Is a cookie banner mandatory?

Last updated: 23 October 2026 · By Maurice, freeehouse team · About 3 minutes to read

What does the law say?

§ 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG for short, requires consent when information is stored on or read from a device. Exempt are processes that are strictly necessary for a service the user expressly asked for to work. The law was called TTDSG until May 2024. It applies to cookies and equally to similar techniques such as local storage in the browser.

What counts as technically necessary?

Typical examples that need no consent:

• a shopping cart in a shop
• a login that persists across several pages
• saving the choice made in the cookie banner itself
• security functions

Not technically necessary, on the other hand, are as a rule statistics tools with cookies, advertising and remarketing pixels and many embedded services that set their own cookies.

What does valid consent look like?

In 2019, in the Planet49 case, the Court of Justice of the European Union ruled that a pre-ticked checkbox is not valid consent. In 2020 the German Federal Court of Justice (BGH) adopted this in its Cookie-Einwilligung II judgment. It follows that:

• Nothing that needs consent may load before consent is given.
• Accepting and declining must be equally easy.
• Consent must be given freely, informed and for specific purposes.
• Visitors must be able to withdraw it at any time.

Can a website do without a cookie banner entirely?

Yes, if it uses only technically necessary storage. In practice that means:

• no statistics with cookies, or statistics that work without storing anything on the device and have been checked for data protection compliance
• fonts on your own server instead of from third-party servers
• maps and videos loaded only after a click, or as a link
• no advertising pixels

For many small businesses this is the better choice: less distraction, a faster site, less legal risk.

What about embedded maps and videos?

An embedded map or video loads content from third-party servers and transmits at least the IP address, and often cookies are set as well. The usual solution: load the embed only when the visitor actively clicks on it, with a short notice beforehand, or simply add a link.

This article is for orientation only and is not legal advice.

Websites from freeehouse often work with no cookie banner at all: no tracking cookies, fonts on our own server, maps and videos only after a click. We don't charge for the build, you only pay for hosting, cheaper than today. Claim your spot on the waiting list

How do I check whether my site sets cookies?

1. 1

   Open the site in a private browser window.

2. 2

   Open the developer tools and go to the section with the page's storage, where cookies and local storage are listed.

3. 3

   Click nothing and see what is already set on loading.

4. 4

   In the network section, check which third-party servers are requested.

Anything that loads before your consent and isn't strictly necessary is a problem.

What about statistics without cookies?

There are statistics tools that work without storing anything on the device. Whether they may be used without consent depends on the exact technology and the processing. If in doubt, have it checked. For many small businesses the Search Console data is enough anyway, as it needs no intervention on your site at all.

Frequently asked questions

Sources

• § 25 TDDDG Schutz der Privatsphäre bei Endeinrichtungen, accessed 23 October 2026
• EuGH, Urteil vom 01.10.2019, C-673/17 (Planet49), accessed 23 October 2026
• BGH, Urteil vom 28.05.2020, I ZR 7/16 (Cookie-Einwilligung II), accessed 23 October 2026

Providers' prices and terms change often. What counts is what's in your customer account and your contract. Not legal advice.

Read more