Tracks devices, in Germany

TDDDG § 25 · Read the law's page

• Obtain the end user's consent, given on the basis of clear and comprehensive information and in the manner the GDPR requires, before storing information on the end user's terminal equipment or accessing information already stored there.
• No consent is required where the storage or access serves only to carry a message over a public telecommunications network, or is strictly necessary to provide a digital service the user explicitly requested.

EinwV §§ 1-20 · Read the law's page

• Integrating a recognized consent-management service to ask for consent under section 25(1) of the TDDDG is voluntary (section 18(1)); you remain responsible for the GDPR information duties and the requirements for valid consent even where you integrate one (section 1(2)).
• If you integrate a recognized consent-management service, take the end users' settings into account, and where you have no consent from an end user through the integration, point to the end user's settings with the recognized service when you ask for consent (section 19(1)).
• If you integrate a recognized service and ask for end users' settings through it, you should, by technical and organizational measures reflecting the state of the art, take care that the end user's use of the service is taken into account when your digital service is called up and that it is checked whether settings are managed at the service (section 18(2)); you should also let the service store the consents you request, point end users at a visible and suitable place to the integration, cooperate with the service on the requirements of section 7, and give it the information required under Articles 7 and 12 to 14 of the GDPR in a machine-readable format (section 18(3)).
• If you manufacture or provide software for retrieving and presenting information from the internet, you should, within the technical possibilities, take care that it takes the integration of recognized services into account and does not suppress, delay, decrypt or otherwise alter a signal or end-user settings deposited through the recognized service or the provider of digital services (section 17).
• If you integrate a recognized service, you should not, without an objective reason, work toward end users using or excluding particular recognized services (section 20).
• To be recognized by the Federal Commissioner for Data Protection and Freedom of Information, a consent-management service must apply with a security concept (sections 8, 10 and 12) and meet the Part 2 requirements, among them: store the settings an end user made and transmit them to the provider on each further use, manage only consents for which the end user was informed in advance of the matters section 3(2) lists, and document the information on which a consent rests in a way that is easily accessible to the end user (section 3).

Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).
• Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).
• If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).
• If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).
• If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).
• Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).
• You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).
• Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17).