Germany Recording Laws: All-Party Consent, StGB, GDPR (2026)

Germany requires all-party consent to record private conversations. Section 201 of the Strafgesetzbuch (StGB) prohibits recording another person's privately spoken words without authorisation, whether the recorder participates in the conversation or not. Violations carry up to three years imprisonment or a fine.

Germany has some of the world's most protective recording and privacy laws, shaped directly by its 20th-century experience with state surveillance. Recording private conversations without all parties' consent is a criminal offence under Section 201 StGB. Parallel obligations under the GDPR, the BDSG, and now the EU AI Act add civil, administrative, and disclosure layers that affect individuals and businesses alike.

Information in this article reflects statutes, regulations, and published court decisions as of May 2026. It is general legal information, not legal advice. Consult a German-licensed lawyer for advice on your specific situation.

---

Quick Answer: Is Germany an All-Party Consent Jurisdiction?

Yes. Germany requires the consent of every party to a private conversation before any participant (or third party) may lawfully record it. Section 201(1) of the Strafgesetzbuch prohibits making a non-public audio recording of another person's privately spoken words without authorisation. Section 201(2) adds separate liability for using, disclosing to a third party, or publicly communicating the contents of such a recording if doing so interferes with another person's legitimate interests. Penalty: up to three years imprisonment or a fine.

The phrase "two-party consent" is a US-law term. Under German law the correct framing is "all-party consent" because the statute protects every person whose words are recorded, whether a conversation involves two people or twenty.

A narrow self-defence exception under Section 34 StGB may justify a recording when it is the only means to avert a present danger to a legally protected interest, but courts scrutinise whether the recording was truly necessary and proportionate. The exception is not available merely because a dispute is anticipated.

---

Historical Context: Why Germany Takes Privacy So Seriously

Germany's strict recording and privacy laws reflect two distinct periods of mass surveillance within living memory.

During the Nazi regime (1933 to 1945), the Gestapo maintained surveillance networks that relied on informants and monitoring to suppress political dissent. After Germany's division in 1945, East Germany's Ministry for State Security (the Stasi) carried the practice further: the Stasi maintained files on approximately 5.6 million people, representing roughly one-third of East Germany's population, using an estimated 91,000 full-time employees and between 170,000 and 500,000 informal collaborators who reported on friends, family, and neighbours. "House books" (Hausbücher) required residents to document every occupant and visitor.

When the Berlin Wall fell in 1989 and the Stasi files became public, the revelations shaped an entire generation's attitudes toward privacy. The Federal Constitutional Court had already signalled the constitutional weight of this in Volkszählungsurteil (BVerfG 1 BvR 209/83, 15 December 1983), recognising a constitutional right to "informational self-determination" (informationelle Selbstbestimmung) derived from Articles 1 and 2 of the Basic Law. That decision became the jurisprudential foundation for Germany's data-protection regime and, eventually, for the European GDPR framework.

---

Section 201 StGB: The Core All-Party Consent Prohibition

Section 201 of the Strafgesetzbuch (Strafgesetzbuch in the version published on BGBl. I 1998, p. 945, as last amended) contains three operative prohibitions.

Section 201(1)(1): Making a non-public audio recording of another person's privately spoken words without authorisation is a criminal offence, whether the recording is made by a device carried by the recorder or by a remotely placed listening device.

Section 201(1)(2): Intercepting using a listening device the privately spoken words of another person that are not intended for the interceptor's knowledge is separately prohibited, even if no recording results.

Section 201(2): Using or disclosing to a third party an illegally obtained recording is a separate offence. Public communication of the contents of privately spoken words is additionally prohibited if done in a way that interferes with another person's legitimate interests. A narrow exception applies where public disclosure serves overriding public interests; courts apply a balancing test.

Penalty: Up to three years imprisonment or a fine for ordinary offenders. Where the offender is a public official or a person entrusted with special public service functions, the maximum increases to five years imprisonment or a fine.

The statute uses the phrase "privately spoken words" (das nichtöffentlich gesprochene Wort). Words spoken in genuinely public settings (a public speech, a street demonstration open to all listeners) do not engage Section 201. Whether words were "private" is assessed contextually; a conversation in a café between two people at a table is private even though the café is a public space.

The Consent Standard

An important nuance: in criminal law, tacit or presumed consent may suffice under Section 201 (for example, both parties know they are being recorded as part of a business call-monitoring programme and continue the call without objection). This is a narrower standard than the GDPR requires for data-protection purposes. Under the GDPR, consent must be freely given, specific, informed, and unambiguous; a pre-recorded notice that "this call may be recorded" is not sufficient consent unless the caller is given a genuine opportunity to object or terminate the call.

The Heidelberg Regional Court (Landgericht Heidelberg, 4 O 44/24, 5 August 2024) reaffirmed the admissibility balancing approach: even where Section 201 is technically violated, a civil court must weigh the severity of the privacy interference against the importance of the evidence before excluding it. The ruling does not create a blanket admissibility rule; it merely preserves judicial discretion in civil proceedings.

---

Section 201a StGB: Image-Based Privacy and the 2021 Amendment

Section 201a protects what German law terms the "höchstpersönlicher Lebensbereich" (the innermost personal sphere) against image and video invasion.

Original scope (enacted 2004): Prohibited creating or transmitting images or video of a person in a private space or a space protected from public view without consent.

2021 amendment (effective 1 October 2021): The Bundestag significantly expanded Section 201a to address:

• Recordings made under clothing without consent (colloquially, "upskirting"), even in public spaces
• Recordings of a person's body in a way that invades their intimate sphere, regardless of whether the person is in a private or public location
• Recordings of the nakedness of a person under 18 years of age, with enhanced penalties

Current key prohibitions under Section 201a:

• Creating or transmitting an image of a person on private premises without consent, where the recording violates that person's intimate sphere
• Creating or transmitting recordings that depict a person's intimate body parts without consent (including under-clothing recordings in public spaces)
• Making available to a third party, even with that third party's consent, images or video that depict the nakedness of a person under 18 (producing, offering, or procuring for oneself or a third party)
• Distributing images that are capable of damaging the depicted person's reputation

Penalty: Up to two years imprisonment or a fine.

Note that secretly filming a person in a public space without capturing intimate content is not automatically criminal under Section 201a. However, publishing such footage typically requires the person's consent under Section 22 of the Kunsturhebergesetz (KUG), the German Copyright Act, unless the subject is a public figure and the image relates to the exercise of their public role.

---

GDPR and BDSG 2018: The Data-Protection Overlay

Audio and video recordings of identifiable individuals are personal data under Article 4(1) of the GDPR. Processing that data (creating, storing, sharing, transmitting, or deleting a recording) requires a lawful basis under Article 6(1).

The five bases relevant to recording in Germany:

1. Consent (Art. 6(1)(a)): The recorded person gives freely given, specific, informed, and unambiguous consent. Consent may be withdrawn at any time; withdrawal does not retroactively make prior processing unlawful but requires immediate cessation.
2. Legitimate interests (Art. 6(1)(f)): The recorder's interest outweighs the data subject's privacy rights. German supervisory authorities apply a strict balancing test; pure commercial convenience rarely outweighs privacy. Security-camera footage for crime prevention on private property has been found to satisfy this basis where signage is present and recording is proportionate.
3. Legal obligation (Art. 6(1)(c)): Applicable, for example, where a financial institution is required by anti-money-laundering law to record certain calls.
4. Vital interests (Art. 6(1)(d)): Available in medical emergencies.
5. Public task (Art. 6(1)(e)): For governmental recording activities.

The Bundesdatenschutzgesetz (BDSG 2018, BGBl. I 2017, p. 2097, in force 25 May 2018) supplements the GDPR in Germany. Key BDSG provisions relevant to recording include:

• Section 26 BDSG: Governs employee data processing. Personal data about employees (including call recordings) may be processed only when necessary for the employment relationship or to investigate criminal offences by employees under documented suspicion. Covert surveillance of employees requires documented suspicion, exhaustion of other investigative methods, and proportionality.
• Section 23 BDSG: Exemptions for journalistic and academic purposes, though these do not override the criminal prohibitions in Section 201 StGB.

GDPR civil liability: Article 82 GDPR provides that any person who has suffered material or non-material damage from a GDPR violation may claim compensation from the controller or processor. German courts have awarded non-material damages for anxiety and distress caused by unlawful recording.

Enforcement fines: Under Article 83 GDPR, violations of the core data-protection principles (including unlawful recording) carry fines up to EUR 20 million or 4 percent of annual global turnover, whichever is higher. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the 16 state-level data protection authorities (Landesdatenschutzbehörden) are the competent supervisory authorities.

---

EU AI Act (Regulation 2024/1689): Deepfakes and Recording Technology

Regulation (EU) 2024/1689, the EU AI Act, entered into force on 1 August 2024. Its staggered application schedule is directly relevant to recording and synthetic-media technology operating in Germany.

Key milestone dates:

Date	What Applied
2 February 2025	Prohibited AI practices (Chapter II) became applicable, including real-time biometric surveillance in public spaces
2 August 2025	GPAI model obligations (Chapter V) entered application; providers of general-purpose AI models must publish technical documentation, comply with the Copyright Directive, and provide training-data summaries
2 August 2026	Full application, including high-risk AI systems (Chapter III)

Deepfake labelling obligation (Article 50(4)): Deployers of an AI system that generates or manipulates images, audio, or video constituting a deepfake must disclose that the content has been artificially generated or manipulated. This obligation applied from 2 February 2025 as part of Chapter IV transparency requirements.

Germany's implementation body: Germany enacted the KI-Durchführungsgesetz (KI-MIG) to designate national competent authorities and establish the coordination centre KoKIVO to work alongside the EU AI Office.

Intersection with recording law: AI-powered transcription tools, voice-cloning services, and meeting-recording platforms that process audio of identifiable individuals must comply with both Section 201 StGB (consent before recording) and GDPR Article 6 (lawful basis for processing). The AI Act adds the further obligation to label or disclose AI-generated content. An AI meeting transcript produced without all-party consent would violate Section 201 StGB regardless of whether the AI Act's transparency rules are satisfied.

---

Penalties: Criminal, Administrative, and Civil

Criminal (Section 201 StGB):

• Ordinary offenders: up to three years imprisonment or a fine
• Public officials and persons with special public service functions: up to five years imprisonment or a fine

Criminal (Section 201a StGB):

• Up to two years imprisonment or a fine
• Aggravated cases (e.g., intimate imagery of minors): higher penalties under Section 201a(3) and related provisions

Proposed Section 201b StGB (deepfakes, pending as of May 2026):

• Ordinary cases: up to two years imprisonment or a fine
• Aggravated cases (public dissemination or intimate content): up to five years imprisonment or a fine
• Status: Bundesrat draft (Drucksache 222/24, July 2024) reintroduced in the Bundestag August 2025; not yet enacted; German Bar Association (BRAK) has expressed concerns about overcriminalisation

Administrative (GDPR / BDSG):

• Fines up to EUR 20 million or 4 percent of annual global turnover (Art. 83 GDPR)
• German supervisory authorities have issued significant fines against businesses for unlawful call recording and covert employee surveillance

Civil (BGB Section 823 and GDPR Article 82):

• Injunction ordering deletion or non-use of unlawfully obtained recordings
• Damages for material harm (lost income, business damage)
• Damages for non-material harm (distress, anxiety, reputational injury)
• Restitution under Section 823(1) BGB for unlawful invasion of the general right of personality (allgemeines Persönlichkeitsrecht)

---

Phone Calls: All-Party Consent Required

Recording a telephone call in Germany requires the consent of every party to the call before the recording begins. This follows directly from Section 201(1)(1) StGB; a telephone call's contents are "privately spoken words" within the meaning of the statute.

For private individuals: Before activating any recording function, you must inform all other participants and receive their agreement. Proceeding after an objection is a criminal offence.

For businesses: Simply playing a pre-recorded message stating "this call may be recorded" does not satisfy the GDPR consent standard unless the caller has a genuine and easy opportunity to object or disconnect. Many businesses require the caller to press a button or verbally confirm consent before recording begins. Internal call-monitoring programmes require notification to employees, and (where a works council exists) co-determination approval under Section 87(1)(6) of the Betriebsverfassungsgesetz.

---

In-Person Recording: Private Conversations

The same all-party consent rule applies to in-person conversations. Recording the privately spoken words of another person without their knowledge violates Section 201(1)(1) StGB regardless of whether the recorder is a participant in the conversation.

Courts have consistently held that conversations at the workplace, in homes, in vehicles, and in private-access commercial premises (meeting rooms, private offices) are "private" for Section 201 purposes. Conversations in genuinely public settings (a public speech, a parliamentary session broadcast live, words spoken to a crowd) do not attract the criminal prohibition.

The narrow self-defence exception (Section 34 StGB) requires a present danger, not merely a feared future one. Courts require that the recording was the only practicable means of averting the specific danger and that the privacy interference was proportionate to the protected interest. Anticipatory recording against an expected dispute does not qualify.

---

Recording Police Officers

Filming or recording police officers in the course of their public duties in Germany is generally lawful. Police officers acting in an official capacity in a public setting are exercising public functions, not engaging in private conversation; the "privately spoken words" requirement of Section 201 StGB is not met by orders given in the street or at a public demonstration.

The right to document police activity is also supported by the constitutional freedom of expression and freedom of the press under Articles 5 and 17a of the Basic Law. The German courts and commentators broadly recognise a public-accountability interest in recording police operations, particularly at assemblies protected under Article 8 (Versammlungsfreiheit).

However, practical limits apply:

• Audio recording of a police officer's private conversation (not in the exercise of official duties) does require consent under Section 201 StGB
• Police officers have argued (and some courts have accepted) that Section 201 extends to "official instructions" in specific contexts; this remains contested, and the German police practice of invoking the "wiretapping paragraph" against demonstrators who film officers has been widely criticised by legal commentators
• Publishing footage that identifies officers by face or badge number may engage data-protection obligations under the GDPR if the footage is processed and stored (as opposed to a live stream that is not retained)

The BVerfG's 2025 ruling on source telecommunications surveillance (BVerfG, press release 69/2025) confirmed the constitutional requirement for proportionality in any state surveillance measure but did not directly address citizen recording of police.

---

Workplace Recording and Employee Surveillance

Workplace recording in Germany is governed by Section 201 StGB, Section 26 BDSG, the GDPR, and the co-determination rights of works councils under the Betriebsverfassungsgesetz (BetrVG).

Key principles:

• Legitimate purpose: Employers must identify a specific, documented, and lawful purpose before any monitoring begins
• Proportionality: The monitoring must be limited to what is necessary for the stated purpose; blanket recording of all employees without documented cause is not proportionate
• Transparency: Employees must be informed about any monitoring, including the nature, scope, duration, and purpose of recording
• Co-determination (Mitbestimmung): Where a works council (Betriebsrat) exists, Section 87(1)(6) BetrVG gives the works council a mandatory right of co-determination over the introduction and use of technical equipment designed to monitor employee behaviour or performance. A works council agreement (Betriebsvereinbarung) is required before implementing call recording or video surveillance in the workplace
• Protected activities: Works council meetings, data protection officer activities, and trade union representative activities cannot be monitored under any circumstances

Covert surveillance: Section 26(1)(2) BDSG permits covert employee surveillance only where there is documented, concrete suspicion of a criminal offence within the employment relationship, other investigative means have been exhausted or are impractical, and the surveillance is proportionate in scope and duration.

The Federal Labour Court (Bundesarbeitsgericht) has held that video-surveillance evidence obtained in violation of these principles may be subject to an evidentiary prohibition (Beweisverwertungsverbot) in employment litigation, though courts weigh the employer's interests on a case-by-case basis.

---

Recording Police (Summary), Assemblies, and Public Officials

As summarised above, recording public officials acting in an official capacity in public does not violate Section 201 StGB. Article 8 of the Basic Law protects assembly; participants in lawful assemblies are permitted to document police conduct at those assemblies. The gofilmthepolice resources published by German civil-liberties organisations confirm that German law permits citizens to film police.

The key distinction is between the official act (lawful to record) and any private utterance by the officer (requires consent under Section 201). Practical guidance: limit recordings to the observable official conduct; do not capture conversations between officers that are clearly not directed to the public.

---

Voyeurism, NCII, and Deepfakes

Current law (Sections 201a and related provisions)

Section 201a as amended in 2021 covers upskirting and intimate recordings made without consent, even in public spaces. Producing, possessing, or distributing such material is a criminal offence. Separate provisions under the Gewaltschutzgesetz allow civil injunctions for victims of image-based abuse.

The aktiv-gegen-digitale-gewalt.de project, a state-funded German counselling service, identifies the following criminal provisions applicable to image-based sexual violence:

• Section 201a StGB (image invasion of intimate sphere)
• Section 184b StGB (distribution of child sexual abuse material where the victim is under 18)
• Section 238 StGB (stalking, which can include circulation of intimate images as a coercive tool)
• Section 33 KUG (publication of images without consent)

The deepfake legislative gap and Section 201b StGB-E

Section 201a technically requires a recording of a real person in a specific situation. AI-generated deepfakes are synthetic composites, not recordings; this means Section 201a does not straightforwardly cover deepfakes even when they simulate intimate imagery.

The Bundesrat recognised this gap and passed a draft law (Drucksache 222/24) in July 2024 proposing a new Section 201b StGB. The Bundestag received the proposal in August 2025. As of May 2026, Section 201b is not yet enacted.

Proposed Section 201b StGB would criminalise:

• Making accessible to others computer-generated or algorithmically altered media content that creates the realistic appearance of an image or audio recording of an identifiable person without their consent
• Ordinary penalty: up to two years imprisonment or a fine
• Aggravated penalty (public dissemination or intimate content): up to five years imprisonment or a fine

The German Bar Association (Bundesrechtsanwaltskammer, BRAK) expressed scepticism in November 2025, warning of overcriminalisation and potential conflicts with freedom of expression. The proposal remains under debate.

EU Directive: The EU Directive on combating violence against women (Directive 2024/1385/EU, entered into force May 2024) requires Member States to penalise the non-consensual creation and sharing of sexualising deepfakes. Germany must transpose the Directive by June 2027.

---

Cross-Border Recording: Germany and the United States

A German resident who records a call with a US counterpart faces two simultaneous legal regimes.

German law applies because the recording is initiated on German soil and the recorded person's words are processed in Germany. All-party consent is required under Section 201 StGB and valid GDPR consent is required for any data processing.

US federal law (18 U.S.C. § 2510 et seq., the Wiretap Act) applies to the US participant's end of the call. Federal law permits one-party consent recording, meaning the US participant could lawfully record the call under federal law without informing the German participant. However, state law may be stricter; California (Cal. Penal Code § 632), Florida (Fla. Stat. § 934.03), and several other states require all-party consent.

Practical result: A business call between a US employee (in a one-party-consent US state) and a German employee must be treated as an all-party consent call because German law governs the German participant's end. Failure to obtain all-party consent exposes the German participant (and potentially the German entity) to criminal and GDPR liability regardless of what is permissible on the US side.

Data transfer implications: Transmitting a recording from Germany to the US also requires a lawful data-transfer mechanism under GDPR Chapter V (Standard Contractual Clauses, the EU-US Data Privacy Framework, or another approved transfer mechanism), in addition to the consent and lawful basis requirements for the initial recording.

---

Government Surveillance: Section 100a StPO and the 2025 BVerfG Ruling

Police and intelligence services in Germany may intercept telecommunications only on prior authorisation of a court.

Section 100a StPO permits court-ordered interception of telecommunications where: (1) one of the serious criminal offences listed in Section 100a(2) StPO is under investigation; (2) the offence is serious in the individual case; and (3) investigating the facts or locating the suspect would otherwise be substantially more difficult or futile. In urgent circumstances, a public prosecutor may order interception provisionally, subject to court confirmation within three working days.

The BVerfG 2025 ruling (press release bvg25-069): The Federal Constitutional Court held in 2025 that source telecommunications surveillance (Quellen-Telekommunikationsüberwachung, "source TKÜ") authorised by Section 100a(1)(2) StPO is not constitutionally justified insofar as it permits surveillance for offences carrying a maximum sentence of only three years imprisonment or less. The court confirmed that surveillance for serious offences (terrorism, organised crime, drug trafficking) remains constitutionally permissible, but the proportionality requirement of Article 10 of the Basic Law invalidates the extension of coercive surveillance to minor offences.

Article 10 Basic Law: Protects the secrecy of telecommunications for all persons in Germany. Any state interception must be authorised by law, subject to judicial oversight, and proportionate to the investigative aim.

The G10 Act (Artikel 10-Gesetz): Governs intelligence-service telecommunications surveillance (as distinct from criminal-procedure surveillance under the StPO). The G10 Act limits intelligence-service interception to specific threats (terrorism, foreign intelligence, arms trafficking) and requires approval from the Parliamentary Control Panel (Parlamentarisches Kontrollgremium).

---

Dashcam Recording

Germany's Federal Court of Justice (BGH, VI ZR 233/17, 15 May 2018) ruled that continuous dashcam recording technically violates Germany's data-protection regulations because it captures images of identifiable persons (pedestrians, other drivers, passengers) without a specific justification for each data subject. Despite the technical violation, dashcam footage is not automatically inadmissible as evidence in civil proceedings. Courts must balance the severity of the data-protection violation against the need for evidence on a case-by-case basis.

Practical status as of 2026: Dashcam use is widespread in Germany. Dashcams with loop recording (overwriting footage after a defined period unless triggered by a collision sensor) are more likely to be found proportionate under GDPR legitimate-interest analysis than devices that retain full continuous footage. Signage informing other road users of recording is good practice but not legally required for private vehicles.

---

Telephone Interception by Service Providers

Section 88 of the Telekommunikationsgesetz (TKG 2021, the most recent consolidated version, BGBl. I 2021, p. 3338) and Article 10 of the Basic Law together require telecommunications service providers to maintain the secrecy of all communications they carry. Providers may not access or disclose call content or related circumstances except to the extent strictly necessary for the commercial provision of the service and the protection of their technical systems.

---

CCTV and Video Surveillance in Public Spaces

CCTV on private property (homes, shops, offices) is regulated by Section 4 BDSG (for public areas) and GDPR Article 6(1)(f) (legitimate interests). Key requirements:

• Cameras may only monitor the owner's own property; recording adjacent public footpaths, roads, or neighbouring properties requires a separate justification and is regularly found disproportionate by German data-protection authorities
• Clearly visible signage must inform persons that they are being recorded, identifying the controller and the purpose
• Footage retention must be limited to what is necessary for the stated purpose; most German DPAs treat 72 hours as a default maximum for security footage
• Access to footage must be restricted and logged

Public-authority CCTV (police cameras at demonstrations, transport hubs) requires a separate statutory basis and is subject to stricter proportionality review under the relevant state police laws (Polizeigesetze) and Article 10 Basic Law.

---

This article presents general legal information about recording laws in Germany. It covers federal German criminal law (StGB, StPO), the federal data protection framework (BDSG, GDPR), and relevant EU regulations as of May 2026. It does not address every state-level (Landesrecht) variation in police law or surveillance statutes. Consult a lawyer licensed in Germany for advice on your specific situation.