Cookie banner: when is it required?

In brief

• No law prescribes a “banner”. What is mandatory is consent, as soon as your website stores or reads information on visitors’ devices that is not strictly necessary (§ 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The banner is merely the usual tool for obtaining it.
• You can do without a banner if your website only accesses visitors’ devices to the extent strictly necessary for its operation and loads nothing from third-party servers before a decision is made. In our measurement, almost one in three websites (32.2%) did not contact a single third-party server before the first click. In that case, the German supervisory authorities even expressly advise against a banner.
• The most common reason for connections made without asking is not tracking, but Google Fonts, Google Maps and the reCAPTCHA spam protection. If they are embedded locally or only loaded on click, this reason disappears.
• If you use a banner, do it properly: rejecting must be as easy as accepting, nothing may be preselected, and nothing may load before consent is given. In our measurement, 76% of websites with third-party services sent no less data to third-party servers after “Reject” than after “Accept”, mostly because there was no effective way to reject.
• Nothing has been abolished: the EU is discussing new cookie rules, but none of them has been adopted. Until then, current law continues to apply unchanged (as of 14 October 2026).

What the law really requires

The term “cookie banner” does not appear in any law. The obligation behind it comes from two sets of rules that are often confused. The German supervisory authorities examine them separately, one after the other.

§ 25 TDDDG, access to the device: anyone who stores information on users’ end devices or reads information already stored there needs their consent. This applies to cookies, but just as much to local storage, tracking pixels, scripts that query device properties, or fingerprinting. It does not matter whether personal data is involved. The only exception is what is strictly necessary for you to be able to provide a service that users have explicitly requested (§ 25(2) no. 2 TDDDG). Until May 2024 the law was called the TTDSG; the renaming did not change anything in its content.

GDPR, the disclosure of data: if your website loads a font, a map or a script from a third-party server, that provider learns the visitor’s IP address. For this you need a legal basis under Art. 6 GDPR. A legitimate interest is often ruled out, for example where there is a local alternative or the provider also uses the data for its own purposes. Then only consent remains.

Valid consent must be given freely, in an informed and unambiguous manner and by an active act (Art. 4(11) GDPR). A pre-ticked checkbox is not enough, as the Court of Justice of the European Union (CJEU, Planet49, 2019) and the German Federal Court of Justice (BGH, Cookie-Einwilligung II, 2020) have ruled. Continuing to browse or scrolling is not consent either. And withdrawing consent must be as easy as giving it (Art. 7(3) GDPR).

Do you need a cookie banner? The decision guide

Whether you need a banner is decided not by your sector or the size of your business, but solely by what your website does technically. Go through the list with everything that is embedded on your website:

The rule of thumb that follows: if nothing loads from third-party servers before a decision is made and your website only accesses the device to the extent strictly necessary for its operation (cookies, local storage, scripts), you do not need a consent banner. In this case, the German Data Protection Conference (DSK) even expressly advises against showing one anyway, because it creates the false impression of a choice. You still need a privacy policy, because it also provides information about technically necessary processing.

What “strictly necessary” means

The exception is narrow. In their guidance for digital services, the German data protection supervisory authorities interpret it in strictly technical terms: necessary is anything without which the requested service would not work. It is not enough that a tool is useful, makes economic sense or is common. And at first, only the website itself is “requested”. Additional functions such as a contact form, a chat, a map or a video are only requested once someone actively uses them.

• Typically necessary: shopping basket and login from the moment they are used, the stored consent decision, non-identifying settings such as the language, load balancing, protection against abuse such as repeated failed login attempts.
• Typically not necessary: audience measurement and statistics, advertising and retargeting, embedded third-party content, review or chat widgets that load as soon as the page is opened.

Be careful with web analytics “without cookies”: many providers advertise that no banner is needed. Using Matomo as an example, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) takes a different view; its assessment is addressed to federal authorities but, by its own account, applies by analogy to similar services. According to this, as soon as a script is delivered that collects information from the device, consent is required in principle. The only thing that is consent-free under the TDDDG is the analysis of server log files, which are generated anyway. The GDPR does apply to them, however, and there is no blanket approval for audience measurement from the DSK either.

The underestimated reason: fonts, maps and spam protection

When it comes to cookie banners, many people think of tracking. Our measurement of 10,389 German websites for the Data Protection Report 2026 paints a different picture:

• 68% of websites contact third-party servers before visitors can click on anything.
• 21% of all websites report the visit to Google solely because of fonts, maps or reCAPTCHA. In most cases the operator does not want to measure anything, but the IP address still goes to Google.
• 9.1% of all websites would additionally be completely quiet before the click if they simply embedded these three Google services locally or on click.

This is the cheapest way to reduce the need for a banner: serve fonts from your own server, replace maps and videos with a preview image that only loads them on click, and choose a spam protection method without third-party contact. For visitors, hardly anything changes as a result.

Legally, this is above all a GDPR question. The Regional Court of Munich I (LG München I) awarded a visitor €100 in damages because a website loaded Google Fonts from Google servers without consent and there was a local alternative (judgment of 20 January 2022, 3 O 17493/20). The legal position is not yet fully settled: in 2025, the Federal Court of Justice referred to the CJEU, among other things, the question of whether an IP address is personal data for the recipient at all and whether deliberately provoked visits give rise to a claim for damages (order of 28 August 2025, VI ZR 258/24). Until then, embedding locally is the safe route.

The free website scanner in the GDPR check-up shows you in under a minute whether your website loads such services.

If you need a banner: what it must be able to do

If, after tidying up, there are still services left that require consent, such as analytics, advertising or a website builder, the banner must meet these requirements:

1. 1Nothing that requires consent loads before the decision. Scripts, pixels and content from third-party servers only start after consent has been given.
2. 2Rejecting is as easy as accepting. If you offer “Accept all” on the first layer, an equivalent option to reject belongs there too, of similar size and clearly visible. A button labelled “Settings or reject”, behind which rejecting only comes on a second layer, is not enough for the DSK.
3. 3Nothing is preselected. All boxes for purposes that are not necessary start out unticked.
4. 4Purposes and providers are named individually. Anyone who consents must know for what and towards whom. “Our partners” is not enough.
5. 5The legal notice (Impressum) and privacy policy remain accessible. The banner must not cover them.
6. 6Consent can be withdrawn at any time, ideally via a permanently visible “Cookie settings” link in the footer.
7. 7Consent can be demonstrated. You must be able to prove that consent was given (Art. 7(1) GDPR). Common consent tools log this.

The line on the reject button is not entirely uniform. The DSK requires a reject option on the first layer at least where the banner has to be clicked away in order to use the site, and considers this to be the case very often with common banners. The Lower Saxony data protection authority (LfD Niedersachsen) expressly requires it as soon as “Accept all” is offered, and according to the authority, the Hanover Administrative Court (VG Hannover) upheld its order (judgment of 19 March 2025, 10 A 5385/22). The Cologne Higher Regional Court (OLG Köln) prohibited a website operator from using a banner that offered no reject option at all on the first layer (judgment of 19 January 2024, 6 U 80/23). If you offer an equivalent “Reject all” next to “Accept all”, you are on the safe side.

Does your reject button work? The five-minute test

A banner that blocks nothing creates work without providing protection. In our measurement, 76% of websites with third-party services contacted no fewer third-party servers after a click on “Reject” than after “Accept”. These are mainly websites without a detectable consent tool. But even on websites with a consent tool, the “no” had no measurable effect in 22 to 86% of cases, depending on the tool. Before the click, websites with a detectable consent tool also contacted 8.4 third-party servers on average, websites without a detectable tool 3.9. This is mainly because a banner is usually found where more is embedded, too. In our assessment, an ineffective reject option is rarely intentional: often the tool was never connected to the embedded services.

How to check your own website:

1. 1Open your website in a private browser window.
2. 2Open the developer tools (F12 key, on a Mac Option + Command + I) and there the “Network” tab.
3. 3Reload the page, click “Reject” in the banner, then clear the list in the “Network” tab and open a subpage.
4. 4Check which addresses of third-party providers still appear, for example google-analytics.com, googletagmanager.com, fonts.googleapis.com or facebook.net.

If something that requires consent appears there, your banner is not connected properly.

Are cookie banners being abolished?

The short answer: not now, and perhaps never completely. In November 2025, with the Digital Omnibus, the European Commission proposed moving the cookie rules into the GDPR insofar as personal data is concerned. This proposal, too, retains consent as the basic rule. Above all, the Commission’s draft provides for:

• Fewer questions: for a short list of purposes, consent would no longer be required, for example for technical transmission, a service that has been explicitly requested, narrowly defined first-party audience measurement and the security of the service.
• Peace after a no: it should be possible to reject with one click, and anyone who has rejected should not be asked again for the same purpose for at least six months.
• A signal from the browser: visitors should be able to record their decision once in machine-readable form, and websites would have to respect it.

None of this has been adopted. In the European Parliament, the committees responsible have not yet voted, in the Council there is not yet a confirmed common position, and negotiations between the two have not begun (as of 14 October 2026). According to the then Federal Commissioner for Data Protection, the Council has not pursued the browser signal any further. In August 2026 she argued for making such signals binding throughout Europe, and a coalition of organisations around noyb is calling for the same. Whether it will come is open, and even after an agreement the draft would provide for transitional periods.

In Germany, the Consent Management Ordinance (Einwilligungsverwaltungsverordnung, EinwV) has also been in force since 1 April 2025. It governs recognised services with which users can record their decisions centrally. For websites, integrating such a service is voluntary, and so far only a single service has been recognised. Today, such a service does not replace the banner.

In any case, there is no all-clear for the most common case: the planned exceptions concern access to the device. Whether Google Fonts, maps or videos that load when the page is opened need a legal basis remains a question for the GDPR. Whether the redefinition of the term “personal data”, which is also planned, and the CJEU proceedings on IP addresses will change anything here is open.

What happens without a correct banner?

Infringements of § 25 TDDDG can be punished with a fine of up to €300,000, infringements of the GDPR under Art. 83 GDPR. In our research, we did not find any publicly documented fines against small businesses over cookie banners. The documented cases look different: orders from supervisory authorities, actions for injunctions by consumer organisations (in the Cologne case with €260 in costs for the cease-and-desist letter) and claims for damages by visitors (in the Munich case €100). Competitors can also pursue data protection breaches under competition law: the CJEU ruled in 2024 that the GDPR does not preclude this (judgment of 4 October 2024, C-21/23), and the Federal Court of Justice confirmed this for German law in 2025 (judgments of 27 March 2025, I ZR 222/19 and I ZR 223/19). The amounts in individual cases are usually small; the effort involved in a dispute is not.

The most common mistakes

• Buying a banner instead of tidying up. If you embed fonts locally and load maps on click, you often do not need one at all.
• Showing a banner even though there is nothing to decide. Without services that require consent, it only causes confusion.
• Hiding the reject option on the second layer. “Accept all” as a button, “Reject” only via “Settings”: the supervisory authorities object to this, and courts have confirmed it in individual cases.
• Installing a banner that blocks nothing. The plugin asks, but the scripts load anyway. With the five-minute test above, you will see it immediately.
• “By using this site you agree” notices. Continuing to browse is not consent.
• Confusing “cookieless” with “consent-free”. Scripts and pixels also access the device.
• Forgetting old tools. Deactivated analytics accounts or remnants of a previous theme continue to set cookies without anyone using the data.
• Banner and privacy policy do not match. Services in the banner that are missing from the policy, or the other way round.

Checking your cookie banner and website with Dieter

Before you decide on a banner, you should know what your website really loads. That is exactly what the free website scanner in the GDPR check-up shows: the same three-state scan as in our study, that is, without a click, after “Accept” and after “Reject”. The cookie banner risk analysis shows whether services that require consent become active before consent has been given, and each finding states what needs to be changed in the banner, the privacy policy or the technical set-up.

Whatever then remains on the website belongs in the privacy policy. Dieter’s privacy policy generator detects embedded services via a website scan, knows over 1,000 of them and keeps your policy up to date via live embedding: if you later add or remove a tool, you update it in Dieter, and the change appears automatically on your website.

Conclusion

A cookie banner is not a mandatory component of every website but the consequence of what a website embeds. If you only access the device to the extent technically necessary and load nothing from third-party servers before a decision is made, you do not need one. The quickest way to get there is often unspectacular: fonts hosted locally, maps and videos on click, old tools removed. If you still need consent for analytics, advertising or your website builder, the banner has to genuinely work, with an equivalent reject option and without loading anything prematurely. Waiting for the EU reform is not worth it: it has not been adopted, and whether it affects the most common case at all is open.