Cookies, consent and the ePrivacy mess: one rulebook for Ireland, Germany and Austria, and why the British advice does not travel

The point: one checkout, three markets, one rulebook, and a neighbour that rewrote its own

A shop in Galway that sells into Germany and Austria has one website and, on paper, one cookie law: all three countries sit under the same European rule, and all three read it the same way. Anything that is not strictly necessary waits for a yes, and the regulators have spent years spelling out what a yes looks like.¹²³ The complication is next door. On 5 February 2026 the UK, the market a good few Irish shops sell into and the market most of the English language advice is written for, rewrote its cookie regulation and opened a door for first party analytics without consent.⁴ Ireland did not follow, and neither did Germany or Austria.

That is the whole article. Read a British agency's blog, copy its tracking setup, and you are breaking the law at home and in your second biggest market. Build for the Irish rule and you are already building for the German and Austrian one, which is a mercy. Either way, the numbers in your ad accounts will be wrong by a predictable amount, which arithmetic fixes and a new tool does not.

I go through the law in each market with the primary sources, show what a valid consent looks like, draw what fires when a visitor says yes or no, and work through a Galway swimwear shop's June to put measured against modelled conversions in euro. The business numbers are made up. The law is not.

What the Irish law says

The Irish rule is Regulation 5(3) of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, which everyone shortens to the ePrivacy Regulations. It says, in substance: a person shall not use an electronic communications network to store information, or to gain access to information already stored, in the terminal equipment of a subscriber or user, unless the subscriber or user has consented and has been given clear and comprehensive information, prominently displayed and easily accessible, including the purposes of the processing.¹ Terminal equipment is your visitor's phone or laptop. The rule is about storing and reading, not cookies as such: a pixel, a fingerprint, local storage and a cookie are all the same thing to it, and the Data Protection Commission (DPC) says so in as many words.⁵

Regulation 5(5) holds the exceptions, and there are exactly two: storage or access for the sole purpose of transmitting a communication, and storage or access strictly necessary to provide an information society service the visitor explicitly requested.¹ That is the European wording, lifted straight across. There is no statistical exception, no analytics exception, no appearance exception. Regulation 5(4) does add an Irish curiosity: consent may be given through browser settings where that is technically possible and effective.¹ The DPC's reading of that sentence is that the circumstances are likely to be very limited, because the average visitor has no idea what their browser is set to or what tracking it lets through.⁵

The DPC published its guidance note on cookies and other tracking technologies on 6 April 2020, together with the report of a sweep it ran from August to December 2019. Three lines from the guidance matter to a shop. Analytics cookies require consent, full stop, and that includes first party analytics. A banner whose only button reads "ok, got it" or "I understand" is not consent. And if you store the visitor's consent in a cookie, you should ask them again no later than six months on, a default the DPC derived from first principles and expects you to justify if you go longer.⁵

The guidance also carries the sentence that British blogs quote at Irish shops as if it were an exception: first party analytics cookies are unlikely to be a priority for enforcement action by the DPC.⁵ Read it properly. It is a statement about the regulator's diary, not about the law. The sentence before it says the cookies need consent. A shop that sets Google Analytics on landing in Galway is breaking Regulation 5(3) and hoping nobody minds, which is a different thing from being allowed to.

The sweep report shows what the DPC found when it looked. It asked 40 well known Irish controllers across retail, media, food ordering, insurance, sport and the public sector how they used cookies, and 38 answered. Two were graded green, twelve red. About two thirds relied on implied consent, the "by continuing to browse you consent" banner, and ten of the 38, or 26%, had pre checked boxes consenting to marketing, advertising and analytics cookies.⁶ The DPC gave everyone six months from the guidance to put their sites in order, with enforcement to follow.⁵ That was October 2020.

Enforcement under the ePrivacy Regulations works differently from a fine on a dashboard. The DPC investigates under Regulation 17, on a complaint or on its own initiative, and can serve an enforcement notice requiring specified steps by a specified date. Ignoring the notice is an offence.¹ And the moment a cookie carries an identifier that can single a person out, which every analytics and advertising cookie does, the GDPR applies to the processing as well, with fines of up to €20 million or 4% of worldwide annual turnover.⁵⁷ Nobody in Ireland has been fined that for a cookie banner. The ceiling is there all the same, and the regulator sits in Dublin, two hours up the road.

What the UK did in 2026, and why it does not travel

Across the water, regulation 6 of the Privacy and Electronic Communications Regulations, PECR, was substituted on 5 February 2026 by the Data (Use and Access) Act 2025. The prohibition reads much like ours: subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.⁴ The difference is in the schedule.

Schedule A1 holds four exceptions that matter to a shop.⁸ Consent, in the UK GDPR sense. Strictly necessary, now with examples in the schedule itself: security, fraud and fault detection, authentication, recording the visitor's selections. And two new ones. The statistical purposes exception: no consent is needed if the sole purpose is collecting statistics on how the site is used in order to improve it, the information is shared with nobody except to help with that improvement, and the visitor is given clear information and a simple, free means of objecting.⁸ The British regulator, the Information Commissioner's Office (ICO), adds that the output must be aggregate data that is not personal data, that the exception does not let you follow individual visitors, and that it does not touch online advertising.⁹ The appearance and functionality exception: adapting the look or the functions of the site to the visitor's preference, and explicitly not adapting content to a person's interests or behaviour.⁹

Two lines from the British regulator survive the crossing intact. Legitimate interests is not a route round the storage rule: anything that fits no exception needs consent.¹⁰ And online advertising has never been exempt and still is not,⁹ whatever its separate advertising review brings one day.¹¹ Its maximum fine rose 35 fold at the same time, to a ceiling of 4% of worldwide annual turnover,¹² and it says 99% of the top 1,000 British websites now meet its banner standard.¹¹ The long tail of smaller shops, on either side of the water, is nowhere near that in my experience.

Why does this matter in Galway? Because it is the regime the tooling and the advice are written for. A British consultant telling you that first party analytics no longer needs a banner is right in Britain and wrong in Limerick. Whether a Galway shop could lean on the British exception for its British visitors is a question for a solicitor, and the answer changes nothing about what you build, because the Irish, German and Austrian standard is the strict one and your banner has to meet it.

What the law says in Germany and Austria

Both countries implement the same European rule Ireland does, article 5(3) of the ePrivacy Directive 2002/58/EC as amended in 2009. Storing information, or gaining access to information already stored, in a user's terminal equipment is allowed only if the user has consented, having been given clear and comprehensive information. The only carve outs are storage or access for the sole purpose of transmitting a communication, and storage or access strictly necessary for a service the user has explicitly requested.¹³ There is no statistical exception in that sentence, and neither country has invented one, any more than Ireland has.

Germany: section 25 of the TDDDG. Paragraph 1 says storage in, and access to, the end user's device is only permitted if the end user has consented on the basis of clear and comprehensive information, and that the information and the consent must follow the GDPR. Paragraph 2 lists the two exceptions: transmission of a message, and storage or access that is strictly necessary so that the provider of a digital service can provide a service the user explicitly requested.¹⁴ Until May 2024 the law was called the TTDSG. The name changed, the section number did not, and the German regulators say the new section 25 matches the old one in substance.²

The German regulators' joint guidance, the Orientierungshilfe Digitale Dienste of the Datenschutzkonferenz, last updated in November 2024, reads that section with a straight face. The legislator kept section 25(2) deliberately close to the European wording and added nothing. The necessity test is technical, a cookie cannot become necessary because the business model needs it, and even simple visitor counting is not automatically part of the service the visitor asked for.² The guidance refuses to bless "reach measurement" as a category at all: the term is too vague and the answer depends on the exact configuration and purpose.²

Austria: section 165(3) of the Telekommunikationsgesetz 2021. Providers must tell the user what personal data they will collect, on what basis, for what purposes and for how long, and collection is only permitted once the user has actively consented on the basis of clear and comprehensive information. The same two exceptions follow: transmission, and what is strictly necessary for a service the user explicitly requested.¹⁵ The Austrian regulator, the Datenschutzbehörde, summarises it in its cookie FAQ: for every technically unnecessary cookie, consent must be obtained, and pre set or pre ticked boxes in the banner are not permitted.³

The German fine for breaching section 25, under section 28 of the TDDDG, tops out at EUR 300,000.¹⁶ That sounds mild until you remember who brought the Planet49 case to the Court of Justice: a federation of consumer organisations, not a regulator.¹⁷

What strictly necessary means, and what it never means

The phrase does the heavy lifting in all three markets, and the DPC's test is the European one: the cookie must be restricted to what is strictly necessary to provide a service the visitor explicitly requested, judged from the visitor's point of view, not yours.⁵ The British regulator puts it as "without it the service could not technically be provided",⁹¹⁰ and the German guidance says the same.²

What passes, in all three markets: a session cookie that keeps the basket together once the visitor has put something in it, the cookie that authenticates a logged in customer, a load balancing cookie, security cookies that detect repeated failed logins, and the cookie that remembers the visitor's consent choice itself.⁵² The DPC's own examples are the basket cookie that expires at the end of the session and the cookie that records a language or country preference.⁵ The German guidance adds a useful subtlety: the basket and payment cookies become necessary when the visitor actually puts something in the basket or starts paying, not while they are merely browsing, and a language or colour preference needs no unique identifier at all, just the value "language: de".²

What does not pass, anywhere: analytics that identify or follow individual visitors, advertising, remarketing, social media plugins that track, and anything that shares data across sites or devices.⁵² The DPC adds two examples worth remembering. A travel site's two year cookie that remembers journey preferences is handy and still needs consent, and the cookies behind a chat widget may not be set until the visitor actually opens the chat.⁵ The Austrian FAQ lists the technically unnecessary services as the ones that need consent and names the basket as the classic necessary one.³

An example: Salthill Swimwear in Galway, which I use throughout, has a basket, a customer login, a consent banner, Google Analytics 4, Google Ads conversion tracking and a Meta pixel. Before any press on the banner it may set the basket cookie once something is in the basket, the login cookie once someone logs in, and the cookie that stores the consent choice. Everything else waits. In Ireland, Germany and Austria the question of analytics without consent does not arise: analytics waits for a yes. The British statistical exception is the only one of its kind in the four markets I write for, and even there I do not see how Google Analytics 4 fits, because the data goes to Google and feeds advertising.

What a valid consent looks like

All three markets take the consent definition from the GDPR, article 4(11): a freely given, specific, informed and unambiguous indication of the person's wishes, by a statement or by a clear affirmative action.⁷ The DPC says in terms that cookie consent must meet that standard.⁵ Recital 32 adds the sentence that killed a decade of banner design: silence, pre ticked boxes or inactivity do not constitute consent.⁷ Article 7(3) adds that it must be as easy to withdraw consent as to give it.⁷

The Court of Justice applied that to cookies in Planet49, case C 673/17, on 1 October 2019. A German company ran a promotional lottery with a pre ticked box consenting to advertising cookies. The Court held that consent is not validly given by way of a pre checked box the user must deselect to refuse, that this is true whether or not the information in the cookie is personal data, and that the visitor must be told how long the cookies run and whether third parties can read them.¹⁷ The judgment landed two months into the DPC's sweep, and the report reads it the same way.⁶

The European Data Protection Board's consent guidelines of May 2020 close the remaining gaps. Access to a site must not be made conditional on consent to cookies, the so called cookie wall, because that consent is not freely given. Scrolling or swiping through a page will not under any circumstances count as a clear affirmative action.¹⁸

And then the regulators on the reject button, which is where most banners still fail. The DPC: if the banner has an accept button, you must give equal prominence to a reject option or to one that takes the visitor to a layer where they can choose by purpose, a banner must not nudge, and a banner that disappears when the visitor scrolls is not consent to anything.⁵ The German guidance: the option to refuse must be clearly recognisable as an equal alternative to the option to consent, which it says is the case when, for example, a button comparable in size, colour, contrast and typeface sits next to the consent button, and a "Settings or reject" button that leads to a second layer is not enough.² The Austrian FAQ: not giving consent must be just as easy as giving it, and the visitor cannot be made to find the refusal on a second or third layer.³ The British checklist says the same, visitors must be able to reject as easily as they accept, and "continue to use our website" with an OK button beside it is not consent.¹⁹

So the banner that is legal in all three markets is dull: two buttons of the same weight on the first layer, no pre ticked purposes, the purposes and third parties named, nothing non essential set until a button is pressed, a footer link that reopens the banner, and a fresh ask inside six months. How a nudge becomes a liability is in my piece on dark patterns in consent design.

Google consent mode v2 is a platform rule, not a law

Consent mode is Google's mechanism for telling its tags what the visitor decided. The tags read four signals: ad_storage and analytics_storage for cookies, and since late 2023 ad_user_data for sending user data to Google for advertising and ad_personalization for personalised advertising. The last two are what people mean by "v2".²⁰

Google's EU user consent policy requires legally valid consent for cookies or local storage where the law requires it, and for the use of personal data for ad personalisation, from users in the European Economic Area, the UK and Switzerland, with records kept.²¹ For EEA traffic, which is every Irish, German and Austrian visitor, Google tied the policy to features: to keep using its tags for measurement, ad personalisation and remarketing, you must collect consent and share the signals with Google.²² That is a contract condition, not a statute, but for a shop in Galway it has the same effect.

Consent mode comes in two shapes.²⁰ Basic: the Google tags do not load until the visitor has interacted with the banner, and if they refuse, no data goes to Google at all. Advanced: the tags load with every signal defaulting to denied, send cookieless pings while consent is denied, and send full measurement only once the visitor grants it. The advanced shape is what gives Google's modelling its own material on the visitors who refused.

For Irish, German and Austrian traffic, which for a Galway shop is the whole of its EU trade, that difference is a legal one. The advanced shape loads Google's script before the visitor has decided, and while consent is denied the script has the browser send pings with a timestamp, the user agent and the referrer to Google.²⁰ The European Data Protection Board reads the European rule as covering exactly that: JavaScript that instructs the browser to send information clearly falls within it, and collecting header data such as the user agent can bring it into play.²³ Being in scope does not by itself mean consent is needed, the EDPB adds, because an exemption may apply.²³ But Regulation 5(5) has only transmission and what is strictly necessary for a service the visitor asked for, nobody asked for Google to model ad conversions, and the DPC says cookies related to advertising are not strictly necessary.¹⁵ Germany's section 25 TDDDG and Austria's section 165(3) carry the same two exceptions, so the same EDPB reading applies there,¹⁴¹⁵ and the German guidance adds that while the banner is showing, no scripts that may access the device are loaded where that access needs consent.² I found no statement by the DPC or a German regulator that names cookieless pings, either way. So basic mode is my default in all three markets, and advanced mode only if the shop's own lawyer sets out in writing why it is lawful. In basic mode Google still models refused conversions, with a general model rather than one specific to your account.²⁰ That brings us to the numbers.

What fires when: the flow

Here is the sequence I build for a shop in all three markets. The first layer is identical everywhere, and so, for once, are the branches, because the three markets share a rule.

Read it top to bottom. The first two boxes happen before anyone touches anything, and they are where most sites fail: the tag manager loads, the pixels fire, and the banner is decoration. That is exactly the "setting of cookies on landing without any engagement by the user" the DPC flagged in its sweep.⁶ The accept branch is ordinary tracking. The reject branch is where the work is, and my rule for it comes below. Both branches land in one report, which has to say which numbers were observed, which were modelled and which came from the database. The engineering of event tracking under consent mode is its own article.

Measured versus modelled: the Galway numbers

Now the arithmetic, because this is where consent stops being a legal question and becomes a budget question.

Worked example: Salthill Swimwear's June in numbers

Salthill Swimwear is an invented shop in Galway run by Siobhán. It sells to Ireland, Germany and Austria, in that order of size. In June it bought 20,000 Google Ads clicks at €0.40 each, so €8,000 of spend: 10,000 clicks and €4,000 in Ireland, 8,000 clicks and €3,200 in Germany, 2,000 clicks and €800 in Austria. Siobhán's own database, which matches orders to the landing session, says those clicks produced 400 orders: 200 in Ireland, 160 in Germany, 40 in Austria. The average order was €65, so €26,000 of revenue from €8,000 of ads. Every one of those numbers is made up for the example.

Now the banner. For the example I assume 60% of Irish visitors press accept and 45% of German and Austrian visitors do, and I come back to those assumptions below. For the first pass I also assume refusers buy at the same rate as accepters, and then I remove that assumption.

Google Ads can only see a conversion when the click id survived in a cookie it was allowed to set. So the conversions it observes are the true conversions multiplied by the consent rate:

$$C_{\text{obs}} = C \times r$$

Here $C_{\text{obs}}$ is the number of conversions the ad platform observes, $C$ is the true number of conversions from those clicks, and $r$ is the consent rate, the share of visitors who accepted. This is a plain rate applied to a count, so if you want the groundwork it is in Foundations: ratios and rates.

Market by market: Ireland, $200 \times 0.60 = 120$. Germany, $160 \times 0.45 = 72$. Austria, $40 \times 0.45 = 18$. Observed total: 210 of 400 orders, which at €65 is €13,650 of the €26,000 that actually happened.

Google's modelling fills part of the gap. Its help page says modelling estimates the missing ad to conversion paths from the journeys of consenting users and from historical trends, deliberately errs on the side of under prediction, needs the cookieless pings to calibrate, and only switches on once an account passes 700 ad clicks a day over seven days per country and domain grouping.²⁴ It gives one illustration: at a 50% consent rate, modelling produced an 18% uplift in reported conversions.²⁴ For the example I assume a 20% uplift on the observed figure. Ireland, $120 \times 1.20 = 144$. Germany, $72 \times 1.20 \approx 86$. Austria, $18 \times 1.20 \approx 22$. Modelled total: 252 orders, €16,380.

The bars are revenue in euro from the same 20,000 clicks, counted three ways: what Google Ads shows with consent mode alone, what it shows once modelling kicks in, and what Siobhán's database knows. The platform is not lying. It reports what it was allowed to see plus a cautious estimate, and even then the account shows about 63% of the real revenue. Nobody at the platform will ring Siobhán to tell her.

Now watch what that does to a decision. Return on ad spend is revenue divided by spend:

$$\text{ROAS} = \frac{\text{revenue}}{\text{spend}}$$

$\text{ROAS}$ is the return on ad spend as a plain multiple, $\text{revenue}$ is the revenue the clicks produced and $\text{spend}$ is what the clicks cost. The maths is the same ratio as before, so Foundations: ratios and rates covers it, and the reason the average ratio is the wrong one to scale a budget on is in Foundations: marginal versus average.

Actual ROAS is the same in all three markets by construction: Ireland $13{,}000 / 4{,}000 = 3.25$, Germany $10{,}400 / 3{,}200 = 3.25$, Austria $2{,}600 / 800 = 3.25$. Observed ROAS is not. Ireland $7{,}800 / 4{,}000 = 1.95$. Germany $4{,}680 / 3{,}200 = 1.46$. Austria $1{,}170 / 800 = 1.46$. If Siobhán has told Google to chase a target ROAS of 2.0, or if her agency reads the dashboard on a Monday morning, Germany gets cut, not because German customers buy less but because they press reject more often. That is the most expensive consent mistake I see, and it is invisible unless you hold the platform's number against your own.

Correcting for the bias, and why you still need your own database

Now remove the simplifying assumption. Google's own page says consented users are typically two to five times more likely to convert than unconsented ones.²⁴ Part of that is real: someone who presses accept is more engaged. Part of it is an artefact: some of the "unconsented" conversions are simply not visible. Either way, dividing the observed number by the consent rate overstates the truth. If consenting visitors convert $k$ times as often as refusing visitors, the true count is:

$$C = C_{\text{obs}} \left( 1 + \frac{1 - r}{k \, r} \right)$$

$C$ is the true number of conversions, $C_{\text{obs}}$ the observed number, $r$ the consent rate and $k$ the ratio of the consenters' conversion rate to the refusers' conversion rate. With $k = 1$ the bracket collapses to $1/r$ and you are back to dividing by the consent rate. The derivation is two conditional rates added together, which is Foundations: probability territory.

Germany, observed 72, $r = 0.45$. With $k = 1$: $72 \times (1 + 0.55 / 0.45) = 72 \times 2.22 = 160$, the true figure in the example. With $k = 2$: $72 \times (1 + 0.55 / 0.90) = 72 \times 1.61 = 116$. So the honest estimate from the platform's side is "somewhere between 116 and 160 German orders", which is a wide range to run a budget on. Siobhán's database says 160, and the database does not need an estimate because it counted.

Server side tracking without consent: my renaming rule

A visitor who presses reject still places an order. The order is a contract between them and the shop, the shop records it in its own database under the GDPR's contract basis, and no cookie is read or written to do so.⁷ That record is the shop's first party truth and it is not a Regulation 5 matter, because nothing is stored on or read from the device beyond the strictly necessary session.

The question is what, if anything, the shop sends onward from that record. Here is the rule I apply, and I state it as my practice rather than as a reading of the law. Every event from a visitor who refused is renamed out of retargeting. The consented order goes to the platforms as the standard event, purchase to GA4, the conversion action to Google Ads with the click id, Purchase to Meta with the matching identifiers. The refused order goes as purchase_nc, stripped of every identifier: no click id, no cookie id, no hashed email, no user agent beyond what the transport needs. That event name is never mapped to a conversion action the platform optimises on, and it is never eligible for an audience. It exists so the total in the report matches the database, and for nothing else.

Why a rename rather than a quiet toggle: the people who run ad accounts change, and a named event is harder to misuse by accident than a flag someone forgot. Nothing from a person who said no should ever become a retargeting audience, and the name enforces that when I am not in the room. The policy backdrop is Google's own: ad personalisation requires consent, and records of it.²¹ An event with no identifier has nothing to personalise with.

For all three markets, which for a Galway shop means the whole of its EU trade, I go a step further and keep the refused stream inside my own systems. In January 2022 the Austrian Datenschutzbehörde, deciding the first of the 101 complaints noyb filed after Schrems II, found that a site's use of Google Analytics sent personal data to Google in the United States without an adequate basis.²⁵ The EU US Data Privacy Framework has since restored a transfer ground to certified US companies.²⁶ The regulators' appetite for data about refusing visitors landing at an American advertising company has not changed with it, and I see no reason to expect Dublin to be more relaxed than Vienna. So the refused orders stay in the shop's database and its own reporting, and the platforms see nothing of them, because in basic mode no tag fires after a no. The plumbing is in the technical guide to server side tracking.

Consent rates: what to expect, and why the number lies a little

People ask me for the consent rate they should plan on, and the honest answer starts with a definition. Commanders Act's 2025 privacy barometer, which looked at 1,301 banners on sites around the world in May 2025, reports an average consent rate of 80.54%. But it defines consent rate as the share of visitors who accepted among those who made a choice, and it reports separately that 32.41% of visitors made no choice at all. The share who consented out of all visitors, which the report calls opt in, was 55.03%.²⁷ Same banners, same month, and the headline number is 25 points higher than the useful one.

For a shop, the useful one is the opt in: the share of all visitors whose conversions the platform can see. That is the $r$ in the formulas above. The visitors who made no choice are refusers as far as your ad account is concerned, because nothing non essential fired. So when a vendor quotes you a consent rate, ask which denominator, and ask whether the banner behind the number had an equal reject button on the first layer. A high consent rate is sometimes a well designed banner and sometimes an illegal one, and the DPC's sweep found a good few of the second kind.⁶

That is why the example used 60% and 45%: assumptions the published figures make plausible, not measurements. The right number for your shop is the one your own banner produces, measured as opt in over all visitors, market by market, and fed into the correction above every month. Where consent is logged properly, that is one query.

What I would build, in order

If Salthill came to me, the order of work would be this, and it is the same for any shop selling from Ireland into the German speaking markets.

First, the banner: two equal buttons on the first layer, purposes and third parties named, nothing non essential before a press, a footer link to change the choice, a consent log, and the consent asked for again inside six months. One banner for all three markets, because Ireland, Germany and Austria sit under the same rule, and a British visitor loses nothing by meeting it.

Second, the exceptions. Keep the strictly necessary list short and written down, with the reason each item is on it, and put nothing analytical on it. If somebody waves the British statistical exception at you, or the DPC's enforcement priority sentence, ask them to show you where Regulation 5(5) says analytics. It does not.

Third, consent mode v2, in the basic shape by default: no Google tag before a press, nothing to Google after a no. Advanced mode only if the shop's own lawyer has set out in writing why its cookieless pings are lawful in Ireland, Germany and Austria. I run the same setup for British visitors rather than split the site in two.

Fourth, the shop's own measurement: orders matched to landing sessions, a monthly reconciliation of platform conversions against database conversions per market, and the correction formula applied so nobody cuts Germany for pressing reject. On Solidus the order record already carries what is needed.

Fifth, the renaming rule, in the code and on one page the next marketer will read.

The old version of this article said that in the German speaking markets compliance is a trust signal. I still think so, and I still cannot prove it with a number, so it stays an opinion. What I can prove is the arithmetic: a shop that measures against its own database makes better budget decisions than one that reads the dashboard, and in Germany and Austria the gap between the two is wider still than at home, because more people there press reject. That is reason enough.

Sources

Footnotes

1. European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, Regulation 5 (confidentiality of communications) and Regulation 17 (Commissioner's powers of enforcement), Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

2. Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (DSK), Orientierungshilfe der Aufsichtsbehörden für Anbieter:innen von digitalen Diensten (OH Digitale Dienste), Version 1.2, marginal numbers 5, 6, 67, 75 to 78, 80, 81, 83, 84, 87 to 90, 121, 135 and 137, DSK, November 2024, https://www.datenschutzkonferenz-online.de/media/oh/OH_Digitale_Dienste.pdf

3. Datenschutzbehörde (Austria), FAQ Datenschutz und Cookies, dsb.gv.at, https://dsb.gv.at/faqs/datenschutz-cookies

4. The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6, as substituted on 5 February 2026 by the Data (Use and Access) Act 2025, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2003/2426/regulation/6

5. Data Protection Commission, Guidance note on cookies and other tracking technologies, dataprotection.ie, 6 April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf

6. Data Protection Commission, Report by the Data Protection Commission on the use of cookies and other tracking technologies, following a sweep conducted between August 2019 and December 2019, dataprotection.ie, 6 April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Report%20by%20the%20DPC%20on%20the%20use%20of%20cookies%20and%20other%20tracking%20technologies.pdf

7. Regulation (EU) 2016/679 (General Data Protection Regulation), article 4(11), article 6(1)(b), article 7, article 83 and recital 32, EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

8. The Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1 (exceptions to regulation 6), inserted 5 February 2026, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2003/2426/schedule/A1

9. Information Commissioner's Office, Guidance on the use of storage and access technologies: What are the exceptions?, ICO, 2026, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/

10. Information Commissioner's Office, Fact vs fiction: ICO debunks myths on storage and access technologies, ICO, 11 September 2025, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/09/fact-vs-fiction-ico-debunks-myths-on-storage-and-access-technologies/

11. Information Commissioner's Office, Final storage and access technologies guidance published, ICO, 29 April 2026, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/

12. Mayer Brown, The Data (Use and Access) Act: PECR reform, rules relating to electronic marketing and cookies in the UK, Mayer Brown, 1 July 2025, https://www.mayerbrown.com/en/insights/publications/2025/06/the-data-use-and-access-act-pecr-reform-rules-relating-to-electronic-marketing-and-cookies-in-the-uk

13. Directive 2002/58/EC on privacy and electronic communications, consolidated text as amended by Directive 2009/136/EC, article 5(3), EUR Lex, 2009, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219

14. Telekommunikation Digitale Dienste Datenschutz Gesetz (TDDDG), § 25 Schutz der Privatsphäre bei Endeinrichtungen, Bundesministerium der Justiz, gesetze im internet, https://www.gesetze-im-internet.de/ttdsg/__25.html

15. Telekommunikationsgesetz 2021 (TKG 2021), § 165 Datenschutz, Allgemeines, Linde Verlag law database, https://linda.lindeverlag.at/Dokument/537514_165/

16. Telekommunikation Digitale Dienste Datenschutz Gesetz (TDDDG), § 28 Bußgeldvorschriften, Bundesministerium der Justiz, gesetze im internet, https://www.gesetze-im-internet.de/ttdsg/__28.html

17. Court of Justice of the European Union, Press release 125/19, Judgment in Case C 673/17 Planet49: Storing cookies requires internet users' active consent, 1 October 2019, https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf

18. European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1, paragraphs 39 to 41 and 86, 4 May 2020, https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf

19. Information Commissioner's Office, Guidance on the use of storage and access technologies: How do we comply with the PECR rules?, ICO, 2026, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-comply-with-the-pecr-rules/

20. Google, Consent mode overview, Google for Developers, Tag Platform, https://developers.google.com/tag-platform/security/concepts/consent-mode

21. Google, EU user consent policy, Google, https://www.google.com/about/company/user-consent-policy/

22. Google, Updates to consent mode for traffic in European Economic Area (EEA), Google Ads Help, https://support.google.com/google-ads/answer/13695607?hl=en

23. European Data Protection Board, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0, paragraphs 33, 40 and 43, EDPB, 7 October 2024, https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf

24. Google, Google Ads Help page on consent mode modelling (the page title uses the American spelling), https://support.google.com/google-ads/answer/10548233

25. noyb, Austrian DSB: EU US data transfers to Google Analytics illegal, noyb.eu, 13 January 2022, https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal

26. European Commission, EU US data transfers: adequacy decision for the EU US Data Privacy Framework, 10 July 2023, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en

27. Commanders Act, Privacy Barometer 2025 edition (1,301 banners, 1 to 31 May 2025), Commanders Act, 2025, https://www.commandersact.com/wp-content/uploads/2025/09/Barometre-Privacy-2025-EN-website.pdf