Consent, TDDDG and Impressum: what businesses selling in Germany should know

Not legal advice. This page gives a general, simplified overview as of October 2026. Laws, guidance and court decisions change, and every case is different. For decisions about your website, consult a lawyer admitted in Germany.

Why this matters more in Germany than you might expect

Companies entering the German market are often surprised by how seriously website rules are taken here. Not only by data protection authorities, but by competitors. Under German unfair competition law, a competitor or certain associations can send a formal warning letter (Abmahnung) demanding that you stop an infringement, often with costs attached.

There is also a marketing side. If your consent setup is built for a market with looser rules, your tracking may break in Germany, or it may run before consent and create risk. Either way, your ad platforms end up working with bad data.

Three rule sets, briefly

GDPR. The EU General Data Protection Regulation applies to processing personal data, including data from analytics and advertising tools. You need a legal basis for each purpose, and you must inform users in a privacy policy (Datenschutzerklärung).

TDDDG. The Telecommunications Digital Services Data Protection Act, called TTDSG until 14 May 2024, governs access to the user's device. Its § 25 says, in short: storing or reading information on a device, through cookies, local storage, pixels or similar technologies, needs consent, unless it is strictly necessary to provide the service the user asked for. Analytics and advertising tags usually fall outside "strictly necessary".

DDG (Impressum). The German Digital Services Act (Digitale-Dienste-Gesetz, not to be confused with the EU Digital Services Act), in force since 14 May 2024, requires providers of commercial online services to provide an Impressum: the provider's name and the address where it is established, for companies also legal form and authorised representative, contact details including email, and, where applicable, register entries, VAT ID and the competent supervisory authority. The law says it must be easy to recognise, directly reachable and permanently available. In practice that means a clearly labelled link on every page.

If you run Google Ads in Germany, this is usually the first thing to check: see Google Ads in Germany. How we produce the findings is explained on our method page.

What usually goes wrong, technically

These are patterns we look for. Whether a specific case is a legal problem is for your lawyer to judge.

Tags firing before consent. The banner appears, but Google Analytics, the Meta pixel or a chat widget have already loaded in the background.

"Reject" that doesn't reject. The visitor declines, and some tags keep running anyway, or the choice isn't saved and the banner returns on every page.

Uneven buttons. "Accept all" is large and colourful, "reject" is hidden in a second layer. German regulators and courts have criticised designs where refusing is harder than accepting.

Consent Mode missing or misconfigured. Google requires consent signals for users in the European Economic Area if you want to keep using measurement, personalised advertising and remarketing. A common error is setting the default to "granted", which defeats the purpose.

Embedded content. YouTube videos, Google Maps or web fonts loaded from third-party servers before consent.

Impressum missing, incomplete or hard to find. Particularly on landing pages built in separate tools for ad campaigns.

Forms sending data to unexpected places. Spam filters, form plugins or CRM integrations transferring enquiries to third-party services the privacy policy doesn't mention.

What Consent Mode v2 is, and isn't

Consent Mode is Google's way of telling its tags whether a visitor has agreed to advertising and analytics storage. Version 2 added two signals, ad_user_data and ad_personalization. In basic mode, Google tags don't load until consent is given. In advanced mode, they load in a restricted state and send cookieless pings. Which mode is appropriate for you is partly a legal question.

Consent Mode doesn't ask for consent. It only carries the answer from your consent tool to Google. A step-by-step check (in German) is in our guide Consent Mode v2 prüfen. For the search side of a German launch, see SEO for the German market.

How we help

1. Diagnosis in 48 hours on working days

We load your website as a new visitor, record what happens before consent, after accepting and after rejecting, on desktop and mobile. No logins. Free (terms).

2. Written findings

A report in English listing what we observed, with network logs and screenshots. Written so that a lawyer can assess it quickly. Yours to keep.

3. Technical repair with a change log

If you want, we fix the technical side: tag manager configuration, Consent Mode, tag sequencing, embedded content. Every change is logged with before, after, reason and rollback. Wording of banners, privacy policies and the Impressum should come from your lawyer.

Prices are on our homepage in the “Preise” section of our homepage.

What we don't do

We don't give legal advice, issue compliance certificates or state that a website is "GDPR compliant". We describe what your website technically does.

See what your website does before anyone clicks "accept"

Send us your website. Within 48 hours on working days you'll have a written, technical record you can take to your lawyer.

Request your free diagnosis