What is cookie consent?

Cookie consent: definition and legal basis

Cookies are small text files that a website stores in the browser. Legally, more is at stake: Section 25 TDDDG (the German Telecommunications Digital Services Data Protection Act) requires consent when information is stored on or read from a device—whether through cookies, local storage or fingerprinting. The exception is anything strictly necessary for a service the user has requested.

If personal data is processed in the process, the validity of consent is governed by the GDPR. It must be given freely, for a specific case, in an informed way and unambiguously, through an active action. Pre-ticked boxes are not enough, as the European Court of Justice ruled in 2019 in the Planet49 case. Withdrawing consent must be as easy at any time as giving it.

What a consent banner must do

A consent banner, technically usually a consent management platform (CMP), informs visitors about purposes, providers and storage periods and lets them accept or reject categories individually. According to the guidance of the German data protection authorities, an equivalent option to reject should appear on the first layer next to “Accept all.” Misleading design puts the validity of consent at risk.

• Services load only after consent is given
• Rejecting is as easy as accepting
• Categories and providers explained with purpose and storage period
• Withdrawal possible at any time, for example via a link in the footer
• The decision is logged and stored in a verifiable way

Real-world example: a supplier with web analytics and videos

A mechanical-engineering supplier uses web analytics, embeds YouTube videos and loads fonts from an external server. Its banner offers only an “OK” button, while analytics and videos already run on the first page view. Data is therefore set and transmitted before anyone has agreed—consent would be questionable even if a visitor clicked later.

The fix: analytics and videos start only after consent, fonts are hosted locally, the banner texts name the providers, and a second button allows rejecting. The system also logs every decision. Necessary cookies—for example for login or for storing the cookie choice itself—remain permitted without consent.

Limits and common mistakes

A banner does not fix faulty technology. The most common mistake: scripts load in the background even though the banner is still open or the visitor has rejected. Other problems are outdated provider lists, wrongly classifying services as “necessary,” and privacy notices that do not match actual use. A look at the browser’s developer tools quickly shows what is really being loaded.

Consent may be needed even without cookies, for example for tracking pixels or fingerprinting that read information from the device. And even where Section 25 TDDDG does not apply, the GDPR question remains whether there is a legal basis for processing the data collected and whether visitors were informed about it.

What companies should look out for

First record which services your website actually uses and decide which are truly needed—every tool you drop makes consent simpler. Choose a CMP that technically blocks services, logs decisions and fits your tag management. Nano Concepts sets up consent solutions cleanly on the technical side and checks that nothing loads before consent. This article does not replace legal advice.