Germany’s Consent Management Regulation: What a Recognised Service Must Do and What Stays Voluntary

Germany’s Consent Management Regulation (EinwV) has applied since 1 April 2025. Together with Section 26 TDDDG, it provides a framework for recognised services that manage decisions about particular storage operations and access to terminal equipment. The aim is fewer repeated consent requests, not blanket permission for arbitrary websites and purposes.

Website integration remains voluntary under Section 18(1) EinwV. Once a service is integrated, however, rules govern the handling of stored choices. The digital service provider remains responsible for information and valid consent. This distinction matters when planning an integration.

What recognition covers

The BfDI register retrieved on 24 October 2026 lists Consenter, provided by Law & Innovation Technology GmbH, with recognition dated 17 October 2025. Recognition concerns the statutory requirements for the service and its submitted security concept. It does not generally approve every website, consent notice or subsequent processing operation.

A recognised service differs from an ordinary consent management platform. A banner product does not become a recognised Section 26 service merely through a product label. Formal recognition and the register entry are decisive.

Requirements for the service

• Independence and purpose limitation: No economic self-interest in obtaining consent or in the managed data; processing is restricted to consent management.
• Informed choice: Information must cover, among other matters, the providers involved, specific storage or access, purposes, periods and withdrawal. A broad category such as marketing does not replace those details.
• Accessible records: Settings, date, time and the information available when the choice was made must remain accessible. Changes and, where applicable, withdrawal must remain possible at any time.
• Switching services: Settings must be held in a commonly used format that software can read automatically and made available free of charge for transfer to another recognised service on request.
• Competition and security: Equal conditions for integrated providers, interoperable communication and a security concept form part of the requirements.

The one-year interval in Section 4(2) concerns a recognised service’s request to review stored settings, unless a different setting has been chosen. It does not establish a universal one-year validity period for consent or prohibit every new website request.

What follows voluntary integration

Section 18 describes technical and organisational measures for participating providers: detecting use of a recognised service, checking stored choices for the requested consent, enabling storage and visibly explaining the integration. Required information should also be provided in machine-readable form. Voluntary participation and the way participation is implemented are therefore separate issues.

Section 19(1) requires participating providers to take the managed settings into account. If no consent has been received through the service and consent is requested again, the request must also refer to the settings held there. An existing refusal does not thereby become permission. Section 20 adds a neutrality rule for integrated services.

Regardless of participation, consent required by Section 25 TDDDG remains a prerequisite for the relevant access to terminal equipment. Only the statutory exceptions permit that access without such consent. Subsequent processing of personal data also needs assessment under the applicable GDPR requirements.

A signal needs a matching scope

A technical approval is usable only when its supporting information matches the actual operation. A record should connect the decision with the provider or recipient, access or storage operation, purpose, timestamp, information version and source. That requires more than a single global analytics-allowed field.

The implementation needs to distinguish at least approval, refusal and absence of a decision. Missing, unmapped or unverified signals must not authorise operations that require consent. Withdrawal must stop the relevant subsequent access; introducing another decision source therefore also requires testing actual tag behaviour.

A common record structure, independent of any one consent provider, makes different consent sources easier to connect. It does not guarantee that every external signal can be accepted unchanged. Purpose, provider and version mapping, together with conflicts between new and existing settings, need an explicit integration rule.

Assessment through concrete integration cases

The number of recognised services does not establish adoption on a particular website or its economic benefit. A useful assessment measures valid settings detected, repeated prompts avoided, mapping failures and the work required for maintenance and withdrawal.

1. The assessment checks recognition, the technical interface and supported browsers or clients.
2. The website’s information and purposes are compared with the scope of managed decisions.
3. Tests cover a first visit without settings, approval, refusal, a return visit, a change and withdrawal.
4. Further checks cover unknown providers, changed purposes, conflicting signals and service failure.
5. Network activity is inspected to verify that consent-dependent tags remain inactive until valid approval and do not fire again after withdrawal.

These checks support a decision based on the actual integration and its measurable effects.

EU proposals remain separate

The Commission’s original Digital Omnibus proposal of November 2025 also addresses machine-readable consent signals in Article 88b. That initiative is separate from the German rules already in force. On 24 October 2026, Parliament’s procedure register still lists the committee decision as pending. A proposal does not create an immediately applicable general duty for websites.