Cookie banners and data protection: the essentials

When is consent required?

Storing or reading information on a user’s device that is not strictly necessary for the service requested generally requires consent (section 25 TDDDG; for personal data, the GDPR applies in addition). This typically affects advertising and analytics services as well as embedded third-party content.

What works without consent

• Technically necessary functions such as a shopping basket
• A website without tracking and without embedded third-party content

The privacy-friendly approach

• Host fonts locally instead of loading them from external servers
• Do without tracking, or choose a solution that uses no personal data
• Load maps and videos only after a click
• Keep forms to the necessary fields only
• Keep your privacy policy up to date and name all the services you use

When a banner is needed

In that case: declining must be just as easy as accepting, pre-ticked boxes are not permitted, and services only start after consent has been given. Have the implementation checked by a lawyer.

Which services typically require consent

• Analytics tools that make visitors recognisable or pass data to third parties
• Advertising and remarketing pixels from social networks and ad networks
• Embedded videos and maps that send data to the provider when they load
• Fonts loaded from external servers, because the IP address is passed to the provider

Whether consent is needed in an individual case depends on exactly what is used and how. Assessing that is a job for a specialist.

Typical banner mistakes

• Services start before consent: The banner appears, but scripts are already loading in the background. Then it is just decoration.
• Declining is hidden: A prominent button for “Accept all” and a small text link for declining are considered problematic.
• Vague wording: If people cannot tell what they are agreeing to, they have not validly consented.
• No way to withdraw consent: Consent must be just as easy to withdraw later, for example via a link in the footer.

Worked example: a map on the contact page

A map with directions is useful to many visitors. If it is embedded directly, it loads data from the map provider as soon as the page is opened. A privacy-friendly solution first shows a static preview image with the note “Load map”. Only after the click is the actual map fetched. For visitors who just need the address, nothing changes. In addition, the address should always appear as text, along with a link to route planning.

Myth versus fact

Myth: A banner protects you from warning letters, whatever is running behind it. Fact: What matters is what actually happens. A banner that does not really control services offers no protection. A website that uses nothing requiring consent generally needs no banner at all. You can check this in the browser’s developer tools: in the “Network” tab you can see which external addresses are contacted while the page loads. The duty to inform in the privacy policy is unaffected, including for contact forms.

Checks before going live

1. Open the page in a private browser window and, in the developer tools under “Network”, see which external servers are contacted before anything has been clicked.
2. For every external address you find, clarify what it is needed for and whether the service is named in the privacy policy.
3. Look at the stored cookies in the “Application” tab and assign each one a purpose.
4. Test the banner: choose decline and check whether the services really do not start.
5. Repeat the check after every major change, such as a new video.

Do not forget documentation

Record which services you use, what for, with which provider and since when. This list helps with the privacy policy, with requests from data subjects, and with every change to the site. As a rule of thumb for extensions and embeds: whatever is not on the list is not built in until someone has checked what it passes on to third parties.

This website manages without tracking and third-party services. More under Websites.