A cookie banner that doesn't work properly, or a legal notice with outdated details, is easily overlooked and can be grounds for a cease-and-desist letter. This overview covers the most common stumbling blocks. It is expressly not legal advice, just a checklist for a first look. It refers to German law, which applies to websites operated from Germany.
Why so much goes
wrong right here.
The rules apply to all websites, regardless of company size. The German Telecommunications Digital Services Data Protection Act was renamed TDDDG on May 13, 2024, yet many texts on websites still reference the old name.
On top of that, after a cookie banner goes in, it's rarely checked whether it actually does what it should. A banner that lets tracking load despite a rejection is worse than none at all.
The 5 most common
stumbling blocks
- 01
No equivalent "Reject" button on the first level
Offering only "Accept" and hiding the reject option in settings violates the requirements under a widely held view. Both options should be equally reachable on the first level.
- 02
Tracking loads before consent
Analytics and marketing services may only load after active consent. Whether that's really the case can be checked in the browser's developer tools: network requests to Google or other services must not appear before the click.
- 03
The privacy policy doesn't match the website
Services in use that aren't mentioned in the text, or services described that no longer exist, are a frequent defect. Every new service means updating the text too.
- 04
Outdated legal references in the legal notice
References to the former Telemediengesetz are obsolete. Provider identification is now governed by the Digitale-Dienste-Gesetz (DDG), section 5.
- 05
Third-party content embedded without review
Embedded maps, videos, or fonts from third-party servers transfer data as soon as the page loads. Anyone using them has to reflect that in the banner and privacy policy. Self-hosted fonts and images sidestep the problem.
Bottom line:
Set it up cleanly once, then maintain it.
Most of these defects can be fixed with manageable effort once they're recognized. What matters is to look at the website as a whole: banner, privacy policy, and services actually loaded must all line up.
On every website we build, analytics services only load after consent, and fonts and images sit on our own server. For binding legal questions, please turn to a qualified professional. How we set websites up cleanly on the technical side is covered in our Web Design & Development service.
FAQ
Frequently asked
questions.
About the author
Owner of simnify in Dessau-Roßlau. Builds high-performance websites and leads local SEO and GEO strategy for businesses across the Anhalt region and all of Germany.
