Germany’s Central Consent Management Regulation: Pros, Challenges, and Why It Might Miss the Mark
In December 2024, the German Federal Council (Bundesrat) approved the Central Consent Management Regulation ("Einwilligungsverwaltungsverordnung" or EinwV). This new framework aims to combat the overwhelming number of cookie banners on websites by creating a central consent mechanism. The goal is to improve user experience by reducing cookie fatigue while enabling businesses to offer a more seamless browsing experience.
But how does this new regulation work? What are its advantages and disadvantages? How practical is it for website owners? And, most importantly, will it actually reduce the deluge of cookie banners that frustrate users and complicate compliance for businesses?
Fundamentals: What Is the Central Consent Management System?
"The central consent management system aims to reduce the number of consent requests and provide a simpler solution for end users." (Source - Note: this is in German. We translated the text.)
The central consent management system allows users to save their cookie preferences with a single centralized service. Websites that integrate this service can retrieve and apply these preferences without the need to display individual cookie banners on every visit. In theory, it’s a "win-win": fewer banners for users and easier GDPR compliance for businesses.
The legal basis for this regulation is § 25 of the Telecommunications-Telemedia Data Protection Act (TTDSG). According to this law, cookies and similar technologies can only be set with user consent, unless they are technically necessary. The central consent management system is designed to standardize and simplify this process, addressing both user frustration and compliance challenges for website owners.
Context: Why Is Germany Introducing This Regulation?
The EinwV is part of Germany’s efforts to improve compliance with the European Union’s General Data Protection Regulation (GDPR) and its national equivalent for telecommunications, the Telecommunications-Telemedia Data Protection Act (TTDSG).
Under these laws, websites must obtain explicit user consent for cookies and tracking technologies, except for cookies that are strictly necessary for the website to function. This has led to the widespread adoption of cookie banners, which have created a poor user experience and confusion over consent management.
The EinwV introduces a centralized consent management system, allowing users to save their cookie preferences in a single place. Websites participating in this system can then retrieve and apply these preferences automatically, without requiring repetitive consent banners.
This regulation applies only in Germany and is separate from broader EU initiatives like the proposed ePrivacy Regulation, which seeks to unify cookie laws across Europe. International website owners should note that this system is not mandatory, and its implementation is currently limited to German users and businesses.
Our Expertise and Perspective on Consent Management
We approach the topic of consent management and data privacy from a different perspective. While many solutions focus on adding more complexity—like centralized consent services—we asked ourselves a simple question: Isn’t there an easier way?
Our answer was to create a solution that eliminates the need for cookies and complicated consent banners entirely. Instead of burdening the user experience with more layers, we opted for an approach that avoids data processing altogether. This is why we remain skeptical about whether centralized consent services truly address the core issue. Our experience shows that overly complex data privacy systems often lead to greater frustration for users and increased effort for businesses.
Rather than hosting your videos on YouTube, Vimeo, or Wistia, you can host them with us—completely bypassing the need for consent management. It’s not just simpler; it also gives you far more flexibility in designing your website. Features like autoplay videos? No problem at all. Feel free to explore the features we offer and see how they can transform your video hosting experience.
What Are the Advantages of Central Consent Management for Businesses?
- Reduced Technical Effort
By leveraging a central consent service, businesses can minimize the resources required to implement and maintain individual cookie banners. This is especially beneficial for small and medium-sized enterprises that may lack the capacity for complex data privacy solutions. - Improved User Experience (UX)
Fewer intrusive cookie banners lead to a more seamless user experience, which can positively impact time-on-site metrics and conversion rates. A smoother browsing journey helps retain users and improves overall engagement. - Unified Standards
Central consent management introduces a standardized framework for obtaining user consent. This simplifies GDPR compliance and reduces the risk of legal issues associated with inconsistent or non-compliant consent mechanisms.
This unified approach not only benefits businesses but also enhances trust with users by offering clear and consistent privacy practices.
How Does It Work in Practice?
The central consent management system allows users to save their cookie preferences with a centralized service, which shares this data with participating websites. In practice, this process is similar to integrating a cookie banner using a Consent Management Platform (CMP). Businesses select a central consent provider, integrate it with their site, and let the system manage cookie preferences. Here’s how the process works step by step:
1. Integration of a Certified "Central Consent Service"
- Select a central consent service certified under the new regulation.
- Integrate the service into your website via a Software Development Kit (SDK) or plugin.
- The implementation resembles existing CMPs, with the service embedded in your site’s header script to control all cookies and scripts.
2. Retrieval of User Data by the Service
When a user visits the website, the central consent service checks, using a Browser ID or another unique identifier, whether preferences have already been saved.
If preferences exist:
- The service informs the website which cookies and scripts are permitted.
- Only approved scripts (e.g., Google Analytics or YouTube) are activated.
If preferences do not exist:
- The website prompts the user to set preferences via the central consent service.
- Once saved, these preferences are applied automatically on future visits.
3. Adjusting Website Content
Based on the saved preferences:
- Allowed Content: Approved cookies and scripts (e.g., videos or tracking tools) are activated automatically.
- Blocked Content: Users see alternative messages, such as: "This video is blocked because cookies have not been enabled."
Users can modify their preferences directly through the central service or an integrated interface on your site.
4. Documentation and Traceability
The central service logs all consent activity, including:
- Timestamp of consent.
- Origin of the consent (e.g., the initial website where preferences were set).
- Duration of the consent’s validity.
Businesses can access this data through a dashboard to demonstrate compliance. However, to maintain user privacy, companies cannot view details about other websites where the user’s preferences were recorded.
Which Requirements Must a Central Consent Service Meet?
For a central consent service to be certified under the new regulation, it must meet specific criteria in three key areas: legal compliance, technical standards, and functionality. These requirements ensure that the service protects user rights, provides reliable data security, and integrates seamlessly with existing technologies.
1. Legal Requirements
The service must adhere to strict legal standards to ensure user rights and compliance with GDPR principles.
Key Requirements:
Voluntary and Informed Consent:
- Consent must be freely given, specific, and informed.
- Users must not be influenced through manipulative design (e.g., nudging) or coercion.
Right to Withdraw and Transparency:
- Users must be able to withdraw or modify their consent at any time.
- The service must make these options clear and easily accessible.
Regulation Reference:
"The central consent services [...] are obligated to protect the rights of end users transparently and enable them to make a free decision."
(BT-Drs. 20/12718, p. 4 - Note: this is in German. We translated the text.)
2. Technical Requirements
Certified consent services must maintain the highest standards of data security and technical reliability.
Key Requirements:
Data Security:
- User data must be encrypted and protected against unauthorized access.
- The service must comply with privacy-by-design principles, minimizing the amount of data collected.
High Availability:
- The service must be reliable and offer low-latency responses, as websites query the service on every visit.
Integration Capabilities:
- The service should support all major platforms and third-party tools (e.g., Google Analytics, YouTube) to ensure widespread compatibility.
Regulation Reference:
"Certified services must ensure that data is protected from unauthorized access and that compliance with data protection regulations is permanently guaranteed."
(BT-Drs. 20/12718, p. 6 - Note: this is in German. We translated the text.)
3. Functional Requirements
In addition to legal and technical compliance, central consent services must meet functional needs to streamline implementation for businesses and usability for end users.
Key Features:
- Interoperability: The service must seamlessly integrate with existing consent management systems and website architectures.
- User Accessibility: Interfaces must be user-friendly, allowing users to manage preferences easily.
- Comprehensive Logging: The service must document consent activity (e.g., timestamp, origin of consent, and validity) for traceability and compliance auditing.
Reality Check: How Many Fewer Banners Are Realistically Possible?
The primary goal of the Central Consent Management Regulation (EinwV) is to reduce the number of intrusive cookie banners. However, the practical implementation raises significant questions about its effectiveness. While the intention is clear, a closer look at the realities reveals why the reduction of banners might remain limited.
1. Technically Necessary Cookies Are Already Exempt
Websites that only use technically necessary cookies already don’t require cookie banners. Examples include:
- Corporate websites without user-based tracking or marketing tools.
- E-commerce sites that use cookies solely for shopping carts or session management.
For these cases, the central consent management system offers no added value, as no banner is required to begin with. Our website, for instance, demonstrates this principle: did you see a cookie banner when accessing this article? Likely not. For businesses that take user privacy seriously, the new regulation isn’t a necessity.
2. Participation Is Voluntary
According to the regulation, websites are not obligated to implement a central consent management system:
"The integration of consent management services by website operators is voluntary (§ 18 para. 1 EinwV)."
(Source: Data Protection Authority of Lower Saxony - Note: this is in German, we translated the quote)
This voluntary nature creates several challenges:
- Strategic control over data: Some companies may prefer their consent banners to maintain control over user data.
- Cost concerns: Implementing a central system involves technical adjustments and additional expenses.
- International requirements: Businesses with global reach may require alternatives for compliance across jurisdictions.
Without widespread adoption, the impact of the system will likely remain limited to a small circle of participants.
3. Third-Party Services Complicate Implementation
Most websites rely on multiple third-party tools, such as YouTube, Google Analytics, or HubSpot. These tools often require individual consent settings.
Even if users agree to the central system, these preferences must precisely match the tools used by the website.
Example:
- A user consents to Google Analytics but denies HubSpot.
- Websites often have unique combinations of 30–50 third-party services, making it unlikely that pre-set preferences will align perfectly.
As a result, businesses may still need cookie banners to handle services that don’t fit into the central system.
4. User Behavior: A Key Challenge
For the system to work, users must actively save their preferences. However, behavioral patterns suggest challenges:
"Accept All" behavior:
- This may be convenient for businesses but contradicts the GDPR’s goal of informed consent.
- Many users click “Accept All” to bypass banners without understanding the settings.
Rare updates to preferences:
- Users rarely revisit and update their settings, meaning stored preferences can become outdated.
- When this happens, banners may reappear, negating the benefits of central consent.
5. National Differences in Regulation
The central consent system applies only in Germany, creating challenges for international websites:
"When users cross the virtual 'border' on the internet, existing regulations apply. For internationally oriented websites, this means differentiated adjustments would be required."
(Source: IITR - Note: this is in German, we translated the quote)
Key Problems:
- In countries like France, where the CNIL enforces stricter cookie consent rules, banners remain mandatory.
- International websites must either:
In practice, most businesses may choose the latter options, further limiting the regulation’s impact.
6. Limited Scope: TTDSG vs. GDPR
A significant criticism is the regulation’s narrow scope:
"The consent management services only cover consents under § 25 TTDSG, not consents required under the GDPR. As a result, the services do not simplify the handling of consents."
(Source: Data Protection Authority of Lower Saxony - Note: this is in German, we translated the quote)
The TTDSG governs technology-specific consents (e.g., setting cookies), while the GDPR governs data-specific consents (e.g., processing collected data).
Example:
You use Google Analytics on your site.
- TTDSG requirement: Consent is needed to store a tracking cookie on the user’s device
- GDPR requirement: Consent is needed to process the data (e.g., IP address, behavior) collected by the cookie.
The central system addresses the TTDSG requirement but leaves the GDPR requirement untouched, forcing businesses to manage two separate systems.
7. What’s Next? The GDPR Is Already Poorly Implemented...
Let’s take one of the most important points from the regulation:
"The central consent management services [...] are obligated to protect the rights of end users transparently and enable them to make a free decision."
(Source: BT-Drs. 20/12718, p. 4 - Note: this is in German, we translated the quote)
Looking at the status quo several years after the introduction of the GDPR, one could describe the situation as a more-or-less major mess. On the one hand, there are websites that do everything correctly. On the other, studies show that many websites are still not GDPR-compliant (Source: arXiv.org).
"The main issue is that providers of digital services are not required to accept user decisions made via consent management services (§ 19 EinwV). If users reject consent, providers can repeatedly request it as often as they like. This pressures users into giving consent. This is unacceptable, contradicts the requirements of the GDPR, and removes the incentive for users to use consent management services. The regulation must stipulate that providers of digital services comply with user decisions."
(Source: DATEV Magazin - Note: this is in German, we translated the quote)
The Biggest Problems with Consent Management Today
Misclassified Services
Time and again, either out of ignorance or deliberately, services are placed in the category of “necessary cookies” and cannot be rejected. In these cases, the consent obtained is invalid.
For instance, Google Analytics clearly requires consent, as do YouTube, Vimeo, and other video-hosting services (even in their "NoCookie" variants), as well as Google reCAPTCHA.
Dark Patterns – Misleading Cookie Banners
Many websites design their cookie banners in a way that highlights the “accept” button while hiding or making the “reject” option difficult to find. These "dark patterns" are intended to manipulate users into giving consent and have been deemed unlawful by data protection authorities.
"We examined the 100 most-visited websites in the country for dark patterns and found that four out of five use manipulative cookie banners."
(Source: Netzpolitik.org - Note: this is in German, we translated the quote)
- Nudging
Some companies bombard their visitors with cookie banners so frequently and persistently that users eventually give in and consent. This happens, for instance, when websites or apps ask for consent again on every new visit and fail to save rejections.
- "Pay or OK" Models
Some news portals, such as SPIEGEL, use models where users must either consent to data processing or purchase a subscription. This approach has been criticized by privacy organizations like noyb and is currently the subject of legal disputes.
(Source: noyb) - Automatic Consent via Scrolling
Certain websites interpret actions like scrolling or simply remaining on the page as user consent for data processing, without explicitly obtaining it. This practice violates GDPR requirements for informed and voluntary consent.
(Source: Usercentrics)
8. Okay, Why Should I Care?
Because you, not the central consent service, will be held accountable. If your implementation is non-compliant, it’s your business that faces the legal and financial risks.
Conclusion: Well...
The Data Protection Commissioner for Lower Saxony sums it up perfectly:
"The LfD Niedersachsen assumes that the current practices regarding consent on websites will unfortunately change very little, and users will continue to be annoyed by the displayed consent requests."
(Source: Data Protection Authority of Lower Saxony Note: this is in German, we translated the quote)
The new regulation on central consent management is well-intentioned but raises serious concerns about its effectiveness and practical implementation.
"Incidentally, the issue of cumbersome consent banners could easily be solved without introducing consent management services. Website operators would simply need to consistently design their websites in a privacy-friendly way—for example, by avoiding third-party services and cookies, especially for excessive and unpredictable digital marketing. Moreover, many consent banners are so intrusive because users cannot simply 'click them away.'"
(Source: Data Protection Authority of Lower Saxony Note: this is in German, we translated the quote)
Our Perspective
Instead of developing yet another complex German solution that leaves so many questions unanswered in practice, why not focus on eliminating the problem altogether?
That’s precisely why we reimagined video hosting with a Privacy First mindset:
- State-of-the-art hosting without consent requirements and user tracking.
- Videos that play for all visitors—no consent management, no overlays, and no data sent to the U.S.
Let’s solve the problem at its root instead of building even more complicated frameworks around it.