Skip to main content

Germany TDDDG (formerly TTDSG) Self-Assessment: Sealmetrics

Reviewed: 12 August 2026. This is a self-assessment; no supervisory authority certifies analytics tools.
Sealmetrics stores nothing on the visitor's terminal equipment and reads no cookies or storage from it, so it does not perform the storage act regulated by §25(1) of the German Telecommunications Digital Services Data Protection Act — the TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), known until May 2024 as the TTDSG. The tracker does read standard runtime browser properties via JavaScript to compute a session identifier. Our reading, set out in Criterion 2, is that this is not access to information stored in the terminal equipment, so no consent banner is required for analytics in Germany. That is an open question, not a certainty: the EDPB reads "access" broadly, and the DSK does not extend the §25(2) exemption to audience measurement, so if §25(1) were held to apply there would be no exemption to fall back on. Check with your DPO or counsel. §25 TDDDG is Germany's transposition of Article 5(3) of the ePrivacy Directive; this self-assessment covers it and the GDPR layer for visitor data as framed by the DSK.

Important Notice

This self-assessment follows the published legal framework and the guidance of the German Data Protection Conference (DSK), but does not constitute certification by the DSK, any German supervisory authority (Landesdatenschutzbehörde), or the BfDI. No such certification scheme for analytics tools currently exists in Germany. This document demonstrates how Sealmetrics meets the applicable requirements when properly configured.

Is a consent banner required for Sealmetrics in Germany?​

CategoryStatus
§25(1) TDDDG — storage of information on terminal equipment✅ Not triggered — nothing is stored
§25(1) TDDDG — access to information stored on terminal equipment⚠️ Sealmetrics' position: not triggered — no cookies or storage are read; runtime browser properties are read to compute the session identifier (see Criterion 2)
GDPR layer (visitor data)✅ No data that identifies anyone; session identifier pseudonymised and unrecoverable after daily rotation; Art. 6(1)(f) legitimate interest
DSK Orientierungshilfe alignment✅ Consistent
Consent banner required⚠️ Our reading: not required — an open question; check with your DPO or counsel (the tracker reads device properties, and the DSK does not extend §25(2) to audience measurement)
Last Assessment DateFebruary 2026

Why is Germany the hard case for analytics?​

Germany is widely regarded as the strictest large EU market for analytics:

  1. §25 TDDDG has no analytics exemption. Unlike France (CNIL's audience-measurement exemption) or the UK (the DUAA 2025 analytics exemption), German law exempts only what is strictly necessary to provide the service the user requested (§25(2) Nr. 2). The DSK has consistently stated that audience measurement is not strictly necessary.
  2. German supervisory authorities actively enforce against cookie banners and tracking implementations.

This means a tool can only operate consent-free in Germany by not triggering §25(1) at all — not by claiming an exemption. That is Sealmetrics' reading of its own design; because the tracker reads device properties via JavaScript, it is a reading a German DPO may not share (see Criterion 2).

Part 1: §25(1) TDDDG — The Two Prohibited Acts​

§25(1) TDDDG requires consent for two acts:

"The storage of information in the terminal equipment of the end user, or the access to information already stored in the terminal equipment, is only permitted if the end user has consented on the basis of clear and comprehensive information."

The provision is technology-neutral: it covers cookies, localStorage, sessionStorage, IndexedDB, cache-based identifiers, and fingerprinting techniques that read stored device information. Note that §25 applies regardless of whether personal data is involved — it protects the integrity of the terminal equipment itself.

Criterion 1: Storage of information in the terminal equipment​

Requirement: No information may be stored on the user's device without consent (unless strictly necessary).

AspectSealmetrics Compliance
Cookies (first- or third-party)✅ None set
localStorage / sessionStorage✅ Not used by the tracker
IndexedDB, cache identifiers, ETags✅ Not used
Any other write to the terminal✅ None

Evidence: The Sealmetrics tracker (~1 KB) writes nothing to the browser. Session continuity (~2-hour window) is handled server-side, not by placing any marker on the device — from a session identifier the tracker computes and sends with each hit (see Criterion 2). You can verify this yourself: load a page with Sealmetrics installed and inspect DevTools → Application → Cookies/Storage. Nothing appears.

Assessment: ✅ The first prohibited act of §25(1) does not occur.

Criterion 2: Access to information already stored in the terminal equipment​

Requirement: No reading of information stored on the user's device without consent.

AspectSealmetrics Compliance
Reading cookies or storage APIs✅ Never — nothing was stored, nothing is read
FingerprintingThe tracker computes, in the browser, a hash of runtime device characteristics — a device fingerprint (see below). No cookies or storage are read to do so
Reading files, contacts, or device identifiers✅ Not performed

The nuance, stated honestly: the tracker does evaluate runtime browser parameters via standard JavaScript APIs — the browser timezone (Intl.DateTimeFormat().resolvedOptions().timeZone, used for country detection and as a hash input) and, as inputs to the session-identifier hash only, languages, screen resolution, colour depth, dark-mode and reduced-motion preferences, CPU core count and device memory. Whether reading such runtime environment parameters constitutes "access to information stored in the terminal equipment" under §25(1) is a debated question in German commentary. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) read "access" broadly, and on that reading a script retrieving these properties can count as access; a DPO who follows them may conclude that §25(1) is engaged.

The DSK's Orientierungshilfe für Anbieter von Telemedien takes the position that information the browser transmits anyway as part of the communication (e.g., the User-Agent header in every HTTP request) is not "access" within the meaning of the provision, whereas active retrieval of stored information is. Sealmetrics' position, criterion by criterion:

ParameterHow obtained§25 analysis
User agentTransmitted by the browser in every HTTP requestNot "access" — part of the communication itself
Referrer, URLTransmitted by the browser / part of the page contextNot "access"
TimezoneStandard JS runtime API; a configuration value, not stored user informationReasonably outside §25; even under the strictest reading, it is a single non-identifying value used for coarse (country-level) statistics and as one input to the session-identifier hash; on its own it creates no identifier
Languages, screen resolution, colour depth, dark-mode and reduced-motion preferences, CPU core count, device memoryStandard JS runtime APIs; combined in the browser with the user agent, timezone and the site's account ID into a hash that serves as the session identifierSame interpretive question as timezone; none of these values is stored or reported, but their combination is a device fingerprint

Stated plainly: the hash computed in the browser is a device fingerprint, so Sealmetrics does not claim that no identifier is built on the device. What limits it is that it is never written to the device and never stored as sent: before storage the server re-keys it with a server secret and a daily salt that is destroyed on rotation, so the stored identifier changes every day and nothing stored can recognize a device across days — not even for Sealmetrics. See What We Track.

Assessment: Sealmetrics' position is that no information stored in the terminal equipment is accessed in the sense of §25(1). The runtime properties read and the in-browser hash built from them are disclosed above so that publishers and their DPOs can weigh the interpretive question themselves.

Criterion 3: §25(2) exemptions — not needed, but noted​

Requirement: If §25(1) were triggered, consent-free operation would require the "strictly necessary" exemption (§25(2) Nr. 2), which the DSK does not extend to analytics.

AspectSealmetrics Position
Does Sealmetrics rely on §25(2)?No — its position is that §25(1) is not triggered (see Criterion 2)
Would analytics qualify as "strictly necessary"?Per DSK guidance, generally no — which is why cookie-based analytics tools need banners in Germany. If §25(1) were held to apply to Sealmetrics' reading of browser properties, the same would be true for it

This is the structural difference Sealmetrics claims from consent-managed tools: on the Criterion 2 interpretation, it does not need an exemption because it performs neither of the acts §25(1) regulates.

Part 2: The GDPR Layer (Visitor Data)​

§25 TDDDG governs the terminal equipment; the GDPR governs any subsequent processing of personal data. The DSK's two-step model requires both to be assessed.

Criterion 4: No data that identifies anyone​

AspectCompliance
IP addresses✅ Never stored — used ephemerally in memory for anti-bot protection only
User IDs / cross-session identifiers✅ None exist
Device fingerprints✅ None stored — the in-browser hash is re-keyed daily on the server and never stored as sent
Country detection✅ Derived from browser timezone, not IP geolocation
Session handling✅ Server-side, short-lived (~2h); the identifier is a pseudonym re-keyed with a daily salt that is destroyed, so it cannot recognize a returning visitor on another day
Retention✅ 24 months for aggregated analytics data, then automatic deletion

Assessment: ✅ Stored records contain no data that identifies anyone. The session identifier is pseudonymised data while the daily salt exists (the per-hit log keeps it for 1 day) and is processed under Article 6(1)(f) GDPR (legitimate interest in measuring one's own website); once the salt rotates, not even Sealmetrics can reconstruct it. Reports are always aggregated. In practice, rights requests from visitors cannot be matched to a record — see Data Subject Rights.

Criterion 5: Transient processing of the IP address​

During request handling, the visitor's IP address is technically received (as with any web server) and used in memory only to check it against blocklists of automated-traffic IPs (abuse prevention), then discarded. To the extent this transient handling constitutes processing of personal data, it is supported by Article 6(1)(f) GDPR (legitimate interest in network and service security), satisfies data minimization (Article 5(1)(c)), and the IP is never stored. The pseudonymised session identifier also rests on Article 6(1)(f) (Criterion 4); consent is not used as the legal basis.

No other use of the IP occurs. A GeoLite2 lookup was designed for the Agent Analytics bot detector, but that feature is not live and cannot be enabled on any account, so it runs on no site today. See What We Track.

Assessment: ✅ Compliant — minimal, transient, security-purposed, never persisted.

Criterion 6: Data location and transfers​

AspectDetail
Processing location of analytics data✅ Dublin, Ireland (EU)
Transfers of analytics data outside the EU✅ None
US cloud storage of analytics data✅ None
Subprocessors✅ Visitor analytics data processed exclusively in the EU — see Subprocessors

German authorities have scrutinized US-linked analytics transfers intensively since Schrems II. Sealmetrics avoids the issue entirely: visitor analytics data is never transferred outside the EU.

Part 3: DSK Orientierungshilfe Checklist​

The DSK's guidance for telemedia providers frames the questions a German controller should ask. Summary against Sealmetrics:

DSK questionSealmetrics answer
Is information stored on the terminal?No
Is stored information accessed?No cookies or storage are read; runtime browser properties are read to compute the session identifier (see Criterion 2)
Is consent under §25(1) required?Our reading: no — an open question, see Criterion 2; check with your DPO or counsel
Is personal data processed afterwards?Pseudonymised data only: the IP transiently in memory, and the session identifier for 1 day; nothing that identifies anyone is stored, and reports are aggregated
Legal basis for that processing?Art. 6(1)(f) GDPR (legitimate interest) for the security check and the pseudonymised session identifier; aggregated reports do not identify anyone
Are users informed?Yes — via the publisher's privacy policy (template below)
Joint controllership / third-party sharing?No third-party data sharing; processor relationship under the DPA

Part 4: Configuration Checklist for German Publishers​

Required ✅​

  • Standard tracking mode (default configuration)
  • No custom user IDs enabling cross-session tracking
  • No PII in custom event properties
  • Privacy policy (Datenschutzerklärung) updated to mention Sealmetrics

Recommended Privacy Policy Text (German):

Diese Website verwendet Sealmetrics zur Reichweitenmessung. Sealmetrics
setzt keine Cookies und speichert keine Informationen auf Ihrem Endgerät.
Zur Sitzungserkennung liest das Skript Standard-Browsereigenschaften aus
und bildet daraus im Browser einen Hashwert, der serverseitig täglich neu
verschlüsselt und nie im Originalzustand gespeichert wird. Es werden
keine Daten gespeichert, die jemanden identifizieren; IP-Adressen werden
nicht gespeichert. Die Sitzungskennung ist flüchtig: Sie wechselt
täglich und kann danach nicht einmal von Sealmetrics rekonstruiert
werden. Die Berichte sind stets aggregiert. Rechtsgrundlage ist unser
berechtigtes Interesse (Art. 6 Abs. 1 lit. f DSGVO). Die Daten werden
ausschließlich in der EU (Dublin, Irland) verarbeitet.

Prohibited ❌​

  • Do NOT pass email addresses or other PII as properties
  • Do NOT combine Sealmetrics data with advertising or profiling tools
  • Do NOT implement custom device-storage workarounds around the tracker

Part 5: Compliance Statement​

Sealmetrics declares that:

  1. Its standard configuration stores no information on the end user's terminal equipment and reads no cookies or storage from it; it reads runtime browser properties to compute a session identifier that is re-keyed daily and never stored as sent. On the interpretation set out in Criterion 2, the consent requirement of §25(1) TDDDG is not triggered
  2. Stored visitor analytics data contains no data that identifies anyone and no persistent identifiers; the session identifier is pseudonymised, processed under Art. 6(1)(f) GDPR and unrecoverable after the daily rotation
  3. All customer analytics data is processed exclusively in the EU (Dublin, Ireland) with no third-country transfers
  4. On this reading, publishers using Sealmetrics in Germany can measure their audience without a consent banner for the analytics function, when configured per this document. Whether reading browser properties is "access" under §25(1) is an open question (EDPB Guidelines 2/2023 read access broadly, and the DSK does not extend §25(2) to audience measurement); publishers should confirm with their DPO or counsel

Publishers cannot claim Sealmetrics is "certified" or "approved" by the DSK, the BfDI, or any Landesdatenschutzbehörde — no such certification exists.

Part 6: Version History​

VersionDateChanges
1.0February 2026Initial self-assessment against §25 TDDDG and DSK guidance
1.1October 2026Session identifier described as pseudonymised data under Art. 6(1)(f); banner verdict presented as Sealmetrics' reading, an open question

References​

Contact​

In short
  • §25 TDDDG has no analytics exemption; Sealmetrics' position is that neither act §25(1) regulates occurs — nothing is stored on the device and no cookies or storage are read — while disclosing that runtime browser properties are read to compute a daily-re-keyed session identifier.
  • Stored visitor data contains nothing that identifies anyone: no IP addresses (in-memory use only for anti-bot protection), no persistent identifiers, a pseudonymised session identifier under Art. 6(1)(f) that becomes unrecoverable after daily rotation, and aggregated reports kept 24 months.
  • Whether a consent banner is needed in Germany is our reading, not a certainty: the tracker reads device properties via JavaScript and the DSK does not extend §25(2) to audience measurement — check with your DPO or counsel.
  • All analytics data is processed in Dublin, Ireland with no third-country transfers; this is not a certification by the DSK, the BfDI or any Landesdatenschutzbehörde.
Written and maintained by the Sealmetrics Team