The German Government is Drafting a Regulation on Cookie Consent Management Services

According to several news reports in the past month of August (for example, Heise.de), the German Government is working on a regulation that will set out the requirements for so-called “consent management services”, which are services for collecting and storing the consent of website users to the placement of cookies and similar technologies.  These services would serve as an alternative to cookie banners.  Among others, they may obtain consent for several websites at once.  More specifically, dedicated software applications could enable users to replicate the consent provided on one website to other websites, therefore generalizing and sorting their consent by category of devices or websites.  Users would be asked to review their consents every six months.

The anticipated regulation will implement Section 26 of the Telecommunications Telemedia Data Protection Act (“TTDSG”), which entered into force on December 1, 2021.

By regulating the consent management services, the Government aims to encourage websites to use them and thereby reduce the amount of cookie banners on the Internet.  However, the single consent rules would not apply to websites that are financed by advertising.  These website would still have to obtain a dedicated consent.  Such ad-financed websites could give their users the choice between free use with advertising cookies and a paid alternative without advertising cookies.  This is in line with the guidance issued by the German Conference of Data Protection Authorities (available only in German).

Cookie management service providers will have to comply with the regulation and register with an independent body to be set up by the regulation. While the parameters for registration are still unclear, one requirement would be that the management service providers do not have an economic self-interest in obtaining a consent and the managed data.

Further Steps

The Government is expected to share the draft regulation with business associations and the federal states for review soon.  Following further review, the draft proposal will then be sent to the EU Commission for additional comments.  The Government hopes to pass the draft regulation by 2023.

*                             *                             *

The Covington Team will keep monitoring the developments on the aforementioned legislation, and is happy to assist with any potential inquiry on the topic of cookies.