§ 9 TDDDG
Processing of Traffic Data
(1)Persons obliged under Section 3(2) sentence 1 may only process the following traffic data insofar as this is necessary for the establishment and maintenance of telecommunications, for billing purposes, or for the establishment of further connections: In all other respects, traffic data must be deleted by the persons obliged under Section 3(2) sentence 1 without delay after the connection has ended. Any processing of traffic data beyond sentence 1 is not permissible. The obligation to process traffic data under other statutory provisions shall remain unaffected. 1 the number or identifier of the participating connections or terminal equipment, personal authorisation identifiers, and where customer cards are used, the card number as well, and for mobile connections, also the location data,; 2 the beginning and end of the respective connection by date and time and, insofar as the charges depend on it, the volumes of data transmitted,; 3 the telecommunications service used by the user,; 4 the endpoints of dedicated connections, their beginning and end by date and time and, insofar as the charges depend on it, the volumes of data transmitted, and; 5 other traffic data necessary for the establishment and maintenance of telecommunications and for billing purposes.
(2)Subscriber-related traffic data under paragraph 1 may be used by the provider of the telecommunications service for the purpose of marketing telecommunications services, for the needs-based design of telecommunications services, or for the provision of value-added services to the extent and for the period necessary for this purpose only if the end user has given consent in accordance with Regulation (EU) 2016/679. The data of other end users must be anonymised without delay. A destination-number-related use of traffic data for the purposes referred to in sentence 1 is only permissible if the end user has been informed in accordance with Regulation (EU) 2016/679 and has given consent. In doing so, the data of other end users must be anonymised without delay. In addition, the end user must be informed that consent under sentences 1 and 3 may be withdrawn at any time.