Analytics in Germany. Without an Einwilligungsbanner.

Why this matters more in Germany

Germany consistently posts the highest cookie-rejection rates in Europe. The cultural baseline of privacy consciousness, the early hardening of §25 TTDSG (December 2021, ahead of most other EU implementations), and assertive state-level enforcement combine to produce a measurement landscape where banner-dependent analytics is structurally weaker than elsewhere.

Common DPO questions

Does the §25 TTDSG exemption apply to all analytics?

No. The exemption requires that the analytics is strictly necessary for the operation of the service, OR meets the conditions for anonymous audience measurement — no terminal-device storage, no cross-site tracking, no personal data, EU processing. Cookie-based analytics with a visitor ID does not qualify; SealMetrics' aggregate cookieless architecture does.

What is the DSK orientation paper?

The Datenschutzkonferenz — the conference of all German federal and state data protection authorities — publishes joint guidance. The 2022 orientation paper on telemedia consent specifies when §25 TTDSG requires consent and when it does not. The conditions for the exemption align with the EDPB Opinion 5/2019 and the CNIL guidance: aggregate, anonymous, EU-hosted, no identifier on the device.

Does the BfDI agree with the state authorities?

Generally yes, on the exemption itself. The BfDI handles federal-level matters; state DPAs (LDI NRW, LfD Bayern, etc.) handle most enforcement. The 2024 BfDI activity report reaffirmed the analytics exemption framing consistent with the DSK position. State authorities can take stronger positions on individual cases — the LfD Bayern is historically the most assertive — but the underlying legal frame is harmonised.

What about Google Analytics on a German site?

Google Analytics still requires consent under §25 TTDSG because it sets cookies and processes personal data through Google infrastructure (transfer to the US). The Garante Italian ban on GA4 in 2022 was followed by similar concerns from German authorities. Consent Mode v2 reduces the cookie load but does not change the fundamental processing nature. SealMetrics operates outside that framework entirely.

Do I still need a Datenschutzerklärung?

Yes. The privacy policy (Datenschutzerklärung) is required under GDPR Art. 13/14 regardless of consent mechanism. It must mention the analytics tool, its purpose, data categories (channel-level aggregates only), retention period (25 months by default for SealMetrics), and the lawful basis (Art. 6(1)(f) legitimate interest, paired with the §25 TTDSG exemption). A template ships with the TPSR package.

What's the position on the new Digital Omnibus 2026?

The Digital Omnibus tightened banner-design enforcement at the EU level and gave authorities sharper Art. 5(3) (and equivalent §25 TTDSG) tools. The analytics exemption itself survived intact. German authorities have welcomed the harmonisation — Germany historically had stricter banner rules than the EU average, and the new floor brings other markets closer to the German position rather than weakening it.