{"id":2046,"date":"2024-04-21T20:26:01","date_gmt":"2024-04-21T18:26:01","guid":{"rendered":"https:\/\/trackboxx.com\/?p=2046"},"modified":"2025-03-17T16:30:34","modified_gmt":"2025-03-17T15:30:34","slug":"web-analytics-in-the-era-of-the-new-data-protection-act-ttdsg","status":"publish","type":"post","link":"https:\/\/trackboxx.com\/en\/web-analytics-in-zeiten-des-neuen-datenschutzgesetzes-ttdsg\/","title":{"rendered":"Web analytics under Germany\u2019s TTDSG data protection law"},"content":{"rendered":"<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-1769608 stk-block-background\" data-v=\"2\" data-block-id=\"1769608\"><style>.stk-1769608{background-color:#fcf8e3 !important;box-shadow:0 5px 5px 0 #123f5209 !important;border-style:solid !important;border-color:#f9f0c3 !important;border-left-width:8px !important}.stk-1769608:before{background-color:#fcf8e3 !important}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-1769608-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-15cfef8\" data-block-id=\"15cfef8\"><style>.stk-15cfef8{margin-bottom:0px !important}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-ad0c7ec\" data-block-id=\"ad0c7ec\"><style>.stk-ad0c7ec .stk--svg-wrapper .stk--inner-svg svg:last-child,.stk-ad0c7ec .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g,path,rect,polygon,ellipse){fill:#000000 !important}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-ad0c7ec\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-ad-0-c-7-ec-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-ad-0-c-7-ec-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 512A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM216 336h24V272H216c-13.3 0-24-10.7-24-24s10.7-24 24-24h48c13.3 0 24 10.7 24 24v88h8c13.3 0 24 10.7 24 24s-10.7 24-24 24H216c-13.3 0-24-10.7-24-24s10.7-24 24-24zm40-208a32 32 0 1 1 0 64 32 32 0 1 1 0-64z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-6dfbac1\" id=\"wichtig\" data-block-id=\"6dfbac1\"><h4 class=\"stk-block-heading__text\">Important<\/h4><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-7f19526\" data-block-id=\"7f19526\"><p class=\"stk-block-text__text translation-block\">Germany\u2019s TTDSG took effect on 1 December 2021, introducing several data protection rules. For websites, <a href=\"https:\/\/dr-dsgvo.de\/-25-ttdsg-schutz-der-privatsphaere-bei-endeinrichtungen\/\" target=\"_blank\" rel=\"noopener\">section 25 TTDSG<\/a> is particularly relevant. It implements the EU\u2019s ePrivacy Directive, often known as the Cookie Directive.<\/p><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Section 25 TTDSG concerns access to users\u2019 devices. Cookies are only one way of accessing them; other technologies are covered too. Reading system variables in a browser using JavaScript, for example, could also count as device access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">The TTDSG requires <strong>consent<\/strong> for access that is not necessary, whether through a cookie or by reading a system variable. Section 25(2) sets this out more precisely, although in longer and less accessible legal language.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Previously, the Telemedia Act\u2019s consent rules covered cookies used for marketing and user profiling. The TTDSG made it more demanding to count visitors without asking for consent.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tracking and counting visitors<\/h2>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">\u201cTracking\u201d has no single precise definition. It usually means <strong>following users<\/strong> across sessions and websites. <a href=\"https:\/\/dr-dsgvo.de\/google-universal-analytics-rechtskonform-nur-mit-einwilligung\/\" target=\"_blank\" rel=\"noopener\">Google Analytics<\/a> is a well-known example of this invasive approach. It requires consent not just for that reason, but because of the cookies it uses. That means presenting visitors with a cookie pop-up. These pop-ups are not only irritating; they often leave websites in breach of the rules, as my <a href=\"https:\/\/dr-dsgvo.de\/cookiegeddon-das-versagen-aller-consent-tools\/\" target=\"_blank\" rel=\"noopener\">Cookiegeddon investigation<\/a> explains.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">For simplicity, this article also uses \u201ctracking\u201d to mean basic <strong>visitor counting<\/strong>. To count visitors, you need to tell one user from another. Otherwise, you count too many or too few visits. Counting the same person as two <em>unique visitors<\/em> because they open two pages in succession skews the statistics. Counting two different people as one when they visit the same page is no more accurate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">So how do you tell users apart? <strong>HTTP<\/strong>, the protocol used to retrieve web pages, is <strong>stateless<\/strong>: it does not remember earlier requests. On its own, it cannot recognise a returning visitor. It is rather like having no memory and mistaking the same passer-by for a different person every time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cookies used to provide that memory. Under the interpretation of the TTDSG discussed here, they require consent even for simple visitor counting. The law refers to what is \u201cstrictly necessary\u201d. Cookies for counting visitors fail that test for two reasons. First, an exact visitor count is not strictly necessary\u2014a debatable point, although I think the stricter interpretation is more likely to prevail. Second, you can count visitors without cookies. That second point is what matters here.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How can you tell users apart?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to avoid asking for consent, cookies are not an option.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can distinguish visitors reliably without cookies by using the metadata a browser sends to the website with every HTTP connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technical specialists often call this connection data or traffic data. Lawyers may use those terms differently, so this article uses the broader term \u201cmetadata\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The metadata sent with a website request includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Browser type and browser version. Example: Mozilla Firefox Version 95.3, subversion 47.11<\/li>\n\n\n\n<li>Operating system type and version. Example: Microsoft Windows 10, 64-bit<\/li>\n\n\n\n<li>Preferred language. Example: German<\/li>\n\n\n\n<li>Network address (IP address)<\/li>\n\n\n\n<li>Cache settings<\/li>\n\n\n\n<li>Requested page. Example: https:\/\/dr-dsgvo.de\/<\/li>\n\n\n\n<li>The time of the request. It is not sent directly, but the server knows when the request arrives.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Using this metadata to distinguish users without cookies is known as <strong>browser fingerprinting<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fingerprinting can be made more precise by collecting additional information through JavaScript, for example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Screen resolution. Example: 1920\u00d71080<\/li>\n\n\n\n<li>Size of the browser window. Example: 1788\u00d7910<\/li>\n\n\n\n<li>Color depth. Example: 24-bit<\/li>\n\n\n\n<li>Time zone. Example: GMT+1<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">These <strong>fingerprinting details<\/strong> have to be actively requested. The metadata listed earlier arrives with the connection, so no extra request is needed. In my view, screen resolution is not stored on the user\u2019s device, although the TTDSG could be interpreted differently. One argument is that a smartphone\u2019s portrait or landscape orientation does not need to be stored: it can change continually. When you switch the phone back on, the display orientation depends on how you are holding it, not on its orientation before shutdown.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Techniques such as <strong>canvas fingerprinting<\/strong> gather further information that makes users easier to distinguish. However, there is little dispute that canvas fingerprinting is a form of device access that requires consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The safest legal approach is not to actively read any additional metadata from the user\u2019s device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The challenge is to retain enough data quality to count visitors accurately.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Counting visitors without consent<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Trackboxx shows that a minimal form of tracking can work without cookies or device access\u2014and therefore without consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Trackboxx uses only the metadata that already accompanies every page request. It does not make additional requests to access the user\u2019s browser. Under a strict interpretation of the TTDSG, those additional requests would require consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Trackboxx does not use cookies, not even session cookies, unless the customer configures it differently. A cookie that lasts for one session is less intrusive than one that remains for a month\u2014its lifespan. Legally, though, the TTDSG does not distinguish between session and persistent cookies. It distinguishes only between necessary and unnecessary cookies or access.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Because Trackboxx does not access the device within the meaning of the TTDSG, it does not require consent under that law.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">GDPR and TTDSG<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GDPR also applies. Its requirements must be considered after addressing the TTDSG rules on cookies and other device access. GDPR stands for General Data Protection Regulation. In German, the regulation is abbreviated as DS-GVO, although texts for a general audience often omit the hyphen and write DSGVO.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The GDPR covers personal data, including data that can be linked to a person. Being able to distinguish one user from another can be enough. The Court of Justice of the EU ruled in 2016 that IP addresses can constitute personal data; Germany\u2019s Federal Court of Justice confirmed the ruling in 2017.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You cannot therefore simply store a user\u2019s IP address to improve visitor counting. Storing it unencrypted would, on this interpretation of Article 6 GDPR, likely require consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To avoid that requirement, Trackboxx does not store IP addresses themselves. Instead, it pseudonymises each address in combination with other values.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A time-limited key is applied to a combination of the IP address, browser version, operating system version and current calendar day. The Trackboxx database therefore contains no IP address. In theory, an address could only be recovered from the encrypted data if the user returned on the same day. That recovery is unnecessary, however, because the next request supplies the IP address again anyway. This approach meets the GDPR requirements described here, with pseudonymised storage based on legitimate interests\u2014one of the GDPR\u2019s legal bases alongside consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Unlike consent, legitimate interests do not require an irritating cookie pop-up. Avoiding consent requests also offers greater legal certainty, because pop-ups are subject to <a href=\"https:\/\/dr-dsgvo.de\/checkliste-fuer-rechtssichere-einwilligungsabfragen-auf-webseiten\/\" target=\"_blank\" rel=\"noopener\">numerous requirements<\/a>, including those in Articles 7 and 13 GDPR. For example, a consent request must explain where and how consent can be withdrawn. Many cookie pop-ups omit this legally required information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IP addresses usually change over time, apparently less often on cable connections than on DSL. They do not, however, change precisely when someone opens a website, so the same visitor can very likely be recognised within a day. Users on corporate networks are harder to tell apart if centrally managed updates give employees identical browser and operating system versions. In practice, though, the resulting imprecision has little impact.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can measure visits and improve content without cookies or intrusive, error-prone cookie pop-ups. Tools such as Trackboxx offer a privacy-friendly solution that meets the TTDSG and GDPR requirements described here.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Data quality need not suffer compared with cookie-based visitor counting. Cookie-based tools have another weakness besides legal uncertainty: anyone can delete browser cookies, manually or with utilities such as CCleaner and antivirus software. Deleting a cookie wipes the tracker\u2019s memory. It then performs no better than Trackboxx, yet still needs consent. Corporate networks offer no advantage to cookie-based trackers either, since larger organisations routinely delete cookies from employees\u2019 computers under their security policies.<\/p>\n\n\n\n<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-5ef430a stk-block-background\" data-v=\"2\" data-block-id=\"5ef430a\"><style>.stk-5ef430a{background-color:#fcf8e3 !important;box-shadow:0 5px 5px 0 #123f5209 !important;border-style:solid !important;border-color:#f9f0c3 !important;border-left-width:8px !important}.stk-5ef430a:before{background-color:#fcf8e3 !important}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-5ef430a-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-0f8f04d\" data-block-id=\"0f8f04d\"><style>.stk-0f8f04d{margin-bottom:0px !important}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-bc761ba\" data-block-id=\"bc761ba\"><style>.stk-bc761ba .stk--svg-wrapper .stk--inner-svg svg:last-child,.stk-bc761ba .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g,path,rect,polygon,ellipse){fill:#000000 !important}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-bc761ba\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-bc-761-ba-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-bc-761-ba-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 512A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM216 336h24V272H216c-13.3 0-24-10.7-24-24s10.7-24 24-24h48c13.3 0 24 10.7 24 24v88h8c13.3 0 24 10.7 24 24s-10.7 24-24 24H216c-13.3 0-24-10.7-24-24s10.7-24 24-24zm40-208a32 32 0 1 1 0 64 32 32 0 1 1 0-64z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-b6bde30\" id=\"gut-zu-wissen\" data-block-id=\"b6bde30\"><h4 class=\"stk-block-heading__text\">Good to know\u2026<\/h4><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-b10b253\" data-block-id=\"b10b253\"><p class=\"stk-block-text__text\">You can respect data protection rules, avoid irritating pop-ups and still find out which content visitors read most. The TTDSG and GDPR do not rule out a workable solution.<\/p><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-call-to-action stk-block-call-to-action stk-block stk-e215782 is-style-default\" data-v=\"2\" data-block-id=\"e215782\"><div class=\"stk-block-call-to-action__content stk-content-align stk-e215782-column stk-container stk-e215782-container stk-hover-parent\"><div class=\"has-text-align-center stk-block-content stk-inner-blocks stk-e215782-inner-blocks\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-55888e5\" id=\"jetzt-trackboxx-30-tage-kostenlos-testen\" data-block-id=\"55888e5\"><h3 class=\"stk-block-heading__text\">Try Trackboxx free for 30 days now<\/h3><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-ea0d235\" data-block-id=\"ea0d235\"><p class=\"stk-block-text__text translation-block\">No payment information required! No automatic renewal!\nYour Trackboxx ready to go in 1 minute.<\/p><\/div>\n\n\n\n<div class=\"wp-block-stackable-button-group stk-block-button-group stk-block stk-0c93f40\" data-block-id=\"0c93f40\"><div class=\"stk-row stk-inner-blocks stk-block-content stk-button-group\">\n<div class=\"wp-block-stackable-button stk-block-button stk-block stk-b564d26\" data-block-id=\"b564d26\"><style>.stk-b564d26 .stk-button{padding-right:40px !important;padding-left:40px !important;background:linear-gradient(135deg,rgb(226,1,119) 0%,rgb(0,92,174) 99%) !important;border-top-left-radius:40px !important;border-top-right-radius:40px !important;border-bottom-right-radius:40px !important;border-bottom-left-radius:40px !important}<\/style><a class=\"stk-link stk-button stk--hover-effect-darken\" href=\"\/en\/helpcenter\/30-day-free-trial\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"stk-button__inner-text\">Start for free now<\/span><\/a><\/div>\n<\/div><\/div>\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Wichtig Das TTDSG gilt in Deutschland seit dem 01.12.2021. Es f\u00fchrt einige Datenschutzregeln ein. F\u00fcr Webseiten ist insbesondere der\u00a0\u00a7 25 TTDSG\u00a0interessant. Dieser Paragraph realisiert die sogenannte ePrivacy-Richtlinie der Europ\u00e4ischen Union, die oft als Cookie-Richtlinie bezeichnet wurde. Im \u00a7 25 TTDSG geht es tats\u00e4chlich um den Zugriff auf die Endeinrichtung von Nutzern. Cookies sind nur eine [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2047,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,37,53],"tags":[],"class_list":["post-2046","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogboxx","category-google-analytics","category-web-analytics"],"acf":[],"_links":{"self":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/2046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/comments?post=2046"}],"version-history":[{"count":0,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/2046\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media\/2047"}],"wp:attachment":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media?parent=2046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/categories?post=2046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/tags?post=2046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}