Whoever keeps it notices immediately at the next rebuild when a new embed has appeared.
What this means in practice
The order stays the same: first look at what the site does, then decide what should stay, and only then talk about a banner. Starting from the other end means buying a consent layer for accesses you do not need at all, and paying for it twice, once at installation and once with every change. How we set up sites that keep this question small from the outset is described on the page about websites for tradespeople.
The duty does not end at go-live. Every new extension, every embedded element and every template update can bring in an outside connection that was not there before. The check therefore belongs in the same cycle as updates and backups, as described in the article on maintaining the site after handover. Anyone assigning the check permanently will find it in our maintenance and support.
Two preconditions make the whole thing considerably easier. The first: the business has access to its own site, to the domain and to the hosting space, otherwise it cannot switch findings off; the article on domain, hosting and access credentials covers that. The second: the company details read the same everywhere, so that the privacy notice and the legal notice name the same controller as the directory entries; how to sort that out is shown in the article on consistent business details in directories.
And one more point that tends to come up in the same meeting: a banner that covers half the page and cannot be closed with the keyboard is also a usability problem. What hangs on that is set out in the article on the German accessibility act and trade businesses. Tackling both topics together saves one pass. For an assessment of your own site a short message through the contact form is enough.
Sources and references
Related Articles
One website for several trades: structure and legal notice
Electrical, plumbing and painting firms on one site: a page per trade, requests routed to the right firm, the legal notice under § 5 DDG and GDPR roles.
Showing past work without naming clients
The best work sits inside private homes. How a trade business shows projects anonymously, what stays possible without a written release and what does not.
Legal notice and privacy for trade websites
Mandatory details under section 5 DDG, chamber and professional title, privacy policy, processing contracts and deletion periods for trade businesses.