Analytics in Germany under the TDDDG (formerly TTDSG)

German website owners often ask whether analytics needs consent under § 25 TDDDG (formerly TTDSG), the rule on accessing visitors’ devices. Cookieless analytics changes the part of that question that concerns the analytics ID.

The practical question

If analytics neither stores information on the visitor’s device nor reads it from there (for example an ID cookie), many argue it can run without asking for consent. Your lawyer must apply the current official guidance to your specific case.

What this means for PureMetrix

PureMetrix does not set a cookie to recognise visitors; daily unique visitors are counted with a salt that changes on the server every day. Data is processed on Hetzner servers in the EU.

Still a separate question

Google Ads, Meta Pixel, embedded maps with tracking and similar tools need their own TDDDG/GDPR assessment. Removing analytics from the cookie banner does not make them compliant.

Checklist for website owners

Document your analytics provider and how cookieless counting works.
Sign a DPA: you are the controller, PureMetrix is your processor.
Exclude staff roles in WordPress.
Keep a list of all other scripts and their providers.

Practical next step

List every script that runs in the visitor’s browser, separate measurement from marketing tags, and document why PureMetrix doesn’t need an analytics cookie. Have your lawyer review this list—a blog post alone is not enough.

TDDDG (formerly TTDSG): the name and device access

In May 2024 the TTDSG was renamed TDDDG; the rule on device access (§ 25) stayed the same. Many people still search for “TTDSG”. What matters is the content: rules on accessing and storing information on devices apply alongside the GDPR. Analytics without a visitor cookie avoids one type of device-access question; it does not answer every data protection question automatically.

Document how PureMetrix works—no visitor cookies, daily salted hashes, processing in the EU on Hetzner, DPA—then list the other scripts that still store IDs. Lawyers in Germany, Austria and Switzerland will ask about your whole setup.

A sensible setup for your website

Use cookieless analytics by default, load marketing pixels only after consent, and don’t use a law’s name as a marketing badge. Make sure your privacy policy describes each provider accurately, and review it after major plugin changes.

Working with German lawyers

Bring the facts about the provider: no visitor cookies, daily salted hashes, processing in the EU on Hetzner, DPA available, role exclusions, optional /px proxy. Ask your lawyer how the remaining ad and embed cookies should be handled under § 25 TDDDG (formerly TTDSG). Don’t claim legal compliance in your own marketing headlines.

Update your privacy policy when you add heatmaps or session recordings—they change the picture, even if PureMetrix stays cookieless.

Common misunderstandings

“EU hosting means no GDPR duties” is wrong. “No cookie means no GDPR duties” is also wrong. Device-access rules and data protection rules both apply. In purchasing decisions in German-speaking countries, accurate descriptions win over slogans.

Cookie banner wording pitfalls in Germany

Claiming “TDDDG-konform” in a cookie wall while ad pixels still load is asking for trouble. Describe PureMetrix accurately and list other providers separately. English pages aimed at German-speaking customers should be just as honest as the German privacy notices.

Embedded media

German websites often still load embeds from US services (videos, maps) that set cookies regardless of analytics. Click-to-load placeholders or consent-gated embeds matter as much as switching to PureMetrix. When your lawyer reviews device-access questions under the TDDDG, look at the whole page.

Keep a change log of your embed rules alongside your analytics changes.

A short note for your team

One paragraph for marketing staff in Germany: we measure without visitor cookies; other tools may still need consent; don’t paste random US pixels into the theme. Link to the PureMetrix documentation and your privacy policy. A short briefing prevents well-meant mistakes.

If an agency runs German websites from abroad, German requirements for privacy notices still apply; where the team sits doesn’t change the device-access rules.

Disclaimer

Not legal advice. A German lawyer should review your specific setup and texts.