Iubenda logo
Start generating


Table of Contents

Germany: which cookie consent rules apply

Must consent be granular in Germany? What about implied and on-scroll consent? Cookie consent rules may differ depending on the EU country. In this post, we’ll take a look at which GDPR cookie rules apply in Germany.

GDPR cookies rules for the UK

Is consent the only possible legal basis that can be applied to cookies – including analytics cookies?

The use of analytics cookies can actually be based on a legitimate interest (“Reichweitenmessung und statistische Analysen”) , subject to the conditions of Art. 6 of the GDPR.

In relation to the legal basis of legitimate interest, Art. 6 GDPR lit. f) states that the basis applies only if “the processing is necessary for achieving the goal of legitimate interest” and “it overweights potential harm (if any) to the interests and fundamental rights and freedoms of data subjects”.

It’s important to note that generally, where legitimate interest applies, the user also has the right to object to the processing. Also, do keep in mind that in one example, the German DSK has stated that using an analytics tool that transfers data to third parties would not be acceptable under legitimate interest.
You can find more information here (see p12).

Is cookie consent by scrolling allowed under German law?

No, Germany does not recognize consent by scrolling to be a valid indication of affirmative consent.

Under German law, is cookie consent by continued browsing allowed?

No. As with consent on scroll, Germany does not recognize consent via continued browsing to be valid. Consent should be given via a direct affirmative action.

Under German law, do I need to add a Reject button to my cookie banner?

Yes, this feature is explicitly required. The explicit reject button is also required by the UK, Ireland and the Netherlands.

German gdpr cookie consent rules

Do cookies have to be blocked before consent under German law?

Yes. Except for exempt categories (which very few cookies fall into), cookies must be blocked until users have given their informed consent.

Must cookie consent be granular in Germany?

While consent must be granular, currently, there is no clear indication as to how granular – the guideline simply states “it must be possible to select single processing activities singularly”. Furthermore, you must clearly separate cookies which require consent from those that do not.

Is proof of consent requested according to the criteria established under the GDPR?

Not yet specified. You can read more about records of consent here.

How iubenda can help you manage cookie consent

Our comprehensive cookie management solution allows you to:

  • easily inform users via cookie banner and a dedicated cookie policy page (which is automatically linked to your privacy policy);
  • obtain and save cookie consent settings;
  • collect granular, per-category consent;
  • preventively block scripts prior to consent;
  • apply the IAB Transparency and Consent Framework with a single click;
  • maintain records of consent via integration with our Consent Database (integration available upon request).

About us


Cookie consent management for the ePrivacy, GDPR and CCPA


See also