Complementing GDPR are national laws:

[Rajulk985]

* **UWG (Gesetz gegen den unlauteren Wettbewerb)**—the Act Against Unfair Competition—governs direct marketing. Section 7 prohibits advertising via telephone, SMS, or email to consumers without prior “express consent.” For B2B recipients, prior consent is still required unless a “presumed consent” can be inferred from an existing business relationship and message relevance.
* **TTDSG (Telekommunikation‑Telemedien‑Datenschutz‑Gesetz)**, passed in 2021, consolidates ePrivacy rules. It regulates cookies, but also Article 3 prohibits intercepting or storing telecommunications content without user permission—relevant to voice recording and SMS monitoring for analytics.
* **BDSG (Bundesdatenschutzgesetz)**—Germany’s supplement to GDPR—modifies certain age thresholds and empowers Länder Data Protection Authorities (DPAs) to fine violators.

Fines are material. German DPAs have levied GDPR penalties exceeding france phone number data €500 million since 2018. The largest SMS‑related case to date was a €9.55 million fine against a berlin‑based e‑commerce firm in 2023 for sending 850,000 promotional SMS to non‑consented numbers scraped from a loyalty program. Remedies included not only the penalty but mandatory deletion of the entire database, staff retraining, and a two‑year auditing period.

**CONSENT CAPTURE AND PROOF**

Legally adequate consent for German phone‑number use often employs a double‑opt‑in method. A user enters the number in a web form, receives an SMS with a PIN or link, and must confirm before any marketing flow begins. The controller then stores a hash of the number, timestamp, IP address, user agent, and consent text version. German courts interpret “burden of proof” strictly: if a consumer files a complaint, the controller must produce evidence within weeks. Brokers or list resellers who cannot supply such granular logs risk their clients’ compliance and thus commercial viability.