What changed for websites
Since late 2021, many German sites must treat non-essential cookies and comparable tracking like the ePrivacy model: consent before storage or access, with narrow exceptions for strictly necessary uses. Marketing and analytics tags that used to load on page view often need an explicit opt-in first.
Practical impact: your banner, tag manager, and server-side tags must align — and you need to show that Reject is honored, not only that a CMP is installed.
TTDSG vs. GDPR
- TTDSG — when you may store or read on the device (cookie / similar tech rules in Germany).
- GDPR — how personal data from those technologies is processed, documented, and protected.
- Both apply to many German-facing properties; EU visitors elsewhere may trigger additional national implementations of the ePrivacy framework.
Auditing under German expectations
Regulators and courts care about what loads in practice. A documented cookie list that does not match a live session is a common finding. CookieComply scans production or staging in Chrome so privacy and marketing teams can show which trackers fire before consent — without deploying another visitor-facing script.