Abmahnung over a cookie banner: what actually applies
For most websites that use analytics or marketing tools, a cookie consent banner is now mandatory. But not every demand over a supposedly "wrong" banner, for instance in a German Abmahnung (a formal cease-and-desist letter), is automatically justified.
When a cookie banner is actually required
Under Section 25 TDDDG (the German Telecommunications Digital Services Data Protection Act, known as the TTDSG until May 2024) and the GDPR, you need the visitor's consent before setting cookies or similar technologies that are not technically necessary, for example for audience measurement, ad tracking or embedded third-party content. Strictly necessary cookies (e.g. shopping cart, login session) do not require consent.
Common points of dispute in these letters
- Tracking before consent: analytics or advertising scripts load before the visitor has agreed.
- No equivalent "Reject" button: the reject button is visually hidden or takes more clicks than "Accept" (a so-called dark pattern).
- No way to withdraw consent: there is no easy way to withdraw consent once it has been given.
- Pre-ticked boxes: categories are already pre-selected instead of the visitor having to actively opt in.
How to respond to such a letter
1. Actually check your own website
Open your site in a private/incognito window and use the developer tools to see which cookies are set before anyone clicks the banner. Often you'll find that the defect exists but is easy to fix.
2. Look for patterns and mass mailings
Cookie-banner Abmahnungen are no different: identically worded mass letters with flat-rate demands are a strong indication of abuse of rights under Section 8c UWG (German Act Against Unfair Competition) or Section 242 BGB (German Civil Code).
3. Fix the defect, whatever the outcome
Legally compliant consent management makes sense anyway, both legally and for your visitors' trust.
4. Don't sign a cease-and-desist declaration without having it checked
As with any Abmahnung: signing a cease-and-desist declaration (Unterlassungserklärung) in a hurry can end up costing more than the original problem.
Related topic
Cookie-banner demands often come up in the same context as Google Fonts Abmahnungen; both are frequently based on automated website scans. The basic approach is the same: stay calm, check the facts, don't sign anything in a hurry.