Law & websites · 4 November 2026 · 5 min read
Cookie banners and GDPR: what's really needed (and what isn't)
Do I even need a cookie banner? What § 25 TDDDG and the GDPR require, typical mistakes, and how a website can work with no banner at all.
Few things annoy visitors like a giant cookie banner. At the same time many businesses fear cease-and-desist letters. The good news: often less is needed than you think, if the website is built cleanly from the start.
The basic rule
Since May 2024 the former TTDSG is called the "Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz" (TDDDG). Under § 25, storing or reading information on a visitor's device (e.g. cookies) requires consent unless it's strictly necessary for the requested service. Further processing of personal data is additionally governed by the GDPR.
What needs no consent
- Technically necessary storage, e.g. a cart, a login or the chosen language
- Storing the cookie choice itself
What needs consent
- Analytics and tracking tools that set cookies or recognise devices
- Marketing pixels (e.g. from social networks)
- Embedded third-party content that transfers data on load, such as maps or videos
Typical mistakes
- "Accept all" big, "Reject" hidden: rejecting must be just as easy
- Pre-ticked boxes
- Tracking starts before anyone agrees
- Google Fonts or other services loaded straight from third-party servers
The most elegant way: no banner needed
A site that serves its own fonts, skips unnecessary trackers, uses cookie-free analytics and loads maps or videos only after a click often needs no banner at all. That's exactly how this website is built: the only thing stored is your language choice, which is technically necessary.
More notes