DAILY

Cookie and consent check

Available Data protection

Storing or reading information on a user's device requires consent under § 25 TDDDG unless the access is strictly necessary for the service the user explicitly requested. The consent must meet the requirements of the GDPR. This checklist follows the German DSK guidance for digital services and CJEU case law.

Scope

1. Does the website or app store information on the device or read it from there (cookies, local storage, pixels, fingerprinting, SDKs)?
§ 25 Abs. 1 TDDDG Open in the law texts
2. Are there accesses that are not strictly necessary for the service explicitly requested (analytics, marketing, A/B testing, embedded third-party content)?
§ 25 Abs. 2 Nr. 2 TDDDG Open in the law texts

Before consent

3. Are all non-essential accesses triggered only after consent, including third-party tags, pixels and scripts?
§ 25 Abs. 1 TDDDG Open in the law texts
4. Is it documented for every access without consent why it is strictly necessary (e.g. shopping cart, login, security, storing the consent choice)?
§ 25 Abs. 2 Nr. 2 TDDDG Open in the law texts

Consent banner

5. Is there an equivalent option on the first layer to reject all optional accesses?
DSK Orientierungshilfe digitale Dienste
6. Are all checkboxes for optional purposes unticked by default?
EuGH C-673/17 (Planet49)
7. Is the design free of nudging towards consent (only consent highlighted, rejection hidden or cumbersome)?
Art. 4 Nr. 11, Art. 7 Abs. 4 DSGVO Open in the law texts
8. Are purposes, third parties involved, storage period and any third-country transfers named before consent?
Art. 4 Nr. 11, Art. 13 DSGVO Open in the law texts
9. Can consent be given separately for different purposes?
Art. 7 Abs. 2, ErwG 43 DSGVO Open in the law texts
10. If access to the site depends on consent (cookie wall, pay-or-consent): is there an equivalent, reasonable alternative without tracking?
DSK Beschluss zu Pur-Abo-Modellen (2023)

After consent

11. Can consent be withdrawn at any time as easily as it was given?
Art. 7 Abs. 3 DSGVO Open in the law texts
12. Are consents logged in a provable way (time, banner version, purposes chosen)?
Art. 7 Abs. 1 DSGVO Open in the law texts
13. For transfers to third countries (e.g. the USA): is there a basis under Art. 44 et seq. GDPR (adequacy decision, Data Privacy Framework certification, standard contractual clauses)?
Art. 44–49 DSGVO Open in the law texts
This result is not saved. With an account, assessments are stored with date and catalog version.
Menu
Preview · What this means
Dark paper