Cookie consent means that no tracking script may be loaded before the user has actively consented. The TTDSG (Section 25) and the GDPR make this consent mandatory for every website that uses non-essential cookies or comparable technologies. The German Data Protection Conference (DSK) additionally clarified in 2024 that dark patterns in cookie banners are unlawful. Since February 2024, Google also requires Consent Mode v2 for all advertisers in the EEA.
Legal Framework: TTDSG and GDPR Working Together
The TTDSG has regulated access to end devices since December 2021. Section 25, Paragraph 1 TTDSG requires consent before information is stored on or read from the end device. This applies not only to cookies but also to local storage, fingerprinting, and similar technologies.
The GDPR additionally applies as soon as personal data is processed. In practice, this means: virtually every analytics tool and every marketing pixel requires informed, voluntary consent. Only technically necessary cookies are exempt, such as those for shopping carts or session management. More on the legal foundations can be found in the article on GDPR-compliant web development .
Cookie Categories: What Is Necessary and What Is Not?
A clean consent system distinguishes at least three categories. This classification is not only legally relevant but also determines the technical implementation: which scripts are loaded immediately, and which only after consent?
- Necessary cookies: Session IDs, CSRF tokens, language settings, shopping cart. These may be set without consent.
- Statistics/Analytics: Google Analytics, Matomo, Hotjar. Require consent unless fully anonymized and server-side (e.g., Matomo without cookies).
- Marketing/Tracking: Google Ads, Meta Pixel, LinkedIn Insight Tag. Always require active consent.
- External media: YouTube embeds, Google Maps, social media widgets. Often load tracking cookies and therefore also require consent.
Dark Patterns: What the DSK Prohibits
The 2024 DSK guidance makes unmistakably clear: cookie banners must not manipulate users. In practice, however, numerous websites still operate with problematic patterns.
- No equivalent reject button: The reject button must be just as visible and accessible as the accept button. Hidden links or small text links are insufficient.
- Pre-selected checkboxes: All non-essential categories must be deactivated by default.
- Repeated prompting: Users who decline must not be asked again on every page view.
- Misleading color schemes: The accept button must not be visually dominant while the reject button appears grayed out.
- No revocation option: Users must be able to withdraw their consent at any time.
Technical Implementation: Consent Before Script
The central technical principle is: no non-essential script may be loaded before consent. This means that Google Analytics, the Meta Pixel, and all other tracking scripts must not be in the HTML but must be dynamically injected only after positive consent.
Consent Management Platforms (CMPs) such as Cookiebot, Usercentrics, or Klaro handle this control. They block scripts by default and release them only after consent. Alternatively, a custom system can be implemented where scripts are blocked via the type attribute (type="text/plain" instead of type="text/javascript") and dynamically activated after consent.
Integration with Google Tag Manager is crucial. Since February 2024, Google requires Consent Mode v2 for all advertisers in the EEA. Without correct consent signals, Google Ads receives no conversion data. Consent Mode sends two signals: ad_storage and analytics_storage, each with the value "granted" or "denied". The technical details for GDPR-compliant forms can serve as a foundation for the consent implementation.
CMP vs. Custom Solution: What Makes Sense for SMEs?
For most SME websites, an established CMP is the more pragmatic choice. Solutions like Cookiebot (from approximately 12 euros/month) or Usercentrics offer automatic cookie scans, legally compliant templates, consent logging, and integration with Google Consent Mode. Setup time is typically 2 to 4 hours.
A custom solution is worthwhile only when special requirements exist: very high page views (CMP costs increase with traffic), specific UX requirements, or an existing tag management system. Development effort is then 15 to 30 hours, plus ongoing maintenance for legal changes.
Conclusion: Consent Is Not a UX Question, But a Technical Obligation
Cookie consent is a technical-legal topic that must be considered from the very beginning of every website. The requirements are clear: no dark patterns, no pre-selected options, no tracking without consent, Consent Mode v2 for Google services. Those who follow these fundamentals protect themselves from legal action and simultaneously build trust with users.
For SMEs, an established CMP that is correctly configured and regularly reviewed is recommended. Technology, law, and user experience must be treated as a unified whole.
