Author: Kurt Schauer
The German Telecommunications and Telemedia Data Protection Act (TTDSG) was created by the German legislature to align existing data protection regulations with the requirements of the General Data Protection Regulation (GDPR) and the ePrivacy Directive. These regulations primarily affect businesses that use their own websites to market their products. To ensure data protection, website visitors must be asked for their consent before cookies and tracking services are used. Website operators who fail to comply with these new regulations face sanctions.
Adapt your website to the latest state of the art and make it GDPR compliant to be on the safe side and meet the requirements of the TTDSG. The effort is manageable. Anyone who tackles the project now will secure a clear competitive advantage and the trust of their customers and website visitors.
Anyone who has already used cookies or similar technologies, such as fingerprint tracking, in compliance with the GDPR will not need to take any action after the TTDSG comes into force. For everyone else, the TTDSG should be a wake-up call. It is to be expected that the supervisory authorities will make full use of the fine framework expanded by the TTDSG in the future.
Is your website data protection compliant?
What is the TTDSG?
In May 2018, the European Union adopted the General Data Protection Regulation (GDPR) with the aim of comprehensively regulating data protection. However, ongoing case law, such as the Federal Court of Justice ruling on the obligation to consent to cookies (BGH ruling of May 28, 2020, case number: I ZR 7/16), made it necessary for a law to be passed at national level to further strengthen data protection. The Telecommunications and Telemedia Data Protection Act (TTDSG) has been in force since December 1, 2021.
The new regulations are aimed equally at website operators, app providers and telecommunications providers. If they use cookies on their online presence to advertise their company or a product, users who visit the homepage must be asked for their consent.
With the TTDSG, the German legislator is particularly focused on the use of cookies. These are small text files that website operators use to display targeted advertising. These text files help, for example, to save a user's settings when they first visit the website. Technically necessary cookies that are required for the operation of the website are not covered by this regulation and can be used without the user's consent.
What is regulated in the TTDSG?
The main message of the TTDSG is that a website operator needs the explicit consent of a visitor if he wants to use cookies on his website. The TTDSG thus implements the rulings of the BGH and the ECJ of recent years on the subject of data protection on the Internet into national law.
In concrete terms, this means that a website operator must obtain the user's consent if they want to access information that the user has left in their settings. This applies, for example, to leaving an email address in a guest comment. If the operator later wants to use this email address for advertising purposes, the user's consent is required.
Exempt from the new regulations of the TTDSG are technically necessary cookies and information that the website operator uses to transmit messages via the public telecommunications network.
Technically necessary cookies are text files that are required to make a website functional. The user's consent is not required for their use. However, the website operator must give the visitor to his website the right to choose. The user must have the option of giving his consent to the use of personal data or revoking it if he no longer wishes his data to be processed.
The scope of the TTDSG does not only apply to computers, but to all end devices that a user uses to establish an internet connection. This means that even when using a smartphone, the user's consent must be obtained if the website operator wants to use personal data for marketing purposes. The use of a cookie banner is therefore also required here.
What other changes does a website operator need to keep an eye on?
The TTDSG contains further regulations that concern data protection and the use of cookies on websites. An important regulation is that a website operator must provide information about the data stored by him at any time if he is requested to do so by a public body (e.g. the data protection authority). This obligation to provide information extends to both user accounts and inventory data.
Sanctions are threatened not only for violations of the provisions of the European General Data Protection Regulation (GDPR), but also for violations of the provisions of the TTDSG. In such cases, the website operator can be fined.
What requirements does a data protection authority place on the appearance of a cookie consent banner?
The question of what requirements are placed on the proper appearance of a cookie consent banner is not explicitly answered in the TTDSG. However, according to a statement by the data protection authority, a website operator fulfils its obligations to use cookies properly if the cookie consent banner placed on the homepage meets the following requirements:
Disable cookies until consent is given
The website operator must keep the cookies deactivated until the visitor has given his consent to the use of personal data.
Active consent of the user
The website operator must actively ask the visitor to give the required consent. This can be done, for example, by ticking a box. However, if a checkbox has already been pre-selected, this represents a violation of data protection that can have consequences for the website operator.
"Accept button" and "Reject button"
The user must have the option to accept or reject the use of cookies. This can be regulated, for example, by the cookie consent banner containing both an "Accept" button and a "Reject" button.
Fines when highlighting the "Accept button"
The website operator may not take any measures to highlight the "Accept" button and influence the user's consent. If the data protection authority finds this, a fine can be imposed on the website operator.
informing the user about relevant aspects
The website operator must inform the user about all important aspects. This includes, for example, the company's headquarters, especially if it is located outside a member state of the European Union.
What sanctions are threatened in the event of a violation of the TTDSG?
If a website operator disregards the data protection regulations that the legislator has established with the TTDSG, he must expect sanctions. If the website visitors are not asked for their consent at the latest when the new regulations come into force, the data protection authority is entitled to impose a fine. This fine can amount to a maximum of 300.000 euros.
In addition, the GDPR regulations apply, which relate to the use of cookies. A website operator who does not obtain the required consent from its users can be fined up to 20 million euros or 4% of its annual global turnover.
If the website does not have a cookie consent banner that complies with the current requirements, the website operator may also receive a warning. In such a case, the website operator should first check whether the warning is justified and whether the accusation of data protection violation is justified at all. The question also arises as to whether the violation should have been warned at all. In any case, it is advisable to seek legal advice.
TTDSG compliant cookie banner for WordPress / WooCommerce
As an agency specializing, among other things, in WordPress agencies , we recommend using a cookie notice banner with automatic scanning of the entire WordPress site.
Our recommendation : www.pictibe.de/wordpress-dsgvo-plugin-ttdsg-datenschutz-konform-cookie-loesung
Any questions?
Kurt Schauer
Managing Director
Related Articles
Target Group Analysis – Definition, Advantages
This article explains what characterizes a good target group analysis and the steps involved in carrying it out.
Career website – white paper download
It is no longer the employers who hold the reins, but the employees. They can choose jobs with...
Inbound Marketing – High-Quality Content
With the imprint, you as the operator of a website show your visitors who they are dealing with. This...