By Marc Alexander

Germany has the strictest consent culture in Europe, sixteen regulators instead of one, and a long habit of treating Google Analytics with suspicion. A GA4 setup that passes in Germany passes almost anywhere. Here's what the law says and what a German site needs.

The rules.

Cookies and similar technologies are covered by section 25 of the TDDDG, Germany's law on data protection in telecommunications and digital services. It was the TTDSG until a renaming in 2024; the substance didn't change.

It says nothing may be stored on, or read from, a visitor's device without their consent, unless it's strictly necessary to provide a service the visitor expressly asked for. The GDPR then governs what happens to the data.

The DSK, the standing conference of Germany's federal and state data protection authorities, publishes the guidance that regulators work from. On analytics and consent it says:

  • Analytics usually needs consent. The guidance doesn't name Google Analytics, and won't say audience measurement is generally allowed without consent. It says that can only be decided for a precisely defined setup and purpose, and stops holding once more data or reports are added. Third-party analytics services, it notes, usually collect far more than a simple count, which is why GA4 needs a yes first in practice. First-party cookies don't change that.
  • Consent has to be real. Informed, specific, given by an action, and as easy to refuse as to give. A banner with "Accept all" in colour and "Settings" in grey text doesn't pass.
  • No consent by nudging. A cookie wall that blocks the site until the visitor agrees, or a banner that reappears on every page until they do, is treated as pressure, not choice.
  • The privacy notice lists the tools. Each service, what it does, and who runs it.

Enforcement is by the state authorities, so a business in Bavaria and one in Hamburg can get different letters about the same banner. Consumer organisations and competitors can also act over unfair competition, which is why German sites take banners more seriously than most.

Where GA4 stands.

GA4 can be run lawfully in Germany. It needs consent before anything loads, a privacy notice that describes it, and a setup that doesn't collect more than it needs. Three points matter:

  • Consent Mode v2. Germany is in the EEA, so Google requires the Consent Mode v2 signals for ads features. Use the basic version, where Google's tags don't load at all until consent. Advanced Consent Mode v2 isn't GDPR compliant: its cookieless pings send data to Google before anyone has agreed. Basic or advanced for EEA traffic sets out the difference.
  • Transfers. German authorities were among the loudest about Google Analytics sending data to the US. The EU-US Data Privacy Framework has covered that since 2023; see GA4 and EU data transfers. The privacy notice should say so.
  • Google Signals and ads personalisation. Off unless there's a reason and a consent for it.

Some German businesses pick a European analytics tool instead, to avoid the conversation. That's a fair choice. Marc Alexander's view is that GA4 with proper consent is also a fair choice, and the better one for a business that advertises with Google, because the two then share the same numbers.

Where German sites usually go wrong.

  1. A consent manager installed, but Tag Manager fires GA4 on page load regardless
  2. Consent recorded for "statistics" but the Google Ads tag loading too
  3. An English-language banner on a German site, or legal text that still names Universal Analytics
  4. Consent Mode defaults set to granted
  5. No link to change the choice later

What to check.

  1. Open the site in a private window and, before touching the banner, watch the network requests. Nothing but essential requests should go out.
  2. Reject, reload and check again
  3. Accept statistics only, and check that advertising tags still wait
  4. Test Consent Mode with the Consent Mode v2 testing guide
  5. Read the privacy notice against what the site actually loads

The wider picture is in GA4 and EU consent rules. Marc sets up GA4, Tag Manager and Consent Mode for German and other European businesses, with prices in euros. The free tracking checker shows what a page loads before anyone chooses.

Sources.

Checked on 31 October 2026.