Cookie Banners: When You Need One — and How to Do Without
Key takeaways
- A site that sets only strictly necessary cookies and uses no external services usually needs no banner.
- Under § 25 TDDDG, not only storing on the device counts, but also reading from it.
- 'Cookieless' analytics in the browser often still reads device data and is legally uncertain in Germany.
- Server-side analytics doesn't touch the device at all — § 25 TDDDG doesn't apply.
- If a banner is needed, 'Reject' must be as visible as 'Accept'.
Nobody likes cookie banners. Visitors click them away in irritation, and many site owners don't really know why they have one.
The topic hides two opposite mistakes. Some sites show a banner they don't need at all. Others need one — and implement it in a way that's legally worthless.
The good news first: the best cookie banner is often the one you don't need. And for many small business sites, that's achievable.
This article covers the rules in Germany, which are stricter in wording than many assume. I'm a developer, not a lawyer; it describes the technical side. Where there's doubt, a legal review is worthwhile — particularly because competitors and consumer associations in Germany can take action against faulty banners.
Contents
When you don't need a banner
The basic rule is simpler than the ubiquitous banners suggest.
If your site sets only strictly necessary cookies and avoids external tracking services, a cookie banner is usually not required.
Strictly necessary means what's essential for a service the visitor has expressly asked for to work. Remembering a basket while someone shops, for instance. Or the session while someone's logged in.
A simple business site with no shop and no login often needs no such cookies at all. Then there's nothing for a banner to ask permission for.
What makes a banner necessary
It's usually not the site itself but something embedded along the way. The usual suspects:
Browser-based analytics. Google Analytics and similar services. Google Analytics transfers data to Google and is regarded by several EU supervisory authorities as not operable without consent.
Embedded videos and maps. A YouTube video or a Google Maps map loads content from the provider's server as soon as the page opens.
Fonts from third-party servers. If fonts load directly from Google rather than your own server, every visit opens a connection to Google.
Social media buttons and embedded posts. They connect to the respective platform.
Booking and chat widgets. Many load the provider's content when the page opens — more in the article on online booking.
Any of these can make a banner necessary. Remove or replace them and the banner often goes too.
The "cookieless" trap
This is the most common misunderstanding, and an expensive one.
Many analytics tools advertise that they work "without cookies". People often conclude: no cookie, so no banner. In Germany that doesn't automatically hold.
The reason lies in the wording of § 25 TDDDG — the law that replaced the former TTDSG on 14 May 2024. Consent is required not only for storing something on the visitor's device, but also for reading information already there. And that applies regardless of whether the information is personal data.
The argument "we don't store any personal data" is irrelevant under § 25 TDDDG.
Many "cookieless" trackers running in the browser still read information from the device to recognise returning visits — through a kind of fingerprint made of browser and device characteristics. That's access to the device. Such setups are considered legally uncertain in Germany.
The legal exception only applies where access is strictly necessary for a service the user wants. Audience measurement serves the operator, not the visitor. It doesn't fall under the exception.
The clean route: server-side analytics
There's a way that solves the problem at the root.
With server-side analytics, a tool evaluates the logs your web server writes anyway, or the server reports the page view itself. Nothing is stored on or read from the visitor's device. § 25 TDDDG simply doesn't come into play.
What remains is only the GDPR level. The IP address is personal data and needs a legal basis. For anonymised audience measurement without cross-site tracking, legitimate interest under Article 6(1)(f) GDPR is considered well defensible — particularly if the IP address is truncated before storage.
Matomo, for example, supports this server-side mode. The distinction matters: Matomo running in the browser with JavaScript is legally a different thing from Matomo evaluating server logs.
And even without a banner: the analytics must be described in your privacy policy. What else belongs there is in the article on Impressum and GDPR.
If you do need a banner
If you need one after all — because a video or shop system is embedded, say — it has to meet certain requirements.
Consent before access. No tracking script may load before the visitor has actively agreed. This order is technically decisive and often implemented wrongly in practice: the banner appears, but tracking is already running in the background.
Rejecting as easy as accepting. "Reject all" must be as visible and reachable as "Accept all". A big coloured accept button next to a hidden reject link isn't enough.
Voluntary and informed. The visitor must understand what they're agreeing to and mustn't be pressured.
Revocable. Consent must be as easy to withdraw later as it was to give.
Germany's Data Protection Conference, the joint body of the German supervisory authorities, published guidance on this for website operators in 2022.
How to do without a banner
For a typical small business site, these are the steps:
| Instead of | Better |
|---|---|
| Google Analytics in the browser | Server-side analytics, or none |
| Fonts from Google's servers | Fonts on your own server |
| A directly embedded YouTube video | A preview image; the video loads on click |
| An embedded Google Maps map | A static map image linking to Maps |
| Social media widgets | Plain text links to your profiles |
Each swap removes a reason for the banner. Once all are done, often none remains.
There's a side benefit: the site gets faster, because less third-party code loads. Hosting your own fonts and choosing a server tie closely to where your site lives — more in the article on hosting and SSL.
If you work with a site builder, you have less control here. Some builders ship a proper opt-in banner, others don't. The differences are in the comparison of builders and developed sites.
Frequently asked questions
Does every website need a cookie banner? No. A site that sets only strictly necessary cookies and uses no external tracking services usually needs no banner.
Do I need no banner if my analytics tool sets no cookies? Not automatically. Under § 25 TDDDG, reading information from the device also requires consent. Many "cookieless" browser tools do exactly that. The legally safe option is server-side analytics, which doesn't touch the device.
What's the difference between TTDSG and TDDDG? The TDDDG replaced the TTDSG on 14 May 2024. The cookie rules were carried over almost unchanged — the relevant provision is now § 25 TDDDG.
Can I use Google Analytics without consent? In practice, no. Google Analytics transfers data to Google and is regarded by several EU supervisory authorities as not operable without consent.
Must 'Reject' be as visible as 'Accept'? Yes. Both options must be equally reachable. A hidden reject link next to a big accept button isn't enough.
Do I have to mention analytics in my privacy policy even without a banner? Yes. Consent-free analytics still processes data and must be described in your privacy policy.
In short
Without tracking, without embedded third-party services and with only strictly necessary cookies, you usually don't need a banner. The trap is the word "cookieless": under § 25 TDDDG, reading from the device counts too.
The clean route to audience measurement without a banner is server-side analytics. And if a banner is needed after all, rejecting must be as easy as accepting — and tracking may only start after consent.