TDDDG-Anforderungen im B2B-Kontext
The Technical Data Protection and Data Economy Ordinance (TDDDG) tightens requirements for the storage and processing of data in the B2B sector. For marketing and sales managers, this means that consent for data collection must be obtained before using tracking tools such as Google Analytics 4 (GA4) and CRM systems like HubSpot.
The central requirement is the traceable documentation of consent. You must ensure that:
- The consent selection takes place before tracking scripts are loaded.
- Consent is granted explicitly and actively (opt-in principle).
- Data is only processed if valid consent is present.
Without this foundation, you risk fines and the loss of trust among potential customers in the DACH region.
Architektur des Consent-Managements
A robust consent management system (CMP) forms the bridge between website visitors and your marketing tools. The architecture must be designed to control data flows in real time.
The recommended technical structure comprises three levels:
- Frontend: The CMP banner is loaded before other scripts are executed. It stores the consent decision locally (e.g., in cookies or LocalStorage).
- Backend/Middleware: A server-side tagging solution or consent server checks the stored decision and determines whether data may be sent to HubSpot or GA4.
- Target Systems: HubSpot and GA4 are configured to accept data only if a valid consent token is present.
This separation prevents tracking cookies from being set before the user has given consent.
Implementierung in Google Analytics 4
GA4 natively supports Consent Mode. You must define the consent variables in your Google Tag Manager (GTM) or directly in your website code.
Die Implementierung folgt diesen Schritten:
- Defining Consent Status: Set the variables
analytics_storage,ad_storage, andad_user_datatodeniedby default. - Updating upon Consent: When the user clicks “Accept” in the CMP, send an update to GA4 with the status
granted. - Server-Side Tagging: Use Google Tag Manager Server-Side to obfuscate data processing and reduce latency. The server checks the consent status before data is sent to Google.
Important: Even with a denied status, GA4 may technically run to collect anonymous, aggregated data. However, the storage of personal data (IP addresses, cookies) must be prevented.
Integration mit HubSpot CRM
HubSpot offers native features for consent management that must be synchronized with your CMP. The goal is to only import leads into the CRM pipeline if they have consented to data usage.
So konfigurieren Sie die Integration:
- HubSpot Forms: Enable the mandatory “Consent” field in your forms. Link this field to the consent status in the CMP.
- Lead Scoring: Adjust your scoring rules. Weight leads higher that have given explicit consent. Leads without consent should not receive automated email marketing.
- Property Mappings: Ensure that the consent status is stored as a custom property in the Contact object. This enables segmented journeys.
By taking this measure, you ensure that your sales teams only work with qualified, consent-bound leads.
Compliance Checklist for DACH Companies
To ensure compliance with the TDDDG and GDPR, you should regularly check the following points:
- Documentation: Maintain a logbook of all consent decisions, including timestamps and the version of the consent.
- Deletion Concept: Implement automatic deletion processes for data when consent is revoked.
- Transparency: Ensure that your privacy policy clearly describes which data is processed in HubSpot and GA4.
- Audit Trail: Use HubSpot’s audit logs to prove when a lead became a contact and whether consent was present.
An annual review of these processes is recommended for mid-sized companies to integrate technical changes and new case law in a timely manner.
Vergleich: Client-Side vs. Server-Side Tagging
The choice of tagging strategy significantly impacts performance and compliance security.
| Merkmal | Client-Side Tagging | Server-Side Tagging |
|---|---|---|
| Load time | Higher (more requests) | Lower (fewer requests) |
| Consent check | In the browser (easier to bypass) | On the server (more robust) |
| Data minimization | Limited | High (data can be filtered) |
| Complexity | Low | Medium to High |
For DACH companies aiming for strict compliance, Server-Side Tagging is the superior solution. It enables central control of data flows and reduces the attack surface for script blockers that could manipulate the consent status.
FAQ
Do I also need to display a consent banner for B2B customers?
Yes. The TDDDG and GDPR do not distinguish between B2C and B2B regarding technical data economy. In the B2B sector as well, active consent is required for storing tracking cookies and processing contact data, unless there is a legitimate interest that outweighs the consent (which is rare in marketing).
Can I use GA4 if the user has rejected cookies?
Yes, but only in a limited form. With GA4 Consent Mode, you can collect anonymous, aggregated data that does not enable personal identification. However, the storage of cookies and the transmission of IP addresses must be omitted if consent is missing.
How do I synchronize the consent status between HubSpot and my CMP?
Use the HubSpot API or a middleware service. If the user revokes their consent in the CMP, the system sends a request to HubSpot to update the contact’s consent status. Conversely, HubSpot should report the status back to the CMP upon lead creation to avoid duplicates.
What role does lead scoring play in consent management?
Lead scoring is used to evaluate the quality of leads. In the context of consent management, you should assign a lower score weight to leads without valid consent or exclude them from automated nurturing journeys. This ensures that your sales resources are focused on consented, qualified contacts.