New TDDDG: Strict rules for cookies and high fines threaten!

New TDDDG: Strict rules for cookies and high fines threaten!

On July 19, 2025, the focus will be on important developments in data protection and the regulation of digital services. The introduction of the TDDDG (Telecommunications Digital Services Data Protection Act) has a decisive impact on the way companies handle personal data.

The TDDDG came into force on December 1, 2021 and supplements the existing General Data Protection Regulation (GDPR). It regulates access to data, especially with regard to cookies, and combines the provisions of the Telemedia Act (TMG) and the Telecommunications Act (TKG). These regulations ensure that information is stored and accessed only with the express consent of the user.

Regulations and requirements

Before the introduction of the TDDDG, there was great legal uncertainty about the applicable regulations for cookies. The previous regulation in Section 15 Paragraph 3 TMG required an opt-out for user consent. However, with the entry into force of the TDDDG, the legal framework was redesigned. The new law also implements Article 5(3) of the ePrivacy Directive and introduced the opt-in principle for consent, which has often led to legal disputes in the past.

A decisive turning point came with the “cookie ruling” of the Federal Court of Justice (BGH), which made it clear that the TMG must be interpreted in accordance with the guidelines. This clarification ensured uniform handling, which was further consolidated by the TDDDG.

Consent and fines

An essential part of the TDDDG is that cookie banners are required when processing that requires consent takes place. These banners must provide clear information, offer an opt-in function and give the user the opportunity to object. Techniques such as “nudging” or “dark patterns”, which are intended to entice users to consent without sufficient information, are considered inadmissible.

The enforcement of these regulations is the responsibility of the data protection supervisory authorities of the federal states. Violations of the provisions of the TDDDG can be punished with fines of up to 300,000 euros. The first conviction for an illegal cookie banner has already taken place against a weather service, which underlines the importance of the new regulations.

The TDDDG is therefore a crucial step in the regulation of digital services and the protection of personal data. Companies are now required to adapt their processes and systems to meet the new requirements. Further information about the regulations and their impact on data protection can be found at CVJ and Dr. Data protection.