What does the article mean by 'consent' in relation to websites?

Consent requires obtaining permission before a website stores information on a device or reads data from it. This includes cookies, local storage, and browser fingerprinting, but only when strictly necessary for a user's expressly requested service.

Why are consent management platforms often unreliable according to the article?

Consent management platforms frequently fail to work effectively because browsers load many files simultaneously, and the platform itself may load before consent is given, delaying the process and potentially missing critical timing requirements.

What are the key legal requirements for obtaining consent under the TDDDG?

Under Section 25 of the TDDDG, consent must be freely given, informed, and obtained before the first access to the device. It must be for strictly necessary services, and the website operator is responsible for ensuring compliance with data protection laws.

When is a cookie banner required for a website?

A cookie banner is needed if your website stores or transmits data to third parties that requires user consent. Many websites can operate without a banner if they avoid these types of services.

How can I ensure my website is GDPR compliant regarding cookies?

A consent tool alone isn’t sufficient; it must reliably block services needing consent until consent is given. It’s crucial to verify that services aren’t loading in parallel before the consent tool is activated.

What types of cookies don't typically require user consent?

Only cookies strictly necessary for a service a visitor expressly requested, such as a shopping cart or login, are allowed without consent. Convenience or statistical cookies generally fall outside of this requirement.

Cookies and Consent: Overview for Website Operators

Many websites show a cookie banner and consider themselves legally safe. Our audits regularly show the opposite: services load before anyone consents, descriptions are incomprehensible, and some banners would not be needed at all. This overview organizes the key questions about cookies and consent and points to the detailed articles.

The key points in brief

You need consent as soon as your website stores information on the end device or reads it there and this is not strictly necessary. That covers cookies, but also local storage and browser fingerprinting. Consent is also required for the analysis of user information for the purpose of further behavioral analysis (tracking).
A consent tool does not make a website compliant with data protection law by itself. What matters is what is actually loaded before consent is given.
The best consent is the one you do not need. Many services can be replaced by privacy-friendly alternatives, and then the banner is no longer necessary.
Check your website yourself instead of relying on vendors' promises.

When consent is required

Two laws are decisive. Section 25 TDDDG (formerly TTDSG) governs every access to the end device, meaning the storing and reading of information. Without consent this is only permitted if it is strictly necessary for a service the user has expressly requested to work. The GDPR additionally governs the processing of personal data that arises in the process. Which cookies are allowed without consent is explained in Cookies and the TDDDG: Which cookies are allowed without consent?. Where the line of technical necessity lies is shown in Website cookies: What may be used without consent?.

Whether cookies are personal data at all is decisive for fines: Cookies: Personal data or not?. The same rules apply to techniques without cookies, such as browser fingerprinting. Not every file request, however, has to be treated like a cookie: Should file requests on websites be treated like cookies?. Even security cookies are not automatically allowed, as the example of CSRF cookies shows. An overview of common services is provided by the checklist for website tools: When is consent required?.

You can find the wording of the provision with explanations at Section 25 TDDDG: Protection of privacy on terminal equipment.

Which cookies does your website set?

Before you decide on a banner, you should know what your website actually stores and loads. The guide: Finding all cookies a website uses walks you through the check in the browser step by step. Basics and common misconceptions are explained in Cookies: Basics, facts and common misinformation and Cookies and data protection: The invisible danger on the web.

Which cookies and services does your website load before anyone consents? The free website check shows you in a few seconds. Check your website now

Consent tools: What they do and what they do not

Consent management platforms promise to block services automatically until consent is given. In practice, browsers load many files in parallel, and a tool that itself has to be loaded first often arrives too late. Why this is so is shown in Consent management platforms: How reliable are cookie tools? and Cookie popups: Five reasons why they cannot work. How widespread the problem is, is demonstrated by the test Cookiegeddon: The failure of all consent tools.

You can check whether your own tool works correctly: Consent tools on websites: How to check whether they are GDPR-compliant. There are practical tests of individual providers:

Obtaining consent correctly

If you need consent, it must be given freely, in an informed manner and before the first access. What this involves is summarized in the checklist for legally compliant consent requests. What understandable descriptions look like, and how not to do it, is shown in Cookie popups: The best cookie descriptions. A frequent mistake is a tag manager that already loads before consent: Loading Google Tag Manager only after consent.