The law implements the European ePrivacy Directive in Germany. It was renamed in May 2024 together with the Digital Services Act implementation law; section 25 remained unchanged in substance.
Section 25: access to end devices
Anyone storing information on users’ devices or reading it from them generally needs consent. This covers cookies, local storage, fingerprinting and similar techniques, regardless of whether personal data is processed.
Exceptions
No consent is needed where access is strictly necessary to provide a service explicitly requested, such as a shopping cart, login or language setting. Analytics and marketing tools usually do not qualify.
Relation to the GDPR
Section 25 governs access to the device, the GDPR the subsequent processing of personal data. Tracking therefore often needs both: consent under the TDDDG and a legal basis under the GDPR, frequently also consent.
In practice
A banner must make rejecting as easy as accepting, and tools may load only after consent. How to check this technically is described in our glossary entry on cookie consent.