German regulator website sweeps: banners and analytics checked at scale

These are not single cases. They are three regulator sweeps that looked for two common faults: a banner with no equal way to refuse on the first layer, and Google Analytics cookies set as soon as the page opened. None of the regulators named the operators.

These are regulator findings from screening. In Bavaria and Saxony operators could still respond, so they are not final decisions. Inth translated the German.

• Bavaria: BayLDA built a tool that checks whether a banner offers, next to "Alle Akzeptieren" (accept all), an equal first-layer way to close it without consenting. The first run started with sites using one very common consent platform. German regulators hold that a refuse option must be on the first layer if the site cannot be used without dealing with the banner.
• Bavarian apps: in nearly all 15 apps checked, processes needing consent ran straight after install and before any interaction with a consent banner.
• Saxony: using Google Analytics requires prior voluntary and unambiguous consent. 2,300 operators, including companies, associations and public bodies, had not met that duty.
• Bremen: Google Analytics cookies were set as soon as visitors opened the pages. The regulator said visitors must actively consent and that a pre-ticked box is not enough.

BayLDA’s president said automated checks open "new options for enforcement", while further steps, remedies and fines stay with human case officers (translated).

Bremen’s report lists what Google Analytics cookies collect and send to Google: IP address with country and provider, browser, operating system, screen resolution, time zone, referring site, on-site behaviour and visit time. All of this left the browser before any choice.

1. 2023Bremen fines five website operators over Google Analytics
2. 9 February 2024BayLDA announces its website and app checks
3. May 2024SDTB checks about 30,000 websites
4. 13 June 2024SDTB announces letters to 2,300 operators

• Bavaria: operators could comment and fix their sites. BayLDA expected final results later in 2024; Inth did not find them.
• Saxony: operators were told to fix the breach and delete all unlawfully collected data. Those who did not would face formal proceedings after a recheck.
• Bremen: five fines. The report does not give amounts or names.

Not published. Bremen’s five fines have no stated amounts, and the Bavarian and Saxon steps were warnings rather than fines.

Enforcement no longer waits for complaints. A regulator can scan thousands of sites for the same two faults, so small operators are in scope too. It is the German counterpart to the UK regulator’s review of the top 1,000 sites.

• Website audit records what loaded before a choice and after Reject, with page, time, region and consent state.
• Consent banner: Accept and Reject get the same weight by default. Under the EU opt-in policy, optional tags wait until the visitor chooses. The Google tag uses Consent Mode v2 defaults set to denied.
• Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.

Tags without a c15t helper must be gated in your own code. Apps are outside the website banner.

In the repository

• Check that the analytics snippet is not in the page template outside the consent check.

In the browser and network

• Open the site in a clean profile and check for analytics cookies and requests before any click.
• Check that the first layer has a reject option equal to accept.

With the people responsible

• Ask who would answer a regulator’s letter and whether past unlawful data can be found and deleted.

• BayLDA press release, 9 February 2024 (PDF) (German)
• BayLDA audit materials (German)
• SDTB press release, 13 June 2024 (German)
• LfDI Bremen annual report 2023, section 4.7 (PDF) (German)

Source review: 20 October 2026. This page describes the cited records. It does not name or audit any operator. Inth did not find the final Bavarian results or the Bremen fine amounts. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: ICO top 1,000 cookie review, Neue Osnabrücker Zeitung, Planet49