Almost every website shows a cookie banner on your first visit. Many people click “Accept all” out of habit without knowing what they are allowing. This guide explains which cookies you may refuse, which ones the law permits without consent and how to recognise a banner that breaks the rules.
Short answer: You may refuse cookies that are not strictly necessary, and the provider must make that possible without extra effort. The basis is Section 25 TDDDG, which requires consent for storing information on your device unless an exception applies. The Datenschutzkonferenz, the German data protection authorities’ conference, explains this in its guidance (status November 2024). Last updated: November 2026.
The most important points at a glance
- Cookies that are strictly necessary for a service you have expressly asked for do not require consent.
- For all other cookies, Section 25(1) TDDDG requires consent, even where no personal data is stored.
- A cookie may not be set before you have consented. Opting out by doing nothing is not enough.
- Refusing must be possible without additional clicks. A button “Accept all” next to a complicated settings menu is problematic.
- If a banner makes refusing harder, you can decline and still use the site, provided it does not exclude you.
What the law requires for cookies
The central provision is Section 25 TDDDG, the German Telecommunications Digital Services Data Protection Act. Under subsection 1, storing information on your terminal equipment and accessing information already stored there is only allowed if you have consented on the basis of clear and comprehensive information. The information and the consent follow the rules of the GDPR.
Subsection 2 sets out the exceptions. No consent is required where the sole purpose is transmitting a message over a public telecommunications network. Consent is also not required where storage or access is strictly necessary so that the provider can deliver a digital service you have expressly requested. This is where the decision about which cookies you can refuse is made.
Which cookies you may refuse
In everyday use the distinction is simpler than it sounds. A cookie that keeps a shopping cart you filled yourself serves a service you are actively using. A cookie that recognises you across several pages in order to show advertising serves a different purpose. The table below classifies typical examples. It does not replace a check of the individual case.
| Cookie type | Example | Consent needed? |
|---|---|---|
| Strictly necessary for a service you requested | Shopping cart, login status, language setting you chose | No, exception under Section 25(2) No. 2 TDDDG |
| Advertising and profiling | Recognition across several pages for ads | Yes, consent under Section 25(1) TDDDG |
| Audience measurement and analytics | Statistics on page views | Generally yes, unless the exception clearly applies |
| Functions you did not expressly request | Embedded maps or videos from third parties | Usually yes, if the provider sets them |
The specific purpose always matters. If a provider uses one cookie for several purposes, it cannot simply extend your consent to all of them. The refusal option must therefore work for the cookies that are not necessary, without you having to deselect individual purposes one by one.
Why a cookie without personal data can still require consent
Many users believe that cookies without a name or an email address are harmless. The Datenschutzkonferenz makes clear in its guidance that the duty to obtain consent applies regardless of whether the cookie contains personal data. The law therefore attaches to access to your device and not only to the question of whether a record about you is created.
The guidance is an interpretation by the supervisory authorities, not a court ruling. It nonetheless shows how the competent bodies apply the rules, and complaints can rely on it. The text also emphasises that Section 25 TDDDG corresponds in substance to the earlier Section 25 TTDSG.
How to recognise a banner that breaks the rules
A banner that does not meet the requirements usually has recognisable features. The guidance names several points that speak against voluntary consent. The checklist below summarises the most important ones and is meant as orientation.
- The site sets cookies on the first visit, before you have decided anything.
- An opt-out in which you merely keep browsing or do nothing counts as consent. The guidance considers such procedures unsuitable.
- A button “Okay” or “Accept” does not explain what you are consenting to.
- Refusing requires several layers, while agreeing takes a single click.
- A button “Accept all” stands next to a settings menu without an equally prominent refusal option.
The guidance speaks of artificially constructed effort where a second banner layer serves only refusal. If refusing requires much more effort than agreeing, voluntariness is regularly absent.
What you do when a banner breaks the rules
First open the settings on the site and switch off all categories that are not necessary. If that is not possible because the site makes refusal harder, this is a sign of the problem. You can then consider whether you really need the service or whether an alternative provider is an option.
It is also worth looking at your browser settings. There you can restrict third-party cookies or delete them after a visit. This does not replace consent, but it reduces recognition across several pages. The guide on app permissions (in German) shows how to check access rights in apps.
Frequently asked questions
May a banner make refusing harder?
According to the Datenschutzkonferenz guidance, refusing should be possible without additional clicks. Extra effort that serves only the refusal undermines the voluntariness of the decision. Whether a specific banner meets the requirements depends on its design in the individual case.
Must I always refuse cookies if the site needs them?
Not necessarily. Cookies that are strictly necessary for the service you actively use do not require consent. Anything beyond that, such as advertising or audience measurement, you may refuse. The site must not exclude you merely because you did not consent, if the refusal unnecessarily blocks access.
Is it enough to delete all cookies in the browser?
Deleting helps but does not replace the decision in the banner. On the next visit the site can ask for consent again. Lasting protection comes more from restrictive browser settings and deliberately refusing third-party cookies.
What happens if I have already consented?
You can usually withdraw a consent you have given, for example through the cookie settings of the site. The withdrawal takes effect for the future. A site that does not let you withdraw consent conflicts with the requirements for a voluntary decision.
Does this also apply to apps?
The guidance deals with digital services in general, not only with websites. Apps are additionally subject to the tracking and permission mechanisms of the respective operating system. The principles on consent remain essentially the same.
What to do now
- Read the options in the next banner before you click.
- Refuse all categories that are not strictly necessary, as long as refusing is possible without great effort.
- Document banners that strike you, with a screenshot and the date, in case you want to complain.
- Check your browser settings to decide which third-party cookies you want to block permanently.
Related guides
- Digital rights in everyday life: the overview for students
- Right to erasure: how to have data removed from online services
- Fitness trackers and health data: who may store the values
- Data breach at a service: what you should do now
Sources: Section 25 TDDDG, gesetze-im-internet.de, retrieved November 2026; Guidance on digital services by the Datenschutzkonferenz, status November 2024.
Last updated: November 2026. This guide is general information, not individual advice.
