Cookies are small text files that can be stored on a user’s device when they visit a website. They can be used, for example, to save settings, recognise users during a session or analyse user behaviour. Depending on their purpose, cookies may involve the processing of personal data. Their use is governed in particular by the German Telecommunications Digital Services Data Protection Act (TDDDG) and, where applicable, the General Data Protection Regulation (GDPR).
How do cookies work?
When a user visits a website, small data files can be stored in their browser. These may contain an identifier that enables the website to recognise a browser when it receives subsequent requests. If the user visits the website again, the stored information can be retrieved.
This makes it possible to provide functions such as:
- Session management: Users remain logged in while browsing a website.
- Saving settings: Selected language or display preferences are retained.
- Shopping cart functions: Selected products remain stored during the shopping process.
- Usage analysis: Website operators can obtain information about how their website is used.
- Personalised advertising: User behaviour can be used to select targeted advertising content.
Cookies can therefore be used both for basic website functions and for analytics and marketing purposes. The applicable data protection requirements depend in particular on the purpose for which the cookies are used and the specific data processing involved.
What types of cookies are there?
Cookies can be distinguished in particular according to their storage duration, origin and purpose.
By storage duration:
- Session cookies: These cookies are stored for the duration of a session and are usually deleted when the browser is closed. For example, they enable multiple page views to be associated with a single session.
- Persistent cookies: These cookies remain stored beyond a single session. They can be used, for example, to save language settings for subsequent visits.
By origin:
- First-party cookies: These are associated with the domain that the user is currently visiting.
- Third-party cookies: These are associated with a different domain and may, for example, be used by integrated analytics or advertising services.
By purpose:
- Strictly necessary cookies: These support functions that are strictly necessary to provide a digital service expressly requested by the user.
- Analytics cookies: These are used to analyse website usage for statistical purposes.
- Marketing cookies: These may be used to track user behaviour and deliver more targeted advertising.
- Personalisation cookies: These make it possible to adapt content or settings to specific user preferences.
These categories may overlap. For example, a persistent cookie may also be a first-party cookie and be used for analytics purposes. Its legal classification therefore depends not merely on the label assigned to a cookie, but above all on its actual function.
When may cookies be used without consent?
The legal requirements governing the storage of information on terminal equipment and access to information already stored on such equipment arise in particular from Section 25 TDDDG. Under Section 25(1) TDDDG, consent is generally required for these activities.
However, Section 25(2) TDDDG provides for statutory exemptions. In particular, consent is not required where storing information or accessing information already stored is strictly necessary to provide a digital service expressly requested by the user.
This may apply, for example, to cookies that are necessary to maintain a shopping cart during an online purchase. By contrast, cookies used for advertising and tracking purposes are generally not strictly necessary to provide the service expressly requested by the user. Their use therefore generally requires prior consent.
It is important to distinguish between the TDDDG and the GDPR:
- TDDDG: Governs, in particular, the circumstances under which information may be stored on or accessed from terminal equipment.
- GDPR: Governs the processing of personal data that may take place in connection with the use of cookies.
Accordingly, the fact that consent is not required for a cookie under Section 25(2) TDDDG does not automatically mean that every associated processing activity involving personal data is lawful. Where applicable, such processing must have an appropriate legal basis under Article 6 GDPR.
What data protection obligations apply when using cookies?
Website operators must assess which cookies and comparable technologies they use and which legal requirements apply to them. Where consent is required, it must be obtained before the relevant technology is used.
Under Articles 4(11) and 7 GDPR, valid consent under data protection law must, in particular, be freely given, informed, specific and unambiguous. Pre-ticked boxes or merely continuing to use a website do not constitute valid consent.
The following points must also be taken into account:
- Transparency: Users must be informed in an understandable manner about the technologies used and the associated data processing.
- Legal basis: Where personal data is processed, an appropriate legal basis under Article 6 GDPR must exist.
- Consent management: Required consent must be obtained and taken into account. Where consent is given under data protection law, it must also be documented in a manner that enables the company to demonstrate that it was obtained.
- Withdrawal: Consent given under data protection law must be capable of being withdrawn at any time with effect for the future.
- Data security: Personal data must be protected through appropriate technical and organisational measures.
Companies can use a consent management platform to manage cookie consent. For example, this can provide users with choices through a cookie banner and prevent technologies requiring consent from being activated without the necessary consent.
Simply displaying a cookie banner is not sufficient, however. What matters is that the legal requirements are also implemented in practice at a technical level.
Practical example: Cookies in an online shop
A company operates an online shop and uses various cookies. One cookie stores the products selected by the customer in the shopping cart so that they remain available when the customer moves between different shop pages.
As this function is strictly necessary for the purchasing process expressly requested by the customer, the cookie may fall within the exemption under Section 25(2) TDDDG.
The company also wishes to use analytics cookies to evaluate website visitors’ behaviour and improve its advertising activities. As these cookies are not strictly necessary, the company generally requires prior consent to use them.
When visiting the online shop, the user is therefore given the option to consent to or reject the analytics cookies. The user decides not to consent to the analytics cookies.
The online shop must respect this decision and must not activate the analytics cookies requiring consent. The functions that are strictly necessary for the purchase can, however, continue to be provided.
legal data assessment: Companies should not automatically classify cookies as either strictly necessary or requiring consent. The decisive factors are the specific function of the cookie and the statutory requirements governing its use. The distinction between strictly necessary cookies and technologies used for analytics or marketing purposes is particularly important. Website operators should regularly review the cookies they use, provide transparent information about them and ensure that technologies requiring consent are only used after valid consent has been obtained.
Legal bases
In particular, Section 25 TDDDG and, where personal data is processed, Articles 4(11), 5, 6, 7, 12, 13 and 32 GDPR.
Related terms.
Consent Consent is one of the legal bases for the processing of personal data under the General Data Protection Regulation (GDPR). It allows data subjects to decide for themselves whether their personal data may be processed for specific purposes. For consent to be valid, it must be freely given, informed, specific and expressed through an unambiguous affirmative action. The relevant legal provisions are set out in particular in Article 4(11), Article 6(1)(a) and Article 7 GDPR. IP address An IP address is a numerical identifier used to address a device in a network such as the internet, and it can be personal data. Art. 4(1) GDPR Privacy notice A privacy notice informs data subjects about how a company or another controller processes personal data. In particular, it explains the purposes and legal bases of the processing, the retention period and the rights of data subjects. The legal requirements are set out in Articles 12 to 14 of the General Data Protection Regulation (GDPR). The aim is to ensure that data processing is transparent and understandable. 