Analytics in Germany. Our reading of §25 TDDDG.

Why this matters more in Germany

Germany consistently posts the highest cookie-rejection rates in Europe. The cultural baseline of privacy consciousness, the early hardening of §25 TDDDG (December 2021, ahead of most other EU implementations), and assertive state-level enforcement combine to produce a measurement landscape where banner-dependent analytics is structurally weaker than elsewhere.

Common DPO questions

Does the §25 TDDDG exemption apply to all analytics?

No. §25(2) exempts storage or access that is strictly necessary for a service the user requested, and the DSK does not extend that exemption to audience measurement. Cookie-based analytics with a visitor ID needs consent. Our reading is that no banner is needed for Sealmetrics, which stores nothing on the device and no data that identifies anyone, but it is not settled in Germany: the tracker reads device properties via JavaScript, which may count as access under §25(1). Check with your DPO.

What is the DSK orientation paper?

The Datenschutzkonferenz — the conference of all German federal and state data protection authorities — publishes joint guidance. The 2022 orientation paper on telemedia consent specifies when §25 TDDDG requires consent and when it does not. Unlike the CNIL, the DSK does not extend the §25(2) exemption to audience measurement.

Does the BfDI agree with the state authorities?

Generally yes. The BfDI handles federal-level matters; state DPAs (LDI NRW, LfD Bayern, etc.) handle most enforcement. State authorities can take stronger positions on individual cases — the LfD Bayern is historically the most assertive — but the underlying legal frame, §25 TDDDG read with the DSK orientation paper, is shared.

What about Google Analytics on a German site?

Google Analytics still requires consent under §25 TDDDG because it sets cookies and processes personal data through Google infrastructure (transfer to the US). The Garante Italian ban on GA4 in 2022 was followed by similar concerns from German authorities. Consent Mode v2 reduces the cookie load but does not change the fundamental processing nature. Sealmetrics sets no cookies and keeps visitor data in the EU; on the §25 question, see our reading above.

Do I still need a Datenschutzerklärung?

Yes. The privacy policy (Datenschutzerklärung) is required under GDPR Art. 13/14 regardless of consent mechanism. It must mention the analytics tool, its purpose, data categories (aggregated reports and a pseudonymised session identifier that rotates daily), retention period (24 months for Sealmetrics, fixed and non-configurable), and the lawful basis (Art. 6(1)(f) legitimate interest). A template ships with the TPSR package.

What's the position on the proposed Digital Omnibus?

It is a proposal, not law: COM(2025) 837, published 19 November 2025, still in the ordinary legislative procedure and realistically 2027–2028 before adoption, with substantive amendments likely. As drafted it would move the terminal-device rules into the GDPR under a new Article 88a and exempt first-party, aggregated audience measurement for the controller's own use — which would be a genuine change for Germany, where §25 TDDDG recognises no analytics carve-out today. Until a text is adopted, §25 TDDDG and the DSK orientation paper are what apply.