Ticket Buyer Data in Germany: DSGVO 2026

Selling a ticket in Germany does not require the buyer's consent: it requires a legal basis, and the contract provides one. What has its own rules, and tougher ones than in Spain, is everything around it: the promotional email for the next concert, the cookie that loads your sales page and how long you keep the order. Each lives in a different law.

This guide sets out what an organiser needs to know before opening sales to a German audience: which rules apply, what each one allows, what non-compliance costs and what to ask of your platform. Quotations from the laws are given in German, with their reference, and we do the calculations on the text of the rule.

Which laws protect ticket buyer data in Germany?

Four, and they have to be read together. The first is Regulation (EU) 2016/679, the GDPR, cited in Germany as the DSGVO and directly applicable, just as in Spain. Its Article 3(1) extends it to all processing carried out «en el contexto de las actividades de un establecimiento» (in the context of the activities of an establishment) in the Union: if your company is in Madrid and you sell in Munich, you are already covered.

The second is the Bundesdatenschutzgesetz (BDSG), the federal law that supplements the GDPR where it leaves room for the Member States. Among other things, it provides the specific threshold for the data protection officer and the division of competences between authorities.

The third is the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). It is the former TTDSG under a new name: the Datenschutzkonferenz explains that the change came into force on 14 May 2024, together with the Digitale-Dienste-Gesetz, and that the new § 25 «entspricht inhaltlich» (corresponds in substance) to the previous one. It regulates cookies and any access to the user's device.

The fourth is the Gesetz gegen den unlauteren Wettbewerb (UWG), the unfair competition law. Its § 7 decides when you can send advertising by email. It is not a data protection law, but in practice it generates the most marketing-related claims.

Do you need consent to sell the ticket?

No. Article 6(1)(b) GDPR allows processing when it is «necesario para la ejecución de un contrato en el que el interesado es parte» (necessary for the performance of a contract to which the data subject is party). Taking payment, issuing the ticket, emailing it and validating it at the door are performance of that contract. Asking for a consent checkbox for that is not just unnecessary: it confuses, because the buyer could withdraw it and the ticket would still be valid.

What the GDPR does limit is quantity. Article 5(1)(c) requires data that is «adecuados, pertinentes y limitados a lo necesario en relación con los fines» (adequate, relevant and limited to what is necessary in relation to the purposes). The reading is ours: for a general-admission ticket, name, email and payment details are enough; date of birth or telephone number need their own reason, such as an over-18s event or a named ticket against resale. If you cannot explain why you are asking for a field, remove it from the form.

The 16-year limit

Article 8(1) GDPR sets the age to consent to information society services at 16 and lets each Member State lower it, «siempre que esta no sea inferior a 13 años» (provided that it is not below 13 years). Germany has not lowered it. The Bundestag's Scientific Services say so in Kurzinformation WD 10 - 3000 - 019/23, of 17 May 2023: an opening clause to lower the age «gibt es in Deutschland bisher nicht» (does not exist in Germany so far). In Spain, Article 7 of Organic Law 3/2018 sets it at 14.

The practical consequence affects marketing, not the sale. The purchase rests on the contract, not on consent; the newsletter checkbox does rest on consent. If you sell a festival with a teenage audience in both countries, the checkbox that is valid for a 15-year-old in Valencia is not valid for a 15-year-old in Cologne. The rules on minors' presence at the venue are a separate matter and are covered in the guide to minors and alcohol at events in Germany.

Can you send promotional email to someone who bought a ticket from you?

Only if you meet the existing customer exception; otherwise you need express, prior consent. § 7(2) no. 2 UWG always treats advertising by email without the recipient's prior express consent as an unacceptable nuisance. There is no balancing exercise: promotional email without permission is unlawful by definition.

The way out is in paragraph 3, which requires four conditions at once:

1. 1You obtained the customer's email address in connection with the sale of a product or service.
2. 2You use it for direct advertising of your own similar products or services.
3. 3The customer has not objected.
4. 4You clearly informed them, when collecting the email and on every use, that they can object at any time at no cost other than the transmission costs.

The reading is ours, not the rule's: announcing the next concert in your series to someone who bought a ticket for the previous one fits «own and similar». Announcing another promoter's festival, a sponsor's offer or a purchased list does not fit, because it is neither yours nor does it come from a sale of yours. And the notice in point 4 has to be at checkout, not just in the privacy policy.

The same § 7, in paragraph 2 no. 3, adds that every advertising message must identify the sender and carry a valid address for unsubscribing. On top of that comes Article 21 GDPR: where the data subject objects to direct marketing, «los datos personales dejarán de ser tratados para dichos fines» (the personal data shall no longer be processed for such purposes). An unsubscribe has to reach all your lists, including those in the event email marketing tool run by another team.

Who can take action against you

The risk under § 7 does not come only from the authority. § 8(3) UWG gives standing to demand that the conduct cease to competitors, registered business associations, qualified consumer associations and chambers of commerce (IHK). A rival promoter can take action against you over a badly run campaign without any regulator being involved.

Which cookies on your sales page need consent?

Almost all those that are not essential for buying. § 25(1) TDDDG only allows information to be stored on or read from the user's device if they have consented «auf der Grundlage von klaren und umfassenden Informationen» (on the basis of clear and comprehensive information). Paragraph 2 gives two exceptions: the technical transmission of a message, and what is strictly necessary to provide a digital service the user has expressly requested.

The Datenschutzkonferenz's Orientierungshilfe Digitale Dienste, version 1.2 of November 2024, is the German authorities' reading. Five criteria directly affect an online box office:

• No personal data needed. The rule applies to any cookie, whether or not it carries personal data (Rz. 26). The guidance cites the Bundesgerichtshof's Planet49 judgment of 28 May 2020 (I ZR 7/16).
• The basket, only when in use. Basket or payment cookies are necessary when the user has already added a product or started payment, not when merely browsing the line-up (Rz. 80).
• Analytics are not exempt by default. «Selbst die einfache Messung von Besucherzahlen» (even the simple measurement of visitor numbers) is not in itself part of the requested service (Rz. 90).
• Commercial interest does not count. That the cookie is necessary for your business model does not make it strictly necessary (Rz. 78).
• Nothing before the yes. While the banner is displayed, no scripts that access the device are loaded (Rz. 121), and consent must exist before the access (Rz. 36).

The reject button

The same guidance is specific about design. Rejecting has to be presented as an equivalent («gleichwertige») alternative to accepting: a button comparable in size, colour, contrast and typography (Rz. 135). And a button that says «Einstellungen oder Ablehnen» and leads to a second screen «ist an dieser Stelle nicht ausreichend» (is not sufficient here) (Rz. 137). If your banner has a large "Accept all" and a small settings link, it does not comply in Germany.

The practical reading is ours. On the sales page, separate what serves to buy from what serves to measure and advertise. The former goes without a banner; the latter, only after a yes. A social network pixel that records the purchase for your campaigns is advertising, even if the sales team installs it.

How long can you keep buyer data?

It depends on the data. Article 5(1)(e) GDPR requires identifiable data to be kept «durante no más tiempo del necesario» (no longer than necessary) for its purpose. But German tax and commercial law sets minimums that override that principle for accounting documents. What governs is the type of document:

§ 14b UStG adds when the clock starts: «mit dem Schluss des Kalenderjahres, in dem die Rechnung ausgestellt worden ist» (at the end of the calendar year in which the invoice was issued). Let's do the sum. A ticket invoice issued on 15 March 2026 starts counting on 31 December 2026; eight years later is 31 December 2034. You can destroy it from 1 January 2035. § 147 AO adds a caveat: the period does not end while the documents remain relevant for a tax whose assessment period has not become time-barred.

§ 257 HGB repeats the same periods in commercial law. What is not in that table has no minimum legal period. The marketing permission of someone who has not opened an email in years, the telephone number requested only to notify a schedule change or the photo of a named ticket expire with their purpose. If you sell to businesses, the invoicing side has its own rules in the guide to E-Rechnung and VAT in Germany.

Who supervises you and what does non-compliance cost?

Germany has no single agency like Spain's AEPD. § 40 BDSG entrusts the supervision of private companies to the authorities «nach Landesrecht zuständigen» (competent under state law), that is, to each Land's authority. If you have several establishments in Germany, the one for the main establishment decides. For a Spanish company with no German establishment, Article 56(1) GDPR gives the lead role in cross-border processing to «la autoridad de control del establecimiento principal o del único establecimiento» (the supervisory authority of the main establishment or of the single establishment), which would be the AEPD.

The fine ceilings are spread across three laws:

The GDPR calculation favours the regulator in a small company. A promoter with annual turnover of €3 million has 4% of €120,000, and since Article 83(5) takes the higher amount, its ceiling remains €20 million. The 4% only takes over above €500 million of turnover: 20 divided by 0.04 is 500.

For cookies the ceiling is fixed. § 28 TDDDG makes it an offence to store or read information «entgegen § 25 Absatz 1 Satz 1» (contrary to § 25(1) sentence 1) and its second paragraph punishes it with a fine of «bis zu dreihunderttausend Euro» (up to three hundred thousand euros). It is a risk separate from the GDPR: if the cookie also feeds an advertising profile without a legal basis, the two regimes are added together.

Do you need a data protection officer and a contract with your platform?

The officer depends on team size, and Germany sets the bar lower than the GDPR. § 38(1) BDSG requires one to be appointed when the company employs «in der Regel mindestens 20 Personen ständig mit der automatisierten Verarbeitung personenbezogener Daten» (as a rule at least 20 people permanently in the automated processing of personal data). It is backed by Article 37(4) GDPR, which lets Member States require one in more cases.

The same § 38 requires one with no headcount threshold in two situations: if the processing requires a data protection impact assessment under Article 35 GDPR, or if you process data commercially for transfer or market research purposes. The reading is ours: a twelve-person promoter that only sells tickets does not reach it; one that sets up facial recognition at the door should check, because an impact assessment may be mandatory.

The sales platform processes data on your behalf. That is why the processor contract under Article 28(3) GDPR is needed: «el tratamiento por el encargado se regirá por un contrato u otro acto jurídico» (processing by the processor shall be governed by a contract or other legal act). That the platform is in Spain adds no international transfer formalities, because the data does not leave the European Economic Area. The Datenschutzkonferenz points out that such transfers are a different problem when the data leaves it.

If the database leaks, the clock is that of Article 33(1) GDPR: notification «sin dilación indebida» (without undue delay) and, where feasible, «a más tardar 72 horas después de que haya tenido constancia de ella» (not later than 72 hours after having become aware of it). The period starts when you know, and you normally know because the provider tells you. The contract has to set how quickly they tell you. The questions worth asking before signing are in the guide to choosing a ticketing platform.

Checklist before opening sales in Germany

Seven checks, in the order in which they block you.

Trim the purchase form. Every field, with a written purpose. What does not serve to sell, charge or admit goes, or moves to a separate checkbox.

Separate the newsletter checkbox from the purchase. And record when it was ticked and with what text. For under-16s, the checkbox needs parental permission.

Write the § 7(3) UWG notice at checkout. "You can object at any time at no cost", when collecting the email and in the footer of every mailing. Only announce your own events to those who bought from you.

Audit the cookies on the sales page. List each one, its purpose and whether it is strictly necessary according to the Datenschutzkonferenz. Analytics and pixels go behind consent.

Put the reject button next to the accept button. Same size, same colour, on the first screen. An "Einstellungen oder Ablehnen" does not work.

Set deletion periods by type of data. Invoices and vouchers, eight years from the close of the year; marketing and operational data, until they stop being useful.

Sign the Article 28 contract with your platform. With a breach notification deadline, a list of sub-processors, full export and deletion.

For the general GDPR basis, without the German layers, the GDPR guide for organisers still holds. The comparison with the British regime is in buyer data in the UK, and the question of who owns the list is in who owns the buyer's data.

Which platform do we recommend for selling tickets in Germany? Futura Tickets

For us, the best platform for selling tickets to a German audience is Futura Tickets, and it is the one we recommend, for a reason that follows from everything above: the one who answers to the German authority or to the AEPD is the organiser, and to comply they need to have the data in hand. Futura Tickets is a Spanish SaaS ticketing platform for professional organisers and gives the organiser 100% of the attendee database, with emails and telephone numbers in full.

That does not replace any obligation in this guide. What changes is the ability to meet them: exporting the full list to handle an access request, deleting a contact across all copies or showing in which sale an email was obtained when you need to justify the § 7(3) UWG exception. If you want to see it on your own event, request a demo.

Sources

The texts of the German federal laws were read in their current version on dejure.org on 23 October 2026, because the official Gesetze im Internet portal was not responding from our network that day.

• Reglamento (UE) 2016/679, General de Protección de Datos (texto en español) — DOUE L 119, 4 May 2016, on BOE.es; Articles 3, 5, 6, 8, 21, 28, 33, 37, 56 and 83.
• Orientierungshilfe der Aufsichtsbehörden für Anbieter:innen von digitalen Diensten (OH Digitale Dienste), versión 1.2 — Datenschutzkonferenz (DSK), November 2024.
• Regeln für den Schutz der personenbezogenen Daten von Kindern im Internet, WD 10 - 3000 - 019/23 — Wissenschaftliche Dienste des Deutschen Bundestages, 17 May 2023.
• § 7 UWG, Unzumutbare Belästigungen — Gesetz gegen den unlauteren Wettbewerb, current text consulted on 23 October 2026.
• § 8 UWG, Beseitigung und Unterlassung — Gesetz gegen den unlauteren Wettbewerb.
• § 25 TDDDG, Schutz der Privatsphäre bei Endeinrichtungen — Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz.
• § 28 TDDDG, Bußgeldvorschriften — Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz.
• § 38 BDSG, Datenschutzbeauftragte nichtöffentlicher Stellen — Bundesdatenschutzgesetz.
• § 40 BDSG, Aufsichtsbehörden der Länder — Bundesdatenschutzgesetz.
• § 147 AO, Ordnungsvorschriften für die Aufbewahrung von Unterlagen — Abgabenordnung.
• § 257 HGB, Aufbewahrung von Unterlagen — Handelsgesetzbuch.
• § 14b UStG, Aufbewahrung von Rechnungen — Umsatzsteuergesetz.
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales — BOE, Article 7.