Cookie banners and privacy on your firm website: what you need and how to avoid it

Two sets of rules: device access and the GDPR

Two sets of rules work together when it comes to cookie banners. The first protects the device: anyone who stores or reads information on a visitor's computer or smartphone, for example by setting a cookie, generally needs consent. In Germany this is laid down in § 25 TDDDG, the Telecommunications Digital Services Data Protection Act, which was called TTDSG until May 2024. In Austria it is governed by § 165(3) TKG 2021. Both implement the same EU directive and share the same exception: what is strictly necessary for the service the user has explicitly requested does not need consent.

The second set of rules is the GDPR. It applies as soon as personal data is processed, and that already includes the IP address. Loading a font, a video or a map from a third-party server transmits the IP address to that provider, even without any cookie. This requires a legal basis, and for services the website doesn't need, in practice that is often only consent.

• Voluntary and active: consent requires a deliberate action. In the Planet49 case in 2019, the CJEU ruled that a pre-ticked box is not valid consent.
• Informed and specific: visitors must know what they are consenting to, which providers are involved and how long data is stored.
• Revocable: withdrawing consent must be as easy as giving it (Art. 7(3) GDPR), for example via a permanent “Cookie settings” link in the footer.
• Beforehand: services that need consent may only load after consent has been given, not as soon as the page is opened.

What needs consent and what doesn't

What matters is not the word “cookie” but what happens technically and whether it is necessary for the website. The following overview shows typical building blocks of firm websites. In individual cases, the configuration is what counts.

If you need a banner: what it should look like

If you use services that require consent, you need a banner that gives a genuine choice. The German supervisory authorities have described their expectations in their guidance for providers of digital services, and in 2023 the European Data Protection Board published the results of its cookie banner taskforce. The gist: rejecting must be possible on the same level and just as easily as accepting.

A third-party consent management tool often loads data from external servers itself. Check where it is hosted, whether there is a data processing agreement and whether it really implements the choice technically. A banner that just looks nice while everything loads in the background is worse than none.

Best of all: no banner

The most elegant solution is a website that loads nothing it would have to ask about. For professional firms this is almost always possible, because the typical reasons for a banner are advertising tracking and embedded third-party content, and a firm website rarely needs either. The benefits: no banner spoiling the first impression, complete statistics and a clear signal that you handle data with care. For firms that advise on data protection themselves, it is even proof of competence; more on this in the guide to the website for IT and data protection law firms.

What is special about firms: confidentiality before the first contact

For professional firms, even visiting a page says a lot. Someone reading the “criminal defence”, “divorce” or “insolvency” page at night reveals a great deal about themselves. An advertising pixel on these pages reports this to an advertising platform. Legally that is permissible with consent, but it fits poorly with a profession whose core is confidentiality. The same applies to contact forms: enquiries should reach you directly, transmitted in encrypted form, and not run through a form service outside the EU.

The same applies to notaries and auditors, who pay particular attention to independence and neutrality. A lean website without tracking is not only legally safer here, but also presents a more consistent picture.

The privacy policy: what belongs in it

Even without a banner you need a privacy policy, because every website processes personal data, at the very least at the host and in the contact form. The information requirements follow from Art. 13 GDPR. Like the imprint, the privacy policy must be reachable with one click from every page. What belongs in the imprint is explained in the guides to mandatory information, for example for lawyers in Germany or tax advisers in Austria.

Two practical notes. First: the website privacy policy is not the same as the data protection information for clients that you hand over when a mandate begins. Second: under § 38 BDSG, firms in Germany generally have to appoint a data protection officer if at least 20 people are constantly involved in the automated processing of personal data. A template from the internet rarely fits exactly; have the policy adapted to the services you actually use.

How to check your website yourself

You can check in a few minutes, without any specialist knowledge, whether your website sends data to third parties unasked. All you need is a browser.

If you find requests to third-party servers before you have consented, talk to your agency. Usually this can be fixed with a few changes, and often the whole banner can go afterwards.