{"id":10593,"date":"2026-09-29T07:20:00","date_gmt":"2026-09-29T05:20:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10593"},"modified":"2026-09-25T10:49:10","modified_gmt":"2026-09-25T08:49:10","slug":"germanys-consent-management-regulation-what-a-recognised-service-must","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/data-privacy\/germanys-consent-management-regulation-what-a-recognised-service-must\/","title":{"rendered":"Germany’s Consent Management Regulation: What a Recognised Service Must Do and What Stays Voluntary"},"content":{"rendered":"

The idea is old and obvious: a person decides once what they permit, and every site abides by it instead of asking again. In Germany that has become a legal basis – Section 26 TDDDG and the consent management regulation belonging to it, in force since 1 April 2025.<\/p>\n

Since 17 October 2025 there is also a first recognised service. The mechanism therefore exists in full: a regulation, a register, a provider, a plug-in. What it does not bring along is a reason for a website to use it.<\/p>\n

\n\"A
Messages one to three always run. Whether the fourth runs is decided by the site alone – and the lower frame shows what happens when it does not.<\/figcaption><\/figure>\n

What the regulation demands<\/h2>\n

A service is recognised only if it meets certain requirements, and those are visibly designed to make it unobjectionable. It must offer a transparently designed interface in which settings can be viewed, changed and revoked at any time. It must operate in a competitively neutral way – every provider of digital services can request data under the same conditions. And the person must be able to switch to another recognised service at any time and easily.<\/p>\n

Those three points answer the obvious objection that a central consent store is itself an instrument of power. They answer it properly. They simply do not answer a different question.<\/p>\n

The question that stays open<\/h2>\n

Integration by providers of digital services is voluntary. No site is obliged to query the service before showing its own banner, and the effectiveness of the whole construction hangs on exactly that.<\/p>\n

For a site the arithmetic is uncomfortable. A banner it puts up itself yields a consent whose wording and defaults it knows. A signal from outside may yield a refusal it did not word. Weighing the two while looking only at one’s own revenue does not lead to integration – which is why participation sits where it sits.<\/p>\n

Who obliges whom to what\n\n  regulation -> service    requirements on interface,\n                           competitive neutrality, switchability\n  regulation -> website    nothing\n\n  person     -> service    sets preferences, revocable at any time\n  website    -> service    queries, if it feels like it\n\n  Exactly one edge in this list is voluntary, and it is the only\n  one without which the rest has no effect.<\/code><\/pre>\n
Why it is remarkable anyway<\/h2>\n
Something similar was meant to appear at European level. The Digital Omnibus of November 2025 provided in Article 88b for a machine-readable consent signal – a preference expressed once in the browser or the operating system, to which sites would adhere. Reports have it that the Council compromise of June 2026 struck that article; Parliament has not settled its position, so nothing is decided, and compromise texts are negotiating drafts.<\/p>\n
The situation therefore stands the wrong way round. At the level that could oblige, the obligation is contested. At the level that already has a working mechanism, it is absent from the start. Germany has the technology without the lever; the EU is negotiating the lever without the technology.<\/p>\n
What a site can do with this today<\/h2>\n
The honest answer for most is: watch. As long as adoption is small, integrating changes nothing measurable about the number of banners, and the work does not pay for itself out of the benefit.<\/p>\n
Two reasons nonetheless argue for knowing the procedure. The first is direction: a consent setup that stores its own decision cleanly per purpose, and could draw it from an interchangeable source, is better prepared for any future rule than one in which the purposes are fused in the banner text. The second is how supervisory authorities see it: a site that ignores a machine-readable refusal while one is technically present argues from a weaker position at the next inspection.<\/p>\n
What stands here is a description of the legal position and not legal advice. The state of play summarises easily: the mechanism is finished, the register is public, and the decisive edge is dashed.<\/p>\n
\n
Questions and answers<\/h2>\n
Does integrating a recognised service replace the site’s own banner?<\/h3>\n
No, it supplements it. A signal exists only for people who use a recognised service and have set preferences there; everyone else is still asked through the site’s own banner. As long as adoption is low, the banner therefore stays the same for almost every visitor.<\/p>\n
What does storing consent \u201ccleanly per purpose\u201d mean in practice?<\/h3>\n
It means the decision exists as a record and not merely as a click on a button. Such a record holds, separately for each purpose:<\/p>\n