New Rules in Germany: Understanding the Consent Management Ordinance

Introduction

In April 2025, Germany ushered in a landmark shift in how online consent is handled with the implementation of the Consent Management Ordinance, formally known as the Einwilligungsverwaltungsverordnung (EinwV). This regulation aims directly at reducing the growing problem of cookie banner fatigue and strengthening digital services data protection. It introduces a system of recognized consent management services, independent consent management platforms (CMPs) that store and communicate users’ consent preferences across different websites. Instead of encountering cookie banners on every visit, users can, in principle, store their consent preferences with a recognized consent management service and have those preferences retrieved by participating services. The new regulation, which underwent a certification approval process, was formally adopted following the involvement and approval of the German federal council, ensuring its legal standing and impact on consent management practices.

The ordinance is legally grounded in the Telecommunications Digital Services Data Protection Act (TDDDG), which governs terminal-device data, cookies, and similar technologies. It aligns with GDPR’s requirements for informed, explicit, and revocable consent, ensuring that any data collection is based on a valid legal basis. The consent requirements set by the ordinance specify that consent must be informed, explicit, freely given, and easily revocable, meeting the high standards established by both the TDDDG and GDPR. The German government approved the statutory order to increase transparency, enhance user rights, and strengthen user trust in digital services. With the support of the Federal Commissioner for Data Protection and Freedom of Information (BfDI), the ordinance promotes a centralized consent management system designed to minimize intrusive cookie banners while maintaining robust security and data privacy.

Notably, the framework is based on voluntary participation by digital service providers, while enforcement of consent obligations for websites continues to be governed primarily by the GDPR and the TDDDG.

Scope and Application

The Consent Management Ordinance applies to a broad range of digital service providers, including website operators, app developers, and other providers of digital services that employ non-essential cookies or equivalent tracking tools. The ordinance regulates access to and storage of information on the user’s device, ensuring that any use of cookies or similar technologies is subject to clear legal requirements. Rather than requiring each provider to build their own consent mechanism, the ordinance fosters the voluntary adoption of recognized consent management services, which handle the retrieval and communication of user consent preferences.

These recognized CMPs, also known as consent management service providers, play a dual role. As a service provider, a CMP is responsible for managing and transmitting user consent data. They interact directly with the end user to manage, store, and enforce their consent preferences, ensuring that the user’s choices are respected across digital services. This means that consent preferences can, in theory, follow the user across different participating websites, potentially reducing repetitive cookie banners while enforcing the user’s preferences where the system is implemented.

The scope of the ordinance centers on managing user consent for non-essential cookies and similar technologies, with requirements anchored in the TDDDG. CMPs must comply with strict criteria, including robust technical and organizational measures to ensure data security and compliance with data protection authorities. Because the ordinance provides a consent framework for services accessible from Germany, it may also be relevant for international websites that choose to participate in the recognized consent system. If they use tracking tools accessible on devices in Germany, their consent management practices must align with the new rules.

In summary, the ordinance regulates the interactions between service providers, end users, and digital services regarding consent management.

Consent Management

A key element of the ordinance is the requirement that consent management services must be approved by the BfDI before they can be recognized. Only approved consent management services are eligible for recognition under the ordinance. To obtain this recognition, services must meet substantial criteria relating to independence, privacy, usability, and transparency.

Recognized services must:

• Demonstrate independence, ensuring that they have no commercial incentive to influence whether users grant or reject consent.
• Process personal data only as necessary for managing user consent and not for unrelated purposes.
• Maintain a robust security concept with appropriate technical and organizational measures to safeguard stored consent data.
• Provide a user-friendly interface that enables users to set, update, or revoke their consent preferences clearly and easily.
• Support standardized signal mechanisms so websites can process consent information signals and honor the user’s stored preferences across multiple visits.
• Manage consents in compliance with all relevant legal and technical standards, ensuring transparency and data protection.

Maintaining recognition status requires ongoing compliance with these requirements, and recognition status can be revoked if a service fails to meet the necessary standards.

Users must be able to revoke consent at any time and make adjustments to their choices. The system is designed to encourage transparency and ensure that decisions are based on informed, voluntary action, ultimately improving user trust and reducing unnecessary user interactions.

While not legally required, many digital service providers choose to integrate consent management services to ensure compliance with regulations and maintain user trust.

Data Protection and Security

The ordinance places considerable emphasis on data protection and data security throughout the consent management lifecycle. Recognized CMPs must adhere to the expectations of data protection authorities and comply with GDPR-level standards for handling personal data.

Applicants must provide detailed documentation showing how their service implements:

• Strong encryption and controlled access mechanisms
• Secure storage and transmission of consent signals
• Proper logging and audit capabilities
• Comprehensive technical and organizational measures
• Internal privacy processes ensuring ongoing compliance
• Retrieval and display software capable of recognizing, integrating, and supporting the transfer of user consent data between different recognized consent management services to ensure transparency, interoperability, and compliance with legal requirements

By reinforcing transparency, the ordinance mandates that users be informed about what data is collected, who processes it, and how long it is stored. These principles promote informed consent, empower users, and reinforce user rights in the digital space. Users must be able to view, modify, and transfer their end user’s settings in a standardized, interoperable manner.

To reduce intrusive cookie banners and repetitive consent requests, the ordinance supports a centralized consent management system. This system ensures that once a user makes a decision through a recognized CMP, participating websites can retrieve that decision automatically, enhancing user experience and reducing banner fatigue.

Cookie Consent and Banners

At the heart of the ordinance is the goal of reducing the proliferation of intrusive cookie banners that disrupt user journeys. By enabling a centrally stored consent decision through recognized CMPs, the system simplifies how users manage tracking permissions.

When a user sets their preferences, for example, accepting all cookies, rejecting all, or allowing only certain categories, the CMP securely stores that decision. Participating websites can then retrieve this information, eliminating the need for repetitive cookie banners that undermine user experience. This approach leads to an improved user experience by reducing repetitive interactions.

Key requirements under the ordinance include:

• Cookie consent must be explicit, informed, and freely given.
• Users must be able to revoke or modify their consent at any time.
• Consent banners must be designed in a user friendly manner and competition-compliant, ensuring clarity and accessibility while avoiding manipulative design patterns.
• Consent management procedures must comply with GDPR, ensuring that consent is meaningful and that users understand the implications of their choices.

The ordinance encourages the use of consent management platforms to streamline the consent experience and ensure compliance with legal requirements. These platforms help digital service providers manage user consent in compliance with the ordinance. By centralizing consent preferences, the system minimizes redundant interactions while maintaining strong privacy protections.

Approval Process and Certification

The approval and certification of recognized consent management services fall under the authority of the BfDI. The commissioner evaluates applications based on strict criteria to ensure that CMPs meet all functional, technical, and organizational requirements.

The approval process includes:

• Submission of a full application containing detailed technical specifications
• A complete security concept demonstrating compliance with GDPR and the TDDDG
• Verification that the interface design is user-friendly, transparent, and not commercially biased
• Confirmation that data processing remains limited to managing consent
• Demonstration of open technical interfaces enabling consistent retrieval and transmission of consent signals

Only services that obtain official recognition may present themselves as recognized consent management services under the ordinance. Once approved, these recognized services are included in a public register. Recognized services are subject to ongoing supervisory review and must continuously comply with the requirements to maintain their recognition status. Failure to uphold the required standards may result in the revocation of recognition.

Implementation and Compliance

For digital service providers, adopting a recognized consent management service is voluntary, but it offers clear compliance and usability advantages. Providers who choose to integrate such services must ensure that their consent management procedure aligns with the ordinance’s expectations.

This includes:

• Integrating the CMP’s retrieval and display mechanisms to honor users’ stored consent preferences
• Ensuring that tracking tools, cookies, and scripts, including platforms such as Google Ads and Google Analytics where applicable, require and obtain valid consent before running, in accordance with the TDDDG and GDPR. This is especially important for Google Ads, as ad personalization and campaign performance depend on proper consent management.
• Maintaining strong technical and organizational measures to protect any stored or transmitted consent data
• Ensuring that the user interface remains clear, lawful, and free of deceptive patterns

Although the ordinance does not mandate the use of recognized services, digital service providers remain fully subject to scrutiny under the GDPR and the TDDDG if their banner-based consent mechanisms do not meet legal requirements.

Penalties and Enforcement

For recognized consent management services, non-compliance with the ordinance can result in serious consequences, including the revocation of certification by the BfDI. Once recognition is revoked, the service is removed from the public register and may no longer operate as a recognized CMP.

For digital service providers, enforcement occurs primarily through GDPR and the TDDDG. If a provider mismanages consent, such as ignoring user revocations or implementing tracking without explicit consent, they may face fines imposed by data protection authorities.

The ordinance strengthens accountability by requiring documented compliance, transparent processes, and systems that reliably demonstrate adherence to user preferences. The BfDI remains responsible for monitoring recognized CMPs, performing ongoing evaluations, and ensuring consistency in enforcement.

Digital Services and Data Privacy

By formalizing the role of recognized consent management services, the ordinance underscores Germany’s commitment to improving data privacy across digital services. The framework supports user-friendly, transparent consent procedures while reinforcing user rights in the digital environment.

Digital service providers, including those using advertising systems, analytics tools, personalization engines, or other data collection technologies, now have a clearer structure for legally processing user data. When integrated with a recognized CMP, providers can receive consent signals that reflect the user’s preferences and act accordingly, subject to continued compliance with GDPR and TDDDG requirements while improving user trust.

For users, the centralized system reduces friction, improves transparency, and strengthens their ability to manage data collection across different websites. This contributes to a safer, more privacy-respecting digital ecosystem and leads to a more consistent and less intrusive experience.

Conclusion

The German Consent Management Ordinance (EinwV) represents a pivotal advancement in how digital service providers approach user consent and data protection. By establishing a legal framework for recognized consent management services, the ordinance aims to streamline the process of managing user consent, potentially reducing the prevalence of disruptive cookie banners where the system is adopted and enhancing the overall user experience.

For businesses operating in the digital space, the path forward is clear: prioritize the integration of recognized consent management services that meet the ordinance’s rigorous standards. This means selecting consent management platforms that not only facilitate explicit user consent but also implement robust technical and organizational measures to safeguard data security and ensure transparent data processing.

Digital service providers should review their current consent management procedures, update their cookie banner practices, and ensure that all data processing activities are fully aligned with the new regulatory requirements. By adopting a user-centric approach to managing consent, companies can demonstrate compliance with the management ordinance, foster greater user trust, and position themselves as leaders in data protection.

As the regulatory landscape continues to evolve, staying proactive in implementing effective consent management solutions will be essential. Embracing these changes not only ensures compliance but also delivers a more seamless and trustworthy online experience for users, ultimately benefiting both service providers and their customers.