In short. German law requires informed consent for device storage or access unless the transmission or strictly necessary requested-service exception applies.
Definition: As of 17 October 2026, Section 25 of Germany's Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) requires informed consent before storing information on an end user's device or accessing information already stored there. Its exceptions cover operations whose sole purpose is transmitting a communication and operations strictly necessary to provide a digital service the user expressly requests.
Key facts
- Germany's TDDDG Section 25(1) requires clear and comprehensive information and applies the General Data Protection Regulation (GDPR) to the information and consent.
- The ePrivacy Directive, Article 5(3), contains the European device-storage and access rule, including both exceptions.
- The Court of Justice's Planet49 judgment, paragraphs 68 to 71, applies the European rule regardless of whether the information is personal data.
- Under GDPR Article 7(3), withdrawing consent must be as easy as giving it.
What are the statutory exceptions?
TDDDG Section 25(2) provides two alternatives to consent. Point 1 covers storage or access whose sole purpose is carrying out the transmission of a communication over a public telecommunications network. The sole-purpose condition applies to the storage or access itself.
Point 2 covers storage or access that is strictly necessary for the provider to supply a digital service expressly requested by the user. Both elements matter: the user expressly requests the service, and the operation is strictly necessary to provide it.
The ePrivacy Directive, Article 5(3), expresses the same distinction between transmission and provision of an expressly requested service. The statutory tests concern the purpose and necessity of the operation; a website's label for a cookie supplies neither condition by itself.
What information and action does consent require?
The GDPR, Article 4(11), defines consent as freely given, specific, informed and unambiguous, expressed through a statement or clear affirmative action. Article 7(1) requires the controller to demonstrate consent. Article 7(2) requires a written consent request that also concerns other matters to be clearly distinguishable and use clear, plain language.
In Planet49, paragraphs 63 and 81, the Court rejects consent obtained through a preselected checkbox that the visitor must deselect to refuse. The judgment also requires information about how long cookies operate and whether third parties may access them.
Does the rule depend on personal data?
In Planet49, paragraphs 68 and 69, the Court explains that Article 5(3) refers to information without requiring it to be personal data. Its protection concerns interference with the user's private sphere.
For processing that involves personal data, GDPR Article 6(1) separately requires a lawful basis. A device-storage exception addresses the storage or access operation; personal-data processing remains subject to that Article's conditions.
Related terms
- Which website cookies fall within the ePrivacy consent exemption?
- GDPR lawful basis for web data
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Does accessing existing information also require consent?
Yes. TDDDG Section 25(1) covers access to information already stored on the device, alongside storing information. The statutory exceptions also cover both operations.
Can a preselected checkbox collect consent?
The Planet49 judgment, paragraph 63, rejects that method. Consent requires an affirmative indication of agreement.
Can you withdraw consent later?
Yes. GDPR Article 7(3) allows withdrawal at any time and requires advance information about that right. Withdrawal leaves the lawfulness of processing based on consent before withdrawal intact.
Sources
- Gesetze im Internet, "TDDDG Section 25: Schutz der Privatsphäre bei Endeinrichtungen", undated
- EUR-Lex, "Directive 2002/58/EC", consolidated text of 19 December 2009
- Court of Justice of the European Union, "Judgment in Case C-673/17, Planet49", 1 October 2019
- EUR-Lex, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
Check how a page reads to answer engines. Open the GEO score analyzer