TDDDG: New cookie rules in court – what does this mean for us?

TDDDG: New cookie rules in court – what does this mean for us?

On June 14, 2025, the focus will be on both legal and technological developments affecting the Internet and data protection. In particular, the new TDDDG (Telecommunications Digital Services Data Protection Act), which has been in force since December 1, 2021, has a significant impact on the regulations for handling cookies and user information.

The TDDDG complements the GDPR and specifically regulates access to data on end devices. It combines provisions of the Telemedia Act (TMG) and the Telecommunications Act (TKG), which aims to harmonize data protection practices. Particularly with regard to cookies, the law requires a strict opt-in principle, which means that users must actively agree before their data is used. This differs fundamentally from the previous regulation of Section 15 Paragraph 3 TMG, which allowed an opt-out, where consent was required as long as users did not actively object.

Current legal developments

A crucial clarification on this issue was the “cookie ruling” of the Federal Court of Justice in the Planet 49 case, which confirmed the need for an interpretation of the TMG in accordance with the directives. This eliminated any ambiguities and significantly increased the requirements for consent to the use of cookies. On May 14, 2024, the TTDSG was given the new title TDDDG, with the term “telemedia” being replaced by “digital services” without significantly changing the content provisions.

It is essential that information can now only be stored and accessed on end devices with the express consent of the user. The only exceptions are for technically necessary cookies, such as those required for session management. All other cookies require cookie banners, which must provide users with clear information and the opportunity to consent and object. Violations of these regulations can be punished with fines of up to 300,000 euros.

Critical consideration and challenges

A central concern of data protection practice is the avoidance of “nudging” and “dark patterns” – techniques designed to trick users into consent. These practices are unacceptable and contradict the principles of the TDDDG. The data protection supervisory authorities of the federal states are responsible for enforcing the regulations, and there has already been a first conviction for an illegal cookie banner that affected a weather service.

The current developments surrounding the TDDDG are part of a broader trend towards better protection of privacy in the digital space. It is all the more important that both users and companies are well informed about their rights and obligations. In this context, note cvj.ch indicates that the regulatory framework remains dynamic and must adapt to the ongoing digital transformation.