Germany requires all-party consent to record a conversation. Every person speaking at your booth must know the recording is happening and must not object — otherwise you are committing a criminal offence under §201 of the German Criminal Code, not merely a data-protection breach.
This matters more in Germany than almost anywhere else in Europe, and Germany hosts some of the largest B2B trade shows in the world — Hannover Messe, MEDICA, Bauma, IFA. If your team records booth conversations, this is the jurisdiction to get right first.
Not legal advice. This is a practical summary for sales teams. German recording law interacts with criminal law, employment law and GDPR in ways that depend on your specific setup. Have your DPO or counsel review your process before an event.
What §201 StGB actually says
Section 201 StGB — Verletzung der Vertraulichkeit des Wortes, "violation of the confidentiality of the spoken word" — makes it an offence to record the non-public spoken word of another person without that person's consent. It also criminalises using such a recording afterwards.
Two parts of that definition decide whether it applies to you:
"Non-public" does not mean "in private." It means the speaker had a reasonable expectation that their words were not being broadcast to the world. A one-to-one conversation at a busy exhibition booth is still non-public, even in a hall with 40,000 people in it. The noise around you does not make the conversation public.
"Without consent" is the whole ballgame. Germany does not recognise one-party consent. The fact that you — a participant — agreed to the recording is irrelevant. Every voice captured needs to have agreed.
The penalty is a fine or up to three years' imprisonment. This is real criminal exposure attaching to an individual, not just a corporate fine.
Why booth signage does not work
The most common mistake exhibitors make is assuming a printed notice covers them. It does not, for two independent reasons.
Under §201, the requirement is that the other party knows and does not object. Someone who walked past a sign they never read has not been informed. If they later say "I never saw that," you have no record proving otherwise.
Under GDPR, Article 4(11) defines consent as freely given, specific, informed and unambiguous, indicated by a clear affirmative action. Passive signage fails on "unambiguous" and on "affirmative action." The European Data Protection Board has been consistent that implied or opt-out consent is not consent.
A sign is a useful supporting signal. It is not a legal basis.
What consent that actually holds looks like
For a booth conversation in Germany, a defensible process has four components:
1. Ask before recording starts. Verbally, in plain German or the language the conversation is being held in. Something like: "Ich zeichne unser Gespräch auf, um die Notizen korrekt zu erfassen — ist das für Sie in Ordnung?" ("I am recording our conversation so my notes are accurate — is that alright with you?")
2. Get an affirmative response. A nod, a spoken yes, or a tap on a screen. Silence is not consent. Someone continuing to talk after a notification is arguably enough under §201, but it is weak under GDPR — get something affirmative.
3. Make the recording visible. A device with a visible indicator light removes any argument that the recording was secret. This is the difference between an overt recording and a covert one, and it is the distinction §201 turns on.
4. Log the consent. Record that consent was given, when, and by whom. If a complaint arrives eight months later, the burden of proof is on you under GDPR Article 7(1). An unlogged verbal yes is very hard to defend.
The GDPR layer sitting on top
Even with valid §201 consent, you are processing personal data and need a lawful basis under GDPR Article 6.
For recording a conversation, consent under Article 6(1)(a) is generally the cleanest basis. Legitimate interests under 6(1)(f) is theoretically available but hard to argue for audio capture of an identifiable person who could reasonably object.
You also owe the person, at the moment of collection:
- Who you are and how to contact your DPO
- What you are recording and why
- How long you keep it
- That they can withdraw consent, and that withdrawal must be as easy as giving it
- Their rights of access, erasure and portability
Practically this is a short spoken summary plus a link or QR code to a full privacy notice.
Data minimisation is your best defence
GDPR Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary. Applied to booth recording, this has a clear implication: if you only need the structured lead data, do not keep the raw audio.
A process that transcribes a conversation, extracts the fields you actually need — name, company, requirement, next step — and then deletes the audio is dramatically easier to defend than one storing hours of recordings indefinitely. It reduces breach exposure, shortens your retention obligations, and shows a supervisory authority you thought about minimisation.
This is how Confee is built: audio is processed into structured CRM fields, and the raw recording does not need to be retained.
A practical German booth checklist
Before the show:
- Privacy notice translated into German, reachable by QR code at the booth
- Booth staff briefed that consent is per conversation, not per day
- Retention period defined and written down
- DPO or counsel has reviewed the process
During each conversation:
- Ask before starting
- Wait for an affirmative yes
- Ensure the recording indicator is visible
- Log that consent was given
- Stop immediately if anyone objects — including someone who joins mid-conversation
After the show:
- Delete raw audio once fields are extracted
- Honour erasure requests within one month (Article 12(3))
The one rule to remember
If you take a single thing from this: in Germany, silence is not consent, and a sign is not consent. You need a person to actively agree, every time, and you need to be able to prove they did.
Get that right and Germany is entirely workable. Get it wrong and the exposure is criminal, not just financial.
Related reading:
- Is Recording Sales Conversations Legal? — the cross-jurisdiction overview
- GDPR-Compliant Lead Capture — the data-protection side in full
- How to Record In-Person Sales Meetings — the practical mechanics
FAQ
Is it legal to record a conversation at a German trade show?
Yes, but only if every person in the conversation knows about it and does not object. §201 StGB makes it a criminal offence to record the non-public spoken word of another person without consent. A booth conversation is non-public, so it falls squarely inside this rule. Germany is an all-party consent jurisdiction.
Is a sign at the booth enough to count as consent in Germany?
No. A generic sign meets neither the §201 StGB standard nor the GDPR standard. §201 requires the other party to actually know and not object. GDPR Article 4(11) requires consent to be freely given, specific, informed and unambiguous, given by a clear affirmative act. Passive signage is none of those.
What are the penalties for illegal recording in Germany?
Under §201 StGB, a fine or imprisonment of up to three years. Separately, a GDPR breach can attract fines up to €20 million or 4% of global annual turnover. The two exposures are independent.
Does GDPR consent replace §201 StGB consent?
No — you need both. §201 StGB is criminal law protecting confidentiality of the spoken word; GDPR governs processing of the resulting personal data. A single clear verbal request plus a logged affirmative response can satisfy both in practice, but they remain separate obligations.