Consent Management Ordinance (EinwV)

So much for the idea. In practice, the EinwV has so far been above all one thing: a framework that exists but is hardly being used yet. Anyone running a website today cannot avoid having their own consent banner. The ordinance changes nothing about this, and it was never intended to abolish the consent requirement itself.

The legal basis: Section 26 TDDDG

The EinwV does not stand on its own. It is the implementing ordinance for an authorisation that the legislator had already written into the then TTDSG in 2021. Section 26(1) TDDDG allows "recognised consent management services" to be established, i.e. services that obtain and manage consent on behalf of end users. The law names four criteria for this:

• User-friendly and competition-compliant procedures. The service must obtain and manage consent in such a way that an ordinary person understands the settings and is not pushed towards "accept all".
• No commercial self-interest. The provider may have no commercial interest of its own either in consent being given or in the managed data. This is the toughest hurdle: it practically excludes anyone whose business model depends on advertising data.
• Strict purpose limitation. The data generated in the service may be processed exclusively for consent management.
• Security concept. The provider must submit a concept demonstrating compliance with the GDPR requirements for data protection and data security.

Section 26(2) TDDDG contains the authorisation to issue an ordinance: the Federal Government may regulate by statutory ordinance what the procedures must look like, how the recognition procedure works, which body is responsible and which technical measures browsers and service providers should take. That is exactly what the EinwV is. Paragraph 3 also provides for an evaluation of its effectiveness within two years of the ordinance being issued, so the assessment is due.

What the legislator wanted to achieve

The political trigger is well known: banner fatigue. Anyone who clicks away twenty cookie dialogues a day no longer makes a conscious decision but looks for the fastest route to the content. Consent thus misses its purpose. The EinwV's answer is a shift: the preference is to move to where it is set once and then transmitted automatically, into an independent service, a browser plug-in or an operating system setting. This is the same idea that runs in the European debate under the abbreviation PIMS (personal information management systems) and that was also laid out in the failed ePrivacy Regulation.

What the EinwV regulates in concrete terms

The ordinance is short but precise. Essentially, it describes three things: the requirements for the service, the recognition procedure and transparency towards the outside world.

• Requirements for the user interface (Section 4 EinwV). The interface must be transparent and understandable. Settings must be viewable, changeable and revocable at any time, so revocation may not be harder to find than consent.
• Application procedure (Section 10 EinwV). Anyone who wants to be recognised submits an application with defined contents. Recognition is not a self-declaration procedure but an official review.
• Security concept (Section 12 EinwV). The provider documents measures for data security, the storage location of the data, protection against unauthorised access and the availability of the service.
• Public register (Section 13 EinwV). Recognised services are entered in a publicly accessible register. The register is the only reliable source for who is actually recognised; self-declarations on provider websites are not.

The recognition procedure at the BfDI

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible. The process has a special feature that you should know if you want to understand why the list of recognised services is so short:

1. The provider submits the application under Section 10 EinwV.
2. The BfDI first checks the formal and then the substantive requirements, in particular independence, purpose limitation and the security concept.
3. The draft decision goes to the applicant and to all state data protection authorities. They have four weeks to comment.
4. After recognition, the service is entered in the public register under Section 13 EinwV.

The involvement of all state authorities is the reason why the procedure takes months. But it is also the reason why recognition carries weight: it is not the opinion of a single authority but an administrative act coordinated within the network of data protection authorities.

Recognition is also not permanent. Providers must check annually whether they still meet the requirements; the BfDI can revoke recognition if the conditions no longer apply.

Real-world example: Consenter as the first recognised service

On 17 October 2025, the BfDI recognised the first service under Section 26 TDDDG: Consenter, developed by Berlin-based Law & Innovation Technology GmbH. The service was entered in the public register, and the associated browser plug-in has been available since the beginning of 2026.

The sober assessment: Consenter is so far the only entry in the register, and its adoption is on a scale that plays no role in the reach calculations of a shop or a corporate website. For website operators, this means in very practical terms that the existence of a recognised service does not relieve anyone of the obligation to run an effective banner themselves. Anyone who wants to know whether this has changed should look at the BfDI's register, not at marketing newsletters.

EinwV, CMP and PIMS: the distinction

Three terms are regularly mixed up. They describe different levels:

The decisive sentence is in the last column: participation is voluntary. The EinwV does not oblige any website to accept PIMS signals, and it does not oblige any user to use such a service. The entire mechanism therefore stands or falls with adoption, and that is exactly where it is stuck.

What the EinwV means for website operators today

For everyday life at mid-sized companies, the situation can be summarised in three sentences. First: the EinwV changes nothing about Section 25 TDDDG. Anyone who sets cookies that are not strictly necessary or reads information from the end device still needs effective consent. Second: a recognised service does not replace your own banner as long as it is not used across the board, and practice is far from that. Third: anyone who wants to follow developments has exactly one indicator that counts, the public register.

It nevertheless makes sense to keep your own CMP configuration in a state in which it could process an external signal in future. Anyone choosing a consent solution today should at least ask the provider how it intends to deal with recognised services under Section 26 TDDDG. This is not an urgent project, but a legitimate question in the selection discussion.

Outlook: the EinwV, ePrivacy and the Digital Omnibus

The German regulation is part of a European environment that continues to move. In its Digital Omnibus package, the EU Commission has proposed a reform of the cookie rules that would, among other things, strengthen machine-readable consent signals. However, the data protection part of this package has not been adopted, and the debate about whether banners will disappear or merely look different is open. As long as this remains the case, the EinwV is the only binding answer that actually exists in German law, with the well-known catch that it is voluntary.

Realistically, therefore, neither the scenario "banners will be history in 2027" nor the opposite is likely. More likely is an intermediate stage in which browsers and operating systems transmit signals in a standardised way and websites have to accept these signals. The EinwV has already created the legal framework for this in Germany. What is missing is adoption.

Three misconceptions that come up regularly

"We use a recognised CMP, so we're off the hook." Recognition under the EinwV concerns consent management services on the user side, not banner software on the operator side. A CMP can be very good and still have nothing to do with the EinwV. Anyone advertising with an "EinwV-compliant" seal should be able to show the register entry.

"The ordinance comes from Brussels." No. The EinwV is German ordinance law based on the TDDDG. The European level is discussing similar mechanisms as part of the ePrivacy reform and the Digital Omnibus package, but has not brought anything comparable into force. This also explains why German solutions end at national borders: a recognised service has no special legal status outside Germany.

"If a user sends a PIMS signal, we have to follow it." Current law does not provide for such an obligation. Participation is voluntary on both sides. Anyone who evaluates a signal anyway should document this properly: the GDPR accountability obligation applies to every consent, regardless of the route by which it was obtained. Conversely, a signal received does not release you from the obligation to be able to prove consent.

Frequently asked questions about the EinwV

Does the EinwV make cookie banners superfluous?

No. It creates the possibility of managing consent via a recognised service. As long as users do not use these services across the board and websites do not evaluate them, your own banner remains the way in which consent under Section 25 TDDDG is obtained.

Since when has the Consent Management Ordinance applied?

Since 1 April 2025. It is based on the authorisation to issue an ordinance in Section 26(2) TDDDG.

Who grants recognition?

The Federal Commissioner for Data Protection and Freedom of Information (BfDI). The state data protection authorities are involved before the decision and have four weeks to comment.

Which services are recognised?

Only the public register under Section 13 EinwV is authoritative. The first registered service is Consenter, recognised on 17 October 2025. Whether others have been added can be checked on the BfDI page on consent management under Section 26 TDDDG (in German).

May my CMP provider itself be recognised?

Only if it has no commercial interest of its own in consent being given or in the managed data, and can demonstrate its legal and organisational independence from companies with such interests. For most providers from the advertising and analytics environment, this is the decisive hurdle.