Do I need a cookie banner for analytics in Germany?
Section 25 of the TDDDG knows only two exceptions, carrying a communication and a service the user asked for; the German data protection authorities say in their guidance that they give no general statement that audience measurement is exempt, because the term covers too many different things.
The rule
- Supervised by
- The data protection authorities of the federation and the states, meeting as the Datenschutzkonferenz (DSK)
- Written in
- Telecommunications and Digital Services Data Protection Act (TDDDG), Section 25
There is no exemption for audience measurement: the only exceptions are carrying a communication and a service the visitor asked for.
What the regulator and the courts have said
- 21 November 2024: Guidance for providers of digital services, version 1.2 (Orientierungshilfe Digitale Dienste) The authorities read section 25 as covering the active reading of information from the device, and decline to say that audience measurement as such is exempt: what is called that ranges from counting readers to profiling them, and only a narrowly defined use could be judged.
- 28 May 2020: Federal Court of Justice, Cookie-Einwilligung II (I ZR 7/16) Cookies that are not necessary need the user's active consent; a pre-ticked box is none. The ruling follows the Court of Justice of the EU in Planet49 and settled that German law asks consent.
Tool by tool
The same question for the tools people use most. Tools that work without cookies get the same verdict as Nvivio.
| Tool | Banner needed? | Why |
|---|---|---|
| Google Analytics 4, as it ships | Yes | Sets the cookies _ga and _ga_<id> for two years to tell users apart. Cookies that identify a browser for two years are neither strictly necessary nor anonymous audience measurement, so Germany asks consent for them. |
| Google Analytics 4 with consent mode | Yes | Consent mode adapts Google's tags to the choice a visitor made in a banner. It is a way to handle consent, not an exemption from it. |
| Matomo without cookies | No, with a note | With cookies turned off and the IP address shortened, it stores nothing on the device and measures only for you. |
| Plausible or Fathom | No, with a note | No cookies and no identifier that lasts beyond a day, measurement for you only. |
| Nvivio, privacy mode | No, with a note | No cookie, nothing on the device, the IP address never stored, a visitor code that changes every day, reports as totals. |
| Nvivio, cookie mode | Yes | Places one first-party cookie to recognise a visitor over months. That needs consent, and Nvivio says so. |
| Heatmaps and session recordings | Yes | They record what one visitor did, usually with a cookie, and are never only audience measurement. |
What changes with the Digital Omnibus
The EU is rewriting the cookie rule. Both the Commission's proposal and the Council's mandate exempt aggregated audience measurement by the provider of a site, or by a third party on its behalf, from consent. The text is not law yet.
Germany has no exemption in section 25. The Digital Omnibus would add one at EU level for aggregated audience measurement; Germany would then apply it, and the authorities' guidance would have to follow. Where the Digital Omnibus stands
Set it up without a banner
Three steps, in the order that keeps you on the right side of the rule in Germany.
- Add the Nvivio script to your site in privacy mode, the default: no cookie, nothing on the device.
- Mention Nvivio in your privacy notice, with the objection box, so visitors can opt out with one click.
- If you keep another tool that sets cookies, load it only after consent, or drop it.
Frequently asked questions
Is first-party analytics exempt from consent in Germany?
No. Germany exempts only what is strictly necessary for a service the visitor asked for, and the regulator does not count statistics among that. First-party or third-party makes no difference to the cookie rule; what matters is whether anything is stored on or read from the device.
Does Google's consent mode v2 remove the banner?
No. Consent mode tells Google's tags what the visitor chose in your banner and sends cookieless pings when consent is refused. It presumes a banner; it does not replace one, and the pings themselves are not covered by any exemption in Germany.
Can I keep Google Analytics 4 next to Nvivio?
Yes, as long as Google Analytics loads only after consent. Nvivio measures everyone in privacy mode, so you keep complete numbers; Google Analytics then shows the consenting part, with its own tools and its data in the United States.
My visitors come from several countries. Which rule applies?
The rules of every country whose residents you measure, not only the one you are in. Follow the strictest country that matters to you, or load the tool that needs consent only after consent there. A tool that needs no consent anywhere, like Nvivio in privacy mode, avoids the question.
Is this legal advice?
No. It is general information, checked against the sources below on the date shown. Rules and readings change; a decision for your site is yours, or your adviser's.
Nearby countries
Sources
- Federal Ministry of Justice, the law as it stands: § 25 TDDDG (gesetze-im-internet.de) · accessed 4 November 2026
- Datenschutzkonferenz, guidance for providers of digital services: Orientierungshilfe Digitale Dienste (datenschutzkonferenz-online.de) · accessed 4 November 2026
- Federal Court of Justice, press release: Pressemitteilung Nr. 67/2020 (bundesgerichtshof.de) · accessed 4 November 2026
This is general information, not legal advice.