Tracking cookies set before consent

German § 25 TDDDG requires consent for any storage on the user's device that is not strictly necessary for the service the user explicitly requested. Unlike the GDPR it does not depend on personal data being processed — the storing itself is the violation.

This is the single most-warned-about point in the German-speaking market, and it almost always happens unintentionally: the analytics snippet sits in the page head and runs before the banner is even painted.

Check it yourself: open the site in a private window, click nothing, and look at the cookies in your developer tools. Everything there before your click is the finding. The fix is not a wording change but an order of operations.