Data protection debate: Web analyzes without consent – ​​is that allowed?

Data protection debate: Web analyzes without consent – ​​is that allowed?

On March 11, 2025, an exciting episode of the series “A Cup with the President” took place, in which Prof. Dr. Stephan Rosshart, a leading expert in data protection and web analytics, discussed the current legal situation regarding cookies and tracking. The focus was on the requirements of the Telecommunications Telemedia Data Protection Act (TTDSG) and the General Data Protection Regulation (GDPR). These legal frameworks are crucial for web operators to respect user privacy while providing effective online services.

A central topic was the question of whether websites need a cookie or consent banner. According to the information from Baden-Württemberg, websites that do not carry out processing that requires consent do not have to include such a banner. In particular, if no non-essential information is stored or read on end devices, consent is not necessary. This also reduces the challenge associated with obtaining consent.

Technically necessary cookies

Cookies generally fall under the consent regulations, but technically necessary cookies are excluded. These are essential to ensure the basic functions of a website. Examples of this include session management and storing user input in online forms. Necessary cookies are also necessary to provide an expressly requested service.

However, the legal requirements are complex. Information collected through cookies or other tracking techniques must be presented transparently to users to ensure trust. Companies should, if possible, avoid using external tracking methods in order to avoid legal gray areas. Web analytics based on collected data also require clear consent, unless these are measures that do not read personal data.

Range analysis versus tracking

But what exactly is the difference between reach analysis and individual tracking? The reach analysis is used to collect statistical information about website visitors. This supports the design and optimization of websites without having to create individual behavior profiles. Tracking, on the other hand, involves a detailed analysis of user behavior, which enables identification and can potentially violate the GDPR if consent is not given.

The discussion about the possibility of web analyzes without consent shows that there are different perspectives among the responsible supervisory authorities. Some German supervisory authorities consider the analysis of log files, which collects information such as IP addresses and browser details, to be permissible if it is carried out anonymously and without cookies.

The uncertainties in this area are causing many website operators to rethink their data processing practices. Like Prof. Dr. Stephan Rosshart concluded by emphasizing that compliance with all legal requirements must have the highest priority in order to avoid legal consequences and not endanger the trust of users. Providers of online services are well advised to regularly inform themselves about changes in data protection and to adapt their websites accordingly.

In summary, the discussion about cookies and tracking mechanisms is not only complex, but also fundamental to the digital economy. Data protection-friendly approaches, such as local font integration or two-click solutions for social media buttons, are possible alternatives to consider.

For more detailed information on the legal requirements and recommendations for designing data protection-compliant websites, please refer to the relevant guidelines. This is what the website offers Baden-Württemberg helpful FAQs on cookies and data protection, while experts on dr-datenschutz.de provide additional insights into web analytics without violating user rights. In conclusion, it is clear that the digital landscape continues to be in a constant state of change, which presents both challenges and opportunities.