Tracking and cookie consent in Germany: what advertisers need

In Germany, tracking starts with a question to the visitor, and the measurement waits for the answer. That is the rule § 25 TDDDG sets for storing or reading information on a device, with narrow exceptions, and Google’s own consent policy asks advertisers for the same. For a company that advertises here from abroad this has two consequences. Some of your visitors will say no and will be missing from your conversion data. And a cookie banner on the page is no proof that the tags wait for it.

I worked for Google on measurement implementation, and consent is the first thing I check in an account. Below: what the law requires, what Consent Mode does and does not solve, what I measured on German business websites, and a checklist. I am not a lawyer and this is not legal advice.

1. What the law requires before measurement starts

Two layers apply at once. One protects the device, the other the personal data.

§ 25 TDDDG: the device

§ 25 TDDDG allows storing information on a user’s device, or reading information that is already stored there, only if the user has consented on the basis of clear and comprehensive information. The consent itself has to meet the GDPR’s requirements. There are two exceptions: the transmission of a message, and storage or access that is strictly necessary for a digital service the user has expressly asked for.

Three details matter for advertisers.

• It does not depend on personal data. The German data protection authorities state in their guidance for providers of digital services that the consent requirement applies whether or not the information relates to a person.
• Consent comes first. The same guidance says the consent must already have been given before the device is accessed. Setting cookies on the first page view and asking afterwards is not permitted.
• Being based abroad does not by itself put you out of scope. The law applies to all companies that have an establishment in Germany, provide services here or make goods available on the market here (§ 1 TDDDG). The same paragraph leaves § 3 DDG, the country-of-origin rule for digital services, unaffected. How the two fit together for a company established in another EU country is a question for a lawyer.

Storing or reading information in breach of the section can be fined with up to €300,000 (§ 28 TDDDG).

GDPR: the personal data

The GDPR applies to a company outside the EU when it processes personal data of people in the EU in connection with offering them goods or services, or with monitoring their behaviour (Art. 3(2)). Where that is the case, the company has to designate a representative in the EU in writing, with exceptions (Art. 27).

Consent is defined as a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action (Art. 4(11)). Recital 32 adds that silence, pre-ticked boxes or inactivity do not count. You have to be able to demonstrate that the person consented (Art. 7(1)), and withdrawing consent has to be as easy as giving it (Art. 7(3)). Breaches of the conditions for consent can be fined with up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)).

The reject button

The authorities’ guidance is specific about the banner. If a banner covers the content and the visitor cannot simply ignore it, refusing must not take more clicks than agreeing. A refusal that only becomes possible on a second layer is the example it gives of extra effort.

The Hanover Administrative Court went the same way in a first-instance judgment of 19 March 2025. According to the data protection authority of Lower Saxony, the court held that a clearly visible “reject all” button has to sit on the first layer of the banner if there is an “accept all” option. It also confirmed the authority’s view that using Google Tag Manager needs consent. That is one court. I plan with it anyway.

2. What Consent Mode does and does not solve

What it does: in Google’s words, consent mode lets you communicate your users’ cookie consent status to Google, and the tags adjust their behaviour. It comes in two versions.

• Basic. Google tags are blocked until the visitor interacts with the banner. If the visitor does not consent, nothing is transferred to Google, not even the consent status.
• Advanced. Google tags load when the visitor opens the site. While consent is denied, they send cookieless pings. Google uses those for an advertiser-specific conversion model.

Modelling does not start by itself. One of Google’s conditions is 700 ad clicks over seven days, per country and domain grouping. And Google expects the signals: to keep using its tags for measurement, ad personalisation and remarketing, you must collect consent from users in the EEA and share the consent signals with Google.

What it does not do:

1. It is not a banner. Google’s page about consent mode says it does not provide a consent banner or widget. Collecting the consent stays your job.
2. It only steers tags that listen to it. Google’s developer documentation lists the tags with built-in consent checks: the Google tag, Google Analytics, Google Ads, Floodlight and Conversion Linker. For tags without built-in checks, it points to the consent settings in Tag Manager, where you add the checks yourself. For a Meta or LinkedIn pixel I set that condition by hand.
3. It does not answer the legal question. In the Advanced version, Google tags load when the page opens and send pings while consent is denied. The Hanover court required consent for Google Tag Manager itself. In my study I counted sites that sent only pings marked “denied” separately: 859 of 41,161, or 2.1%. Which version you run is a decision for your lawyer or data protection officer.
4. It does not configure itself. In the same study, 3,066 sites sent requests to Google Analytics 4 before any click. 2,027 of them carried no consent status at all, 896 reported “denied”, 115 reported “granted” before any click, and 28 were mixed or unclear.

The setup steps are in Consent Mode v2 setup.

3. What my three studies measured on German business websites

All three studies use the same sample: 50,000 website addresses drawn at random from 350,146 German businesses listed with a website in OpenStreetMap. Each study has its own base of sites that could be evaluated.

Tracking before consent

Between 23 and 26 September 2026 I opened every address in a real browser and logged what happened before any click. 41,161 sites were reachable.

• 59.5% had a cookie banner the browser could detect.
• 8.8%, or 3,619 sites, sent data to a measurement or advertising service before any click, without a “denied” signal. The 95% confidence interval runs from 8.5% to 9.1%.
• On 2,619 of those 3,619 sites the browser had detected a banner.
• Google Analytics or Google Ads was involved on 2,670 of them.
• On a fixed quarter of the sites (10,173) the browser then tried to click an accept button and found one on 5,212 of them. Of 1,854 sites among them that showed tracking, 573 measured before the click. That is 30.9%. 1,079 sent no measurement before the click.
• A further 1,733 sites, 4.2%, loaded a tracking script before the click without measuring through it yet.

The full results are in Tracking before consent.

Google Fonts

As of 22 September 2026, with 38,065 reachable sites as the base, 18.7% still loaded their fonts from Google’s servers (about 17.7 points seen directly, the rest estimated from a re-check of 185 sites). I also checked 706 large German companies, 540 of them reachable. There it was 10.1%.

The reason this is a consent topic: in January 2022 the Regional Court of Munich I, as a court of first instance, ordered a website operator to pay €100 because the visitor’s IP address had been passed to Google through Google Fonts without consent. The court noted that the fonts can be used without a connection to Google’s servers. Details are in Google Fonts and GDPR.

Legal pages

For the third study I fetched the addresses on 24 September 2026. 38,958 returned an encrypted page without an error, and 37,393 homepages could be analysed. Around 10.9% of those had no link to a privacy policy (range 8.7% to 14.7%, verified in a browser). The rest is in German business websites 2026.

These are local German businesses, from restaurants to law firms, not a sample of advertisers. I read the numbers as a base rate: a banner on the page says little about what happens behind it.

Conclusion

A checklist for an advertiser based abroad:

1. List every tag on the landing pages and note what it stores or reads on the device.
2. A banner in German with “accept” and “reject” on the first layer, the same number of clicks for both.
3. All consent signals default to “denied”. Whether Google tags load before the choice (Advanced) or only after it (Basic) is a decision for your lawyer or data protection officer. Every other tag waits for the yes.
4. Add consent checks in Tag Manager for every tag that is not from Google.
5. Test in a fresh browser window before you click anything. The five-minute method is in the study, and the tracking check gives a first read.
6. Keep consent records, link the privacy policy on every landing page, and make withdrawal as easy as consent.
7. Host fonts yourself. The Google Fonts checker shows whether a page still calls Google.
8. If your company is outside the EU, ask your lawyer about the Art. 27 representative.
9. Plan for the gap. Visitors who decline are missing from your conversion data, so judge campaigns on what consent leaves you.

What I would leave alone: a banner with a single “OK” button, and any setup nobody has tested with the banner still open.

If you want me to look at your consent and tracking setup before you advertise in Germany, book an intro call.