When a cookie banner is needed and when it is theatre
The rule is about the device, not about cookies. Storing information on a user's terminal equipment or accessing information already stored there requires consent based on clear and comprehensive information, unless it serves solely to transmit a message or is strictly necessary for a service the user expressly requested. Remove what is not necessary and the banner often goes with it.
What the provision actually regulates
The wording does not mention cookies. It covers storing information on the end user's terminal equipment and accessing information already stored there, which is why local storage, device fingerprints and similar techniques fall under the same rule.
Consent must rest on clear and comprehensive information. That is the part most banners fail: a wall that offers accept and a hidden link to settings has not given information, it has extracted a click.
The two exemptions, and what they leave
There are exactly 2 exemptions. The first applies when storage or access serves solely to carry out the transmission of a message over a public telecommunications network. The second applies when it is strictly necessary to provide a digital service the user has expressly requested.
Run your own site through those two sentences and count what survives. A session cookie that keeps a shopping basket is strictly necessary for a service the visitor asked for. A language preference the visitor set is arguable and usually defensible. An analytics identifier, a map embed that contacts a third party and a video player that sets identifiers before playback are none of those things.
For a small brochure site the honest count is often 0 non exempt technologies once the three usual additions are removed, and 0 means no banner. That is the cheapest privacy improvement available: not asking, because there is nothing to ask about.
The downside is priced as well. Section 28 of the same act lists 13 categories of violation across 4 tiers of 300,000, 100,000, 50,000 and 10,000 euros, and storing or accessing information contrary to section 25(1) sits in the 300,000 euro tier. That is the top band, for the same act that a removed map embed would have avoided in about 20 minutes of work.
| Element | Exempt | Why |
|---|---|---|
| Session cookie for a basket or login | Yes | Strictly necessary for a requested service |
| Language or currency the visitor set | Usually | Provides what was expressly requested |
| Analytics identifier | No | Not necessary for the requested service |
| Embedded map from a third party | No | Contacts another party before any request |
| Self hosted fonts | Nothing stored | No access to the device involved |
The order to work in
List every request your pages make to a domain that is not yours. Fonts, maps, video, analytics, chat, ratings widgets. For each one decide whether the visitor asked for it, and remove or self host what they did not.
Only then design a banner, if anything is left. A banner is the fallback for the things you decided to keep, not the entry ticket to running a website.
Questions and answers
Is a banner always required?
Does the rule only cover cookies?
Are analytics strictly necessary?
What is the cheapest fix?
Sources
- Section 25, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz The consent requirement and both exemptions
- Section 5 Digitale-Dienste-Gesetz (DDG) The separate information duties that apply alongside
