Author: Kurt Schauer
The Telecommunications Telemedia Data Protection Act (TTDSG) was created by the German legislator to adapt the existing data protection provisions to the requirements of the General Data Protection Regulation (GDPR) and the ePrivacy Directive. The regulations particularly affect entrepreneurs who use their own website to market their products. To ensure data protection, visitors to a homepage must be asked for their consent if cookies and tracking services are used. If the new regulations are disregarded, website operators face sanctions.
Adapt your website to the current state of technology and make it GDPR-compliant to be on the safe side and meet the requirements of the TTDSG. The effort is manageable. Those who tackle the project now will secure a clear competitive advantage and the trust of their customers and website visitors.
Those who have already handled the use of cookies or similar technologies, such as fingerprint tracking, in a GDPR-compliant manner will not need to take any action even after the TTDSG comes into force. For everyone else, the TTDSG should be a wake-up call. It is expected that the supervisory authorities will increasingly utilize the expanded fine framework provided by the TTDSG in the future.
Is your website data protection compliant?
What is the TTDSG?
In May 2018, the European Union adopted the General Data Protection Regulation (GDPR) with the aim of comprehensively regulating data protection. However, ongoing jurisprudence, such as the BGH ruling on the obligation to obtain consent for cookies (BGH ruling of May 28, 2020, Az.: I ZR 7/16), made it necessary for a law to be enacted at the national level to further strengthen data protection. The Telecommunications-Telemedia Data Protection Act (TTDSG) has been in force since December 1, 2021.
The new provisions are aimed equally at website operators, app providers, and telecommunications providers. If they use cookies on their online presences to advertise their company or a product, users visiting the homepage must be asked for their consent.
With the TTDSG, the German legislator is particularly focused on the use of cookies. These are small text files that website operators use to display targeted advertising. These text files, for example, help to save a user’s settings during their first visit to the website. Technically necessary cookies, which are required for the operation of the website, do not fall under this regulation and can be used without the user’s consent.
What does the TTDSG regulate?
The main statement of the TTDSG is that a website operator requires the explicit consent of a visitor if they wish to use cookies on their website. In doing so, the TTDSG translates the judgments of the BGH and the ECJ of recent years on the topic of data protection on the internet into national law.
Specifically, this means that a website operator must obtain the user’s consent if they wish to access information that the user has left in their settings. This applies, for example, to leaving an email address in a guest comment. If the operator wishes to use this email address later for advertising purposes, the user’s consent is required.
Technically necessary cookies and information that the website operator uses for the transmission of messages via the public telecommunications network are exempt from the new regulations of the TTDSG.
Technically necessary cookies are text files that are required to make a website functional. No user consent is required for their use. However, the website operator must grant the visitor of their website a right of choice. The user must have the option to give their consent to the use of personal data or to withdraw it if they no longer wish their data to be processed.
The scope of application of the TTDSG refers not only to computers but to all end devices that a user employs to establish an internet connection. This means that even when using a smartphone, the user’s consent must be obtained if the website operator wishes to use personal data for marketing purposes. The use of a cookie banner is therefore also necessary here.
What other changes must a website operator keep in mind?
The TTDSG contains further regulations concerning data protection and the use of cookies on websites. An important provision is that a website operator must provide information about the data stored by them at any time if requested to do so by a public authority (e.g., the data protection authority). This duty to provide information extends to both user accounts and inventory data.
Sanctions are not only threatened for violations of the provisions of the European General Data Protection Regulation (GDPR) but also for violations of the regulations of the TTDSG. In such cases, the website operator may be subject to a fine.
What requirements does a data protection authority impose on the appearance of a cookie consent banner?
The question of what requirements are placed on the proper appearance of a cookie consent banner is not explicitly answered in the TTDSG. However, according to a statement by the data protection authority, a website operator fulfills their obligations for the proper use of cookies if the cookie consent banner placed on the homepage meets the following requirements:
Deactivate cookies until consent is given
The website operator must leave the cookies deactivated until the visitor has given their consent to the use of personal data.
Active consent of the user
The website operator must actively ask the visitor to give the required consent. This can be done, for example, by ticking a checkbox. However, if a checkbox has already been pre-selected, this constitutes a breach of data protection that can have consequences for the website operator.
»Accept button« and »Reject button«
The user must have the option to accept or reject the use of cookies. This can be arranged, for example, by ensuring that the cookie consent banner contains both an „Accept“ button and a „Reject“ button.
Fines for highlighting the »Accept button«
The website operator may not take any measures to highlight the „Accept“ button and influence the user’s consent. If the data protection authority determines that this has occurred, a fine can be imposed on the website operator.
Informing the user about relevant aspects
The website operator must inform the user about all important aspects. This includes, for example, the location of the company, especially if it is outside a Member State of the European Union.
What sanctions are imposed for a violation of the TTDSG?
If a website operator disregards the data protection regulations established by the legislator with the TTDSG, they must expect sanctions. If website visitors are not asked for their consent at the latest when the new regulations come into force, the data protection authority is entitled to impose a fine. This fine can amount to up to 300,000 Euros in the maximum case.
In addition, the regulations of the GDPR apply, which relate to the use of cookies. A website operator who does not obtain the necessary consent from their users can be subject to a fine of up to 20 million Euros or 4% of the worldwide annual turnover.
If a cookie consent banner that complies with current requirements is missing on the website, the website operator may also receive a warning letter. In such a case, they should first check whether the warning letter is justified and whether the accusation of a data protection violation is justified at all. Furthermore, the question arises whether the violation should have been warned against at all. It is advisable in any case to seek legal advice.
TTDSG-compliant Cookie Banner for WordPress / WooCommerce
As an agency specializing, among other things, in WordPress agencies, we recommend using a cookie notice banner with an automatic scan of the entire WordPress site.
Our recommendation: www.pictibe.de/wordpress-dsgvo-plugin-ttdsg-datenschutz-konform-cookie-loesung
Do you have questions?
Kurt Schauer
Managing Director
Related articles
Target Audience Analysis - Definition, Benefits
This article explains what characterizes a good target audience analysis and in which steps it can be carried out.
Career Website – Whitepaper Download
It is no longer employers who hold the reins, but employees. They can choose the jobs with which they can...
Inbound marketing - high-quality content
With the imprint, as the operator of a website, you show your visitors who they are dealing with here. This...
