What applies today: Section 25 TDDDG
The rule in force fits into a single sentence: storing information in a user's terminal equipment and accessing information already stored there are permitted only if the end user has consented on the basis of clear and comprehensive information (Section 25 subsection 1 TDDDG). The Act dates from 23 June 2021 and was last amended by Article 3 of the Act of 10 March 2026 (TDDDG, consolidated version); the consent requirement itself did not move.
The Act names two exceptions and no more (Section 25 subsection 2 TDDDG). The first covers carrying out the transmission of a message over a public telecommunications network. The second applies where access is strictly necessary for the provider to supply a digital service the user has expressly requested. Anyone pulling audience measurement under the second exception is arguing against the wording: the measurement serves the provider, while what the user requested was the page.
A breach of subsection 1 sentence 1 is an administrative offence and can be punished with a fine of up to 300,000 euros (Section 28 subsection 2 TDDDG). That is the statutory ceiling, not the routine outcome - but it is the ceiling that stands open today, while the draft is still being negotiated.
Two features of the German rule are regularly overlooked. First, it applies regardless of whether the stored information relates to an identifiable person: the supervisory authorities record that Section 25 subsection 1 TDDDG establishes a consent requirement independently of any personal reference and therefore reaches beyond the scope of the General Data Protection Regulation (DSK, paragraph 26). Second, consent is tied to the specific case: if the cookies in use or the embedded third-party services change, the original consent becomes void and has to be obtained again (DSK, paragraph 63). How such a silent change in the tag inventory becomes visible is covered in the article on monitoring consent and tag drift.
There is also a supervisory line on design. A refusal option on the first layer is not required across the board, but it is required where users have to interact with the banner in order to continue their visit (DSK, paragraph 124). Where a refusal button is offered next to the consent button, its label has to be unambiguous; a button reading settings or reject that leads to a further layer does not suffice at this point (DSK, paragraph 137). What that means for the structure of a banner is set out in the article on implementing cookie consent correctly.
Until adoption, the law as it stands applies unchanged. Switching off the banner now is unlawful and invites a cease-and-desist letter. Every statement in this article about Articles 88a and 88b describes a proposal, not law in force - and the wording can still change in the course of the procedure.
What the proposal contains: Articles 88a and 88b
The Commission transmitted its proposal to the Council on 20 November 2025 as part of a larger package simplifying the digital legislative framework (Council of the EU, progress report of 1 June 2026). The principle would remain: storing personal data in terminal equipment and gaining access to it would be permitted only with consent (Commission proposal, Article 88a paragraph 1). What would be new is the location of the rule - it would sit in the General Data Protection Regulation rather than in the ePrivacy Directive.
Considerably wider than today is the list of purposes that would require no consent. The proposal names four (Commission proposal, Article 88a paragraph 3):
- Transmission of an electronic communication over an electronic communications network - in substance the first exception in force today.
- Providing a service explicitly requested by the data subject. Today this exception is confined to information society services; the proposal drops that limitation (EDPB and EDPS, paragraph 101).
- Creating aggregated information about the usage of an online service to measure its audience, where the controller of that service carries it out solely for its own use. There is no such exception in the law in force.
- Maintaining or restoring the security of a service provided by the controller and requested by the user. This exception would also be new.
Where consent would still be needed, the proposal sets out three duties (Commission proposal, Article 88a paragraph 4). The data subject would have to be able to refuse the request in an easy and intelligible manner with a single-click button or equivalent means. After consent has been given, no fresh request for the same purpose would be allowed for as long as the controller can lawfully rely on that consent. And after a refusal, no new request for the same purpose would be permitted for at least six months. Article 88a is meant to apply six months after the Regulation enters into force (Commission proposal, Article 88a paragraph 5).
Article 88b would address the technical side. Controllers would have to design their interfaces so that consent and refusal can also be expressed in an automated, machine-readable way, and they would have to respect those expressions. Those two paragraphs are meant to apply 24 months after entry into force (Commission proposal, Article 88b paragraph 5). Providers of web browsers that are not small or medium-sized enterprises would have to supply the technical means for it - a duty set to bite only 48 months after entry into force (Commission proposal, Article 88b paragraph 7). The Commission is to request European standardisation organisations to draw up standards for interpreting such signals.
The six months in Article 88a paragraph 4 are the blocking period after a refusal. The six months in Article 88a paragraph 5 are the gap between the Regulation entering into force and becoming applicable. The two periods start from different events, and at present neither of them is running.
Where the procedure stood in August 2026
A Commission proposal is the start of a procedure, not its outcome. The file runs under the ordinary legislative procedure, so Parliament and Council have to agree. The Parliament's procedure file records publication of the proposal on 19 November 2025, the announcement of the committee referral on 19 January 2026 and the appointment of the rapporteurs on 25 February 2026 (procedure file of the European Parliament). Two committees share responsibility. A draft committee report is dated 22 June 2026, the amendments tabled in committee 27 July 2026; the stage reached is recorded as the committee decision, which is still pending.
In the Council, the Presidency's third compromise text is on the table. It was presented at the meeting of the responsible working party on 27 May 2026 and takes account of written contributions from delegations and of a technical workshop held on 5 May 2026 (Council of the EU, progress report of 1 June 2026). In substance, the compromise text carries the most consequential point of the whole procedure for practitioners: on the proposed Article 88a, the Presidency opposes moving those provisions under the General Data Protection Regulation and instead amends the current rules in the ePrivacy Directive so they stay within a single specific legal framework, clarifying the exceptions proposed by the Commission there, expressly including independent audience measurement (Council of the EU, paragraph 18). The proposed Article 88b is meanwhile carried as a new Article 8a; the Presidency wants the revised provision to stay within the framework of the General Data Protection Regulation, with greater weight on the standardisation process (Council of the EU, paragraph 19).
A second point from the same report belongs in any assessment: the absence of an impact assessment for the proposal was raised repeatedly by a large number of delegations, in particular in relation to the provisions touching the General Data Protection Regulation (Council of the EU, paragraph 22). A file in which article numbers, the location of the rules and even the legal instrument are still in motion is no basis for rebuilding your own setup.
| Point | Law in force today | Commission proposal | Council compromise text |
|---|---|---|---|
| Legal instrument | ePrivacy Directive, transposed in Section 25 TDDDG | General Data Protection Regulation, Article 88a | ePrivacy Directive, amended there |
| Consent-free purposes | two, narrowly framed | four, including audience measurement and security | the four purposes clarified within ePrivacy |
| Refusal with one click | only where interaction is required, per supervisory reading | express duty in Article 88a paragraph 4 | open in the procedure |
| Blocking period after refusal | no statutory period | at least six months | open in the procedure |
| Machine-readable signal | only via recognised consent management under national law | Article 88b, from 24 months after entry into force | as a new Article 8a, emphasis on standardisation |
| Applicable since | 1 December 2021 | six months after the Regulation enters into force | open |
What the data protection authorities criticise
The European Data Protection Board and the European Data Protection Supervisor adopted a joint opinion on 10 February 2026. Their central objection is not a detail but the architecture: protection of terminal equipment would sit partly with the General Data Protection Regulation and partly still with the ePrivacy Directive, producing two different regimes depending on whether the data are personal or not (joint opinion of the EDPB and the EDPS). Information in terminal equipment can be both at once - in which case the processing of personal data might rely on an exception under Article 88a paragraph 3, while consent would still be required for the non-personal data under the ePrivacy Directive.
For Germany the point is particularly tangible, because Section 25 TDDDG does not hinge on a personal reference at all (DSK, paragraph 26). An audience measurement that writes a purely technical identifier into terminal equipment would fall under the German rule even where it identifies nobody in data protection terms. The stated goal of simplification would therefore not be reached here as a matter of course - at least not while the ePrivacy Directive remains alongside.
The authorities also comment on the new audience measurement exception. They recommend clarifying that the aggregated information must be anonymous and must not relate to an identified person, that the data collected must not be further processed for another purpose, must not be combined with data from other services of the provider or of a third party, and must not be shared with third parties (EDPB and EDPS, paragraph 102). Those three conditions decide whether a measurement would fall under the exception at all - and they are stricter than the short wording in the proposal first suggests. What that means for the design of a measurement setup is covered in the article on analytics without consent banners.
The authorities also spot a practical contradiction: to observe the six-month blocking period after a refusal, the controller would have to record that refusal - which means accessing terminal equipment again. They therefore suggest adding an express exception for that case, provided no unique identifier is used but a general entry that is the same for every person who has refused (EDPB and EDPS, paragraph 106). The rule meant to make banners rarer thus needs an entry in the browser of its own.
On one point the endorsement is clear: the requirements for automated, machine-readable expressions are strongly welcomed, because technical means can simplify compliance and make choices effective. They would also address the fatigue caused by repeated consent requests, since data subjects currently have no mechanism for expressing their preferences across sites (EDPB and EDPS, paragraph 108).
Germany's own route to consent management is already running
What Article 88b proposes at European level, Germany has already regulated on its own route - voluntarily rather than as a duty. Section 26 TDDDG allows services for managing consent to be recognised if they meet four conditions: a user-friendly and competition-compliant procedure, no economic self-interest in consent being given, processing of the data solely for consent management, and a submitted security concept (Section 26 subsection 1 TDDDG).
The details sit in the Consent Management Regulation of 6 February 2025, whose text has been on record since 1 April 2025 (EinwV, consolidated version). It contains three points worth comparing with the draft. First, a recognised service may prompt users to review their settings at the earliest after one year, unless the end user has provided otherwise (Section 4 subsection 2 EinwV) - a period pointing in the same direction as the six months in the proposal, only longer and tied to a different event. Second, manufacturers and providers of retrieval and display software are to ensure, within the technical possibilities, that stored signals and settings are neither suppressed, delayed nor decrypted nor altered in any other way (Section 17 EinwV). Third, providers of digital services that integrate a recognised service take the end users' settings into account (Section 19 subsection 1 EinwV).
The difference from the draft is the point of connection: consent management under German law takes effect where a provider integrates it. Article 88b would turn respect for machine-readable expressions into a general duty and would put browser providers under an obligation. Both routes rest on the same prerequisite: a site that knows which scripts it loads at all and what their execution depends on.
Which work pays off under either regime
The interesting part of this procedure is how much preparation is worth doing without betting on an outcome. The five steps below are required under the law as it stands and would remain sensible if the draft became law in the Commission's version or in the Council's.
- Take stock before consent. Load every important page without any interaction with the banner and record which cookies are set and which third-party connections are opened. Everything happening before consent needs an exception under Section 25 subsection 2 TDDDG today - and one under Article 88a paragraph 3 under the draft.
- Record the purpose per entry, not per tool. Both regimes attach to the purpose, not to the vendor's name. A tool serving four purposes needs four rows in the record.
- Make refusing as easy as consenting. Under the current supervisory reading, refusal has to be possible without extra clicks where the banner blocks access (DSK, paragraph 124). Under the draft, a single-click refusal button would be an express duty. Building it today is right in both directions.
- Document consents and tie them to the specific case. If the inventory of cookies or third-party services changes, the earlier consent becomes void (DSK, paragraph 63). Without a change log, neither the time nor the scope can be evidenced.
- Build the measurement so it stands without consent. An audience measurement that does not touch storage in terminal equipment at all already falls outside Section 25 TDDDG today. It would at the same time meet the narrow conditions the authorities want attached to the proposed audience measurement exception (EDPB and EDPS, paragraph 102).
The last point is the only one that calls for an architectural decision - and the only one that pays off under either regime. How such a measurement is built and what it delivers is set out in the overview of GDPR-compliant website analytics; the same structure applies to experiments, described under A/B testing without consent banners.
# One row per cookie and per third-party connection, collected daily
# Column 2 is the only one that decides between lawful and unlawful
Page before consent Name Purpose Sec. 25(2) no. 2 TDDDG
/ yes session_id basket applies
/ yes visitor_metric audience does not apply
/pricing no test_variant A/B test only after consent
/blog yes third_party_script map does not apply
# Every row with "yes" in column 2 and "does not apply" in column 5
# is a finding today - regardless of how the procedure ends.The table looks banal and is not: it is the only form in which a site's state can be checked against both regimes without knowing the draft's final wording. It is also the basis for a data protection impact assessment for web tracking, should one become necessary.
What is not worth doing right now
Three reactions to the reporting on the proposal are common and wrong on the merits.
- Switching off or trimming back the banner. The proposal has not been adopted, and even the Commission's version would apply only six months after the Regulation entered into force (Commission proposal, Article 88a paragraph 5). Until then Section 25 subsection 1 TDDDG remains applicable unchanged.
- Relying on the new exception for audience measurement already. The exception does not exist in the law in force. Even if it arrived, it would require anonymous aggregates with no combination and no sharing (EDPB and EDPS, paragraph 102).
- Waiting for the browser signal and doing nothing until then. The relevant paragraphs are meant to bite only 24 months after entry into force, the duty on browser providers only after 48 months (Commission proposal, Article 88b paragraph 7). And in the Council that part is meanwhile carried as a new Article 8a (Council of the EU, paragraph 19).
Whether you build audience measurement so that it works without touching terminal equipment is a technical decision with a legal side effect. It comes out right today - under Section 25 TDDDG, under the Commission's proposal and under the Council's compromise text. The same holds for retention periods for monitoring and analytics data: short periods are defensible under any conceivable version.
How to measure the state of play continuously
A cookie inventory ages fast. A new campaign, an embedded video, an updated framework - and something is running before consent that was not running yesterday. That case is the expensive one: the consent obtained for the old inventory no longer covers the new one (DSK, paragraph 63).
The page is loaded without any interaction with the banner. What counts is what the browser stores in that state and where it opens connections - the state Section 25 subsection 1 TDDDG addresses.
A new entry before consent is a finding, not a hint. It shows that the specific case has changed and that the existing consent would have to be obtained again.
Each entry carries the purpose from the record of processing activities next to it. Without that column no exception can be checked, neither the current one nor a future one.
A finding that only surfaces at the next audit is months old. An alert on the day of deployment keeps the window small in which measurement runs without a legal basis.
The same principle carries beyond consent: data flows to third countries and session recordings can only be assessed once it is known which connections a page actually opens. And without an overview of which pages are monitored at all, every statement remains a sample - more on that under auditing monitoring coverage.
Anyone running paywalls or access models will find the matching supervisory line in the article on consent or pay. And anyone wanting to keep the technical side of session identifiers clean will find the attributes in the article on session cookies with Secure, HttpOnly and SameSite.
What to keep in mind over the coming months
The proposal is real, the procedure is running, and the direction is visible: fewer requests, more machine-readable choices, a wider list of consent-free purposes. What comes of it will be decided between two chambers currently pursuing different routes - the Council wants the exceptions to the consent requirement to stay in the ePrivacy Directive, while the Commission wanted to move them into the General Data Protection Regulation (Council of the EU, paragraph 18).
For your own site that yields an unspectacular order of work: first know what runs before consent, then record the purpose per entry, then make refusing as easy as consenting. Those three steps are required under the law in force and remain sensible under every version of the draft under discussion. Everything else can be decided once a text has been adopted - and not before. For a setup without a consent request, it is also worth looking at the situation after the end of the Privacy Sandbox.
This article draws on the European Commission's proposal in the version transmitted to the Council, on the joint opinion of the European Data Protection Board and the European Data Protection Supervisor of February 2026, on the Presidency progress report of June 2026, on the procedure file of the European Parliament, on Sections 25, 26 and 28 TDDDG and the Consent Management Regulation in the versions published on gesetze-im-internet.de, and on the guidance of the German supervisory authorities for providers of digital services. The figures and periods quoted relate to the state of the respective publication; the draft is in an ongoing procedure and can still change.