The Baden-Württemberg data protection authority ('LfDI Baden-Württemberg') released, on 29 April 2019, its frequently asked questions ('FAQs') regarding cookies, tracking and compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In particular, the FAQs highlight that website operators and mobile app developers must ensure that their data processing is compliant with the GDPR and that the data protection regulations of the former Telemedia Act 2007 ('the TMG') are no longer in force.

In addition, the FAQs reiterate that telemedia service providers that integrate elements that aggregate user behaviour, especially across websites or device boundaries, require active, explicit, informed, voluntary and prior user consent. The FAQs note that a mere notification that a website uses cookies to improve browsing experience, or for web analytics and advertising, is insufficient and misleading because the processing of the user's data is not transparent. Furthermore, consent must not be obtained for the use of cookies per se, but for the collection and transfer of personal data. In particular, it must be clearly and comprehensibly listed to which third parties the data is passed on and also which third parties are collecting or receiving data and for what purpose. The FAQs also provide advice on the creation of consent banners.

You can read the press release here, the FAQs here, and guidance here, all only available in German.