Cookies are small text files that a website stores on the user's terminal device in order to recognise the user or save settings.
When is consent required?
Under Section 25 TDDDG, storing information on, and accessing information from, the terminal device generally requires consent. This applies to cookies as well as to comparable technologies such as local storage or fingerprinting.
Cookies that are strictly necessary for the service explicitly requested by the user are exempt, for example for a shopping basket, a login or storing the cookie choice itself.
Interplay with the GDPR
Where personal data is processed through cookies, the subsequent processing also requires a legal basis under the GDPR. For analytics and marketing cookies, this is regularly consent in practice.
The privacy notice must provide information about the cookies used, their purposes, providers and storage periods.
Legal provisions
- Section 25 TDDDG
- Protection of privacy in terminal equipment, consent and exemptions.
- Art. 6(1) GDPR
- Legal basis for processing the data collected.
- Art. 13 GDPR
- Information obligations towards users.
Related terms.
Consent Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data. Art. 4(11) GDPR IP address An IP address is a numerical identifier used to address a device in a network such as the internet, and it can be personal data. Art. 4(1) GDPR Privacy notice The privacy notice is the information with which a controller informs data subjects about the processing of their personal data, typically on a website. Art. 12 GDPR 