Cookie banners: when your website really needs one

Many businesses have a cookie banner simply because that is what everyone does. Whether it is needed depends on what your site actually does. Up front: this is not legal advice. In individual cases, a lawyer specialising in IT law can help.

The legal basis

In Germany, § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG, called TTDSG until May 2024) governs access to end devices. In short: anyone who stores information on a visitor's device or reads it from there needs consent. That covers cookies, but also the browser's local storage and similar techniques. The exception: storage is strictly necessary for a service the user has explicitly requested (§ 25(2) No. 2 TDDDG).

The GDPR applies as well as soon as personal data is processed, for example the IP address when content is loaded from third-party servers.

When you do not need a banner

Typical examples of strictly necessary storage are the shopping cart in a shop, the login to a customer area or saving the cookie choice itself. For a normal business website that means: without analytics tools, advertising pixels and embedded third-party content, you can often do without a banner entirely.

When you need one

• Visitor statistics such as Google Analytics that store data on the device.
• Advertising pixels from Meta, Google Ads or other networks.
• Embedded YouTube videos, Google Maps or Instagram feeds that transfer data to the provider when loading.

Fonts from third-party servers such as Google Fonts are a special case. There it is less about cookies than about transferring the IP address. The better solution than a banner is to host the fonts on your own server.

If you use a banner, do it right

The German data protection conference of supervisory authorities has described what valid consent requires in its guidance for providers of digital services (source: datenschutzkonferenz-online.de). The main points:

• In the authorities' view, rejecting must be just as easy as accepting.
• No pre-ticked boxes. The European Court of Justice ruled on this in 2019 (case C-673/17, "Planet49").
• Nothing that requires consent may be loaded before consent is given.
• Consent must be revocable at any time, for example via a link in the footer.

The best banner is no banner

For most small businesses, the simplest way is to build the site so that it needs no consent: fonts hosted locally, no tracking pixels, maps and videos only loaded after a click. That is privacy-friendly, the site loads faster, and visitors are not greeted by a pop-up first.

Frequently asked questions

Is a notice saying "This site uses cookies" with an OK button enough?

If services that require consent are running, no. A mere notice is not consent, and those services may only start after real agreement.

Do I still need a privacy policy without a banner?

Yes. Even a site without a banner processes data, for example in the server's log files or through the contact form. That belongs in the privacy policy.