The TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) is the German law on data protection in telecommunications and digital services. For website operators and advertisers, one provision matters most: § 25 TDDDG. It decides when you may set cookies, load pixels or otherwise store or read information on your visitors' devices.
What does § 25 TDDDG regulate?
Under § 25(1) TDDDG, storing information on a user's device and accessing information already stored there is only allowed with consent. The consent must meet the GDPR standard: freely given, informed, unambiguous and given in advance.
§ 25(2) lists two exceptions where no consent is needed:
- The access serves only to transmit a message over a public network.
- The access is strictly necessary to provide a digital service the user has explicitly requested.
Strictly necessary are, for example, cookies for the shopping cart, the login or storing the cookie decision itself. Ad pixels, remarketing cookies and conversion tracking for ad platforms are, according to the prevailing view, not strictly necessary. For those you need consent, usually collected through a cookie banner.
Not only cookies
The term "access" is broad. Besides cookies it covers local storage, tracking pixels and scripts that read information from the browser. The European data protection authorities said so explicitly in their Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive. Fingerprinting is covered too, even though it works without cookies.
Relation to the GDPR and ePrivacy
The TDDDG and the GDPR work together:
- § 25 TDDDG governs access to the device, regardless of whether the data is personal.
- The GDPR governs the subsequent processing of personal data, for example when a pixel transfers data to Meta or Google.
For typical ad tracking you therefore usually need both: consent for device access under the TDDDG and a legal basis for processing under the GDPR, which for advertising purposes is usually consent as well.
§ 25 TDDDG implements Art. 5(3) of the European ePrivacy Directive. Other EU countries have their own laws with similar content.
From TTDSG to TDDDG
Until May 2024 the law was called Telekommunikation-Telemedien-Datenschutz-Gesetz, or TTDSG. When the German Digital Services Act (Digitale-Dienste-Gesetz) came into force on 14 May 2024, it was renamed because the term "telemedia" was replaced by "digital services". The cookie rules did not change.
Based on the law there is also the German Consent Management Ordinance (Einwilligungsverwaltungsverordnung), which governs recognised services for managing cookie decisions.
What will the Digital Omnibus change?
In November 2025, the European Commission proposed in its Digital Omnibus to move the cookie rules from the ePrivacy Directive into the GDPR and to create new exceptions. The Council drafts from autumn 2026, however, keep the rules in Art. 5(3) of the ePrivacy Directive and add a limited list of exceptions there, for example for anonymous, aggregated audience measurement. As of October 2026 there is no agreement between Council and Parliament. Until then, § 25 TDDDG applies unchanged.