Marketing needs data, but in Germany privacy laws set clear limits. Good setups respect user choices and still provide useful insights.
This is general information, not legal advice.
The legal basics
- The TTDSG requires consent before storing or reading information on a user's device (cookies, local storage, device IDs), unless it is strictly necessary.
- The GDPR governs the processing of personal data such as IP addresses and user IDs.
In practice, most analytics and advertising tracking requires prior opt-in consent.
Consent banners done right
- Equal prominence for "accept" and "reject"
- No pre-ticked boxes
- Clear categories and purposes
- Easy way to change or withdraw consent later
- No tracking before consent
Google Consent Mode
Consent Mode adjusts how Google tags behave based on consent. Implement it correctly so tags respect choices and Google can model conversions where allowed.
Privacy-friendly analytics
Tools that work without cookies or personal data, or self-hosted analytics, can provide basic statistics with less legal friction. Evaluate them with your data protection officer.
Server-side tracking
Sending data via your own server gives more control over what is shared with third parties. It is not a way around consent requirements – it is a way to implement them more cleanly.
Documentation
List all tools in your privacy policy, sign data processing agreements and check international transfers.
What you can still measure
- Conversions from consenting users
- Aggregated, modelled data
- First-party data from forms and CRM
- Campaign tags (UTM parameters) on links
Balance
Focus on the metrics you actually use for decisions; collecting less often means less risk and clearer reports.
The cookie banner on this website follows these principles: no optional tracking without consent, and settings that can be changed at any time.