GWB vs DMA: German Competition Act & Digital Markets Act Guide

Introduction

Website owners operating in Europe face a growing web of regulations that go beyond the GDPR. Two key frameworks—the German Competition Act (Gesetz gegen Wettbewerbsbeschränkungen, or GWB) and the EU’s Digital Markets Act (DMA)—now directly influence how you handle consent, tags, and disclosures. While both aim to curb anti‑competitive behaviour by large digital platforms, they create distinct compliance obligations for any website that uses third‑party services like analytics, advertising, or embedded content. This guide breaks down what the GWB and DMA mean for your website, how to implement the required changes step by step, and how to validate your setup with GDPRChecker’s scanning tools.

What is the German Competition Act (GWB) vs the Digital Markets Act (DMA)?

The German Competition Act (GWB) and the Digital Markets Act (DMA) are two separate legal instruments that address market power in the digital economy. The GWB is a national law that has been amended—most notably in 2021 with Section 19a—to give the German Federal Cartel Office (Bundeskartellamt) stronger powers against companies with “paramount significance for competition across markets.” The DMA, in contrast, is an EU regulation that designates large online platforms as “gatekeepers” and imposes a list of dos and don’ts to ensure fair and contestable digital markets.

For website owners, the practical overlap lies in how these laws affect the use of gatekeeper services. Under the DMA, gatekeepers must obtain explicit consent before combining personal data across their own services or with third‑party data for advertising purposes. The GWB, through its Section 19a enforcement, can impose similar or even stricter data‑handling requirements on designated companies. In both cases, the website that integrates a gatekeeper’s tags, pixels, or SDKs becomes responsible for ensuring that the consent it collects meets the heightened standards. This means your cookie banner, tag manager triggers, and privacy disclosures must be configured to respect not just the GDPR but also the specific consent requirements flowing from the GWB and DMA.

GWB vs DMA: Key Differences and Compliance Impact

Although the GWB and DMA share the goal of promoting competition, they differ in scope, enforcement, and the obligations they place on website operators. The table below summarises the critical distinctions.

| Aspect | German Competition Act (GWB) | Digital Markets Act (DMA) | |--------|-------------------------------|---------------------------| | **Legal basis** | National German law | EU regulation (directly applicable in all member states) | | **Who is targeted** | Companies with “paramount cross‑market significance” (e.g., Google, Meta, Amazon) as determined by the Bundeskartellamt | “Gatekeepers” designated by the European Commission based on quantitative thresholds (e.g., 45 million monthly active end users in the EU) | | **Consent requirements** | Can mandate specific consent flows for data combination; often stricter than GDPR consent | Requires gatekeepers to obtain explicit consent for combining personal data across core platform services or with third‑party data (Art. 5(2) DMA) | | **Enforcement** | Bundeskartellamt; can issue cease‑and‑desist orders and fines | European Commission; fines up to 10% of global turnover | | **Impact on website owners** | Must ensure consent mechanisms align with any GWB‑imposed restrictions on integrated services | Must implement consent that meets DMA standards when using gatekeeper services (e.g., Google Analytics, Meta Pixel) |

In practice, the DMA’s consent requirements are the most immediate concern for most websites because they apply uniformly across the EU whenever a gatekeeper service is used. The GWB can add an extra layer of complexity for websites that specifically target the German market, as the Bundeskartellamt may impose additional data‑separation obligations on the same gatekeepers.

Step‑by‑Step Implementation for GWB and DMA Compliance

Achieving compliance with the GWB and DMA requires a methodical review of your consent infrastructure. Follow these steps to align your website with the current requirements.

1. Audit All Gatekeeper Services

List every third‑party service that runs on your website and identify which ones belong to designated gatekeepers. As of 2025, gatekeepers include Alphabet (Google), Meta, Amazon, Apple, ByteDance (TikTok), and Microsoft, among others. Pay special attention to tags that combine data—for example, Google Analytics advertising features, Google Ads conversion tracking, or Meta Pixel with advanced matching. Document the purpose of each tag and the legal basis you rely on.

2. Implement a Consent Banner That Supports Granular Choices

Your cookie banner must offer users a genuine choice for each category of data processing, especially for marketing and analytics cookies. Under the DMA, a simple “Accept All” / “Reject All” pair is the minimum, but you should also provide granular toggles for advertising, analytics, and functional cookies. The banner must not use deceptive design (dark patterns) that nudge users toward acceptance. Test the “Reject All” flow thoroughly: after a user rejects all, no gatekeeper tags should fire except those strictly necessary for the service you explicitly requested.

3. Integrate Consent Mode v2 (or Equivalent)

For Google services, implement Google Consent Mode v2. This involves updating your gtag.js or Google Tag Manager container to send default consent states before any tags fire, and then updating those states based on the user’s banner choices. The key consent types are: - `analytics_storage` - `ad_storage` - `ad_user_data` - `ad_personalization`

When a user rejects all, these should be set to `denied`. When consent is granted, they can be set to `granted`. For non‑Google gatekeepers, check whether they offer a similar consent‑signalling API; if not, you must block their tags entirely until consent is obtained.

4. Update Your Privacy Policy and Disclosures

Your privacy policy must clearly disclose the gatekeeper services you use, the purposes of data processing, and the legal bases. Under the DMA, you should also explain that the gatekeeper may combine data across its services when consent is given, and that users have the right to withdraw consent at any time. Link to the gatekeeper’s own privacy policy where relevant. For German users, consider adding a specific section that references the GWB and the enhanced rights it may confer.

5. Configure Tag Manager Triggers Correctly

In Google Tag Manager (or any other tag manager), set up triggers that respect consent signals. For example, a Google Analytics 4 tag should only fire when `analytics_storage` is `granted`. A Meta Pixel tag should be blocked entirely until marketing consent is given. Use the built‑in consent overview in GTM to verify that all tags have the correct consent checks applied. Never rely on the tag manager’s “All Pages” trigger without an additional consent condition.

6. Test Pre‑Consent Network Requests

One of the most common mistakes is allowing tags to fire before the user has interacted with the consent banner. Even if the tag is configured to respect consent, a network request that fires on page load can still transmit data (e.g., IP address) before consent is recorded. Use browser developer tools or a dedicated scanner to check for any requests to gatekeeper domains that occur before the consent update. All such requests must be blocked until the user has made a choice.

Common Mistakes and How to Avoid Them

Website owners often stumble over the same pitfalls when trying to align with the GWB and DMA. Here are the most frequent errors and how to steer clear of them.

**Assuming GDPR consent is enough.** The DMA requires a higher standard of consent for data combination by gatekeepers. A generic GDPR consent banner that does not integrate Consent Mode v2 or an equivalent signalling mechanism is insufficient. Always verify that your CMP is sending the correct signals to each gatekeeper.
**Failing to test the “Reject All” path.** Many banners work perfectly when a user clicks “Accept All,” but the “Reject All” flow is broken. Tags may still fire, or the banner may reappear on every page. Test this path on every page template and in every browser you support.
**Ignoring the GWB’s extra requirements for Germany.** If your website targets German users, the Bundeskartellamt’s orders against gatekeepers can impose additional constraints. For example, Google may be required to offer a genuine choice to not combine data, which means your consent banner must present that choice clearly and not bundle it with other purposes.
**Using outdated consent plugins.** Some older CMPs do not support Consent Mode v2 or the IAB TCF v2.2. If your CMP cannot send the necessary signals, you are effectively non‑compliant. Upgrade to a modern CMP or use a managed consent solution that handles these updates automatically.
**Neglecting to update disclosures after a change.** Every time you add a new gatekeeper service or change how data is processed, your privacy policy and cookie declaration must be updated. An outdated policy is a red flag for regulators and can undermine the validity of consent.

How to Validate GWB and DMA Compliance with GDPRChecker

GDPRChecker provides a suite of scanning tools that help you verify your website’s compliance with the consent requirements flowing from the GWB and DMA. While GDPRChecker is not a legal advisor and does not issue certifications, its scans give you concrete evidence of how your site behaves in practice.

Pre‑Consent Request Scan

Run a GDPRChecker scan with the scanner configured to emulate a first‑time visitor who has not yet interacted with your consent banner. The scan will list every network request that fires before consent, including requests to gatekeeper domains. Any request to `www.googletagmanager.com`, `googleads.g.doubleclick.net`, `connect.facebook.net`, or similar domains that appears before the consent update is a potential violation. Use the scan results to adjust your tag manager triggers or banner implementation until zero pre‑consent requests to gatekeepers are detected.

Consent Banner Behaviour Check

GDPRChecker can simulate different consent choices—accept all, reject all, and granular selections—and verify that the corresponding tags fire or are blocked accordingly. After making a change to your banner or tags, re‑run the scan to confirm that the behaviour matches your intended configuration. This is especially important after updating Consent Mode defaults or adding new gatekeeper tags.

Disclosure and Policy Link Verification

The scanner checks that your cookie banner links to a valid privacy policy and that the policy itself contains the required disclosures about gatekeeper services. It can also detect whether your cookie declaration is up to date by comparing the declared cookies with those actually set during the scan. For a deeper dive into policy compliance, see our guide on closing the Privacy Policy gap.

Ongoing Monitoring

On paid plans, GDPRChecker offers runtime protection and monitoring that continuously checks your site for new or unauthorised tags. This is critical for DMA compliance because adding a new marketing pixel without updating your consent setup can instantly create a compliance gap. The monitoring dashboard alerts you when new trackers appear, so you can review and configure them before they cause a problem.

Real‑World Examples of GWB and DMA Compliance in Action

To make the requirements concrete, consider these three scenarios.

Example 1: E‑commerce Site Using Google Analytics and Google Ads

An online shop based in Germany uses Google Analytics 4 and Google Ads conversion tracking. Under the DMA, the shop must implement Consent Mode v2 so that when a user rejects marketing cookies, the `ad_storage` and `ad_user_data` signals are set to `denied`. The shop’s consent banner must offer a clear “Reject All” button that sets all non‑essential consent to denied. After implementation, a GDPRChecker scan confirms that no requests to `doubleclick.net` fire before consent, and that after rejection, only anonymised, cookieless pings are sent to Google Analytics.

Example 2: News Portal with Meta Pixel and Embedded YouTube Videos

A news website embeds YouTube videos and uses the Meta Pixel for audience measurement. Because both YouTube and Meta are gatekeeper services, the site must block the YouTube iframe and the Meta Pixel until the user consents to marketing cookies. The site implements a two‑layer consent banner: the first layer offers “Accept All” and “Manage Settings”; the second layer provides toggles for functional, analytics, and marketing. When a user rejects marketing, the YouTube placeholder is shown instead of the video, and the Meta Pixel does not load. A GDPRChecker scan verifies that no requests to `facebook.com` or `youtube.com` occur in the rejected state.

Example 3: SaaS Landing Page with LinkedIn Insight Tag

A B2B SaaS company uses the LinkedIn Insight Tag for conversion tracking and retargeting. LinkedIn is a gatekeeper service under the DMA. The company updates its GTM container to fire the LinkedIn tag only when `ad_storage` consent is granted. It also updates its privacy policy to disclose the use of LinkedIn’s services and the potential for data combination. A post‑change GDPRChecker scan confirms that the Insight Tag does not fire on the “Reject All” path, and the policy link is correctly detected.

Implementation Checklist

Use this checklist to ensure your website meets the core requirements of the GWB and DMA.

Identify all gatekeeper services running on your site (Google, Meta, Amazon, Apple, ByteDance, Microsoft).
Implement a consent banner with “Accept All” and “Reject All” buttons, plus granular toggles.
Integrate Google Consent Mode v2 (or equivalent) for every Google service.
Configure default consent states to `denied` for all non‑essential categories.
Update tag manager triggers to respect consent signals for every gatekeeper tag.
Block all gatekeeper tags from firing before the user interacts with the banner.
Test the “Reject All” flow on every page template and browser.
Update your privacy policy to disclose gatekeeper services, data combination, and DMA/GWB rights.
Run a GDPRChecker pre‑consent scan and verify zero unauthorised network requests.
Run a GDPRChecker consent‑behaviour scan for accept‑all, reject‑all, and granular choices.
Set up ongoing monitoring (available on paid plans) to catch new or unauthorised tags.
Schedule a quarterly review of your consent setup, especially after adding new services or changing gatekeeper configurations.

FAQ

What is the German Competition Act (GWB) vs the Digital Markets Act (DMA)? The GWB is a German national law that targets companies with paramount cross‑market significance, while the DMA is an EU regulation that imposes obligations on designated gatekeepers. Both can require stricter consent for data combination by large platforms, impacting how websites must configure their cookie banners and tags.

Do I need to comply with the GWB and DMA for GDPR? Yes, if your website uses services from gatekeepers like Google or Meta. The DMA mandates explicit consent for data combination, which goes beyond basic GDPR consent. The GWB may add further requirements if you target the German market. Compliance with both is essential to avoid enforcement risks.

How do I implement GWB and DMA requirements on my website? Start by auditing all gatekeeper tags, then implement a consent banner with granular choices and integrate Consent Mode v2 (or equivalent). Update your tag manager triggers, block pre‑consent requests, and revise your privacy policy. Finally, validate everything with a scanner like GDPRChecker.

How can I verify GWB and DMA compliance with a scanner? Use GDPRChecker to run a pre‑consent scan that detects network requests to gatekeeper domains before consent. Also run consent‑behaviour scans to confirm tags fire correctly after accept/reject choices. The scanner checks policy links and cookie declarations for completeness.

What are common mistakes when aligning with the GWB and DMA? Common mistakes include assuming GDPR consent is sufficient, failing to test the “Reject All” path, ignoring Germany‑specific GWB requirements, using outdated CMPs that lack Consent Mode v2, and neglecting to update disclosures after changes. Each can lead to non‑compliance.

Which cookies and trackers should I check for GWB and DMA compliance? Focus on tags from designated gatekeepers: Google (Analytics, Ads, Tag Manager), Meta (Pixel), Amazon (Ads), Apple (App Tracking), ByteDance (TikTok Pixel), and Microsoft (Clarity, Ads). Any tag that combines data across services must be controlled by consent signals.

How often should I review my GWB and DMA compliance setup? Review your setup at least quarterly, and immediately after adding a new gatekeeper service, updating your CMP, or changing your tag configuration. Ongoing monitoring with GDPRChecker can alert you to new trackers that need attention between reviews.

What evidence should I keep for GWB and DMA compliance? Keep records of your consent banner configurations, Consent Mode implementations, scan reports from GDPRChecker showing pre‑consent and post‑consent behaviour, dated privacy policy versions, and logs of consent choices (if your CMP provides them). This documentation demonstrates your compliance efforts.

Next Steps: Validate Your Setup with GDPRChecker

Aligning your website with the German Competition Act and the Digital Markets Act is not a one‑time task—it requires ongoing vigilance. Start by running a free GDPRChecker scan to identify any pre‑consent requests to gatekeeper domains or gaps in your consent banner behaviour. For deeper protection, explore our managed consent and monitoring plans that keep your site compliant as regulations evolve. Remember, this guide provides technical implementation steps, not legal advice; always consult a qualified privacy professional for your specific situation.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "German Competition Act (GWB) vs Digital Markets Act (DMA): A Practical Compliance Guide for Website Owners", "description": "Understand the German Competition Act (GWB) vs the Digital Markets Act (DMA) and what they mean for your website's consent, tags, and disclosures. Practical steps to validate compliance with GDPRChecker.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/german-competition-act-gwb-vs-dma-digital-markets-act" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice

This original AI-assisted editorial draft was selected, reviewed, and published by GDPRChecker. All rights are reserved where protected by applicable law. Do not reproduce the article without permission.