Quick freeze is coming to Germany. With the government bill on IP address retention and the further development of investigative powers in criminal proceedings (Bundestag printed paper 21/6581), Germany is introducing a Sicherungsanordnung: an order that obliges telecommunications providers to preserve existing traffic data immediately, before a court decides whether the data may be disclosed.
For providers, this means a new, time-critical process: receive the order, freeze the data, store it separately and securely, watch the deadlines, disclose it only on a second order, and delete it irreversibly. This article explains what the draft requires, who is affected and how to prepare.
Status: government bill BT-Drs. 21/6581; first reading on 24 June 2026, committee hearing on 7 October 2026; not yet passed. Details may still change.
Key Takeaways
- A Sicherungsanordnung freezes traffic data only. Location and cell data can be included where the offence is of considerable significance. Content, subscriber data and data from the new IP address retention are out of scope.
- Orders can come from the public prosecutor (in urgent cases from investigators), the Federal Police and the BKA. They are valid for up to three months and can be extended by a court by up to three months.
- Around 3,000 providers of publicly available telecommunications services are affected. § 176 TKG-E authorises them, and those who participate in providing the service, to process the frozen data.
- Preservation and disclosure are two separate steps. Data is only handed over on a separate request, typically based on a court order.
- Frozen data must be stored separately, protected by state-of-the-art security measures, and deleted irreversibly after transmission or expiry.
- The European Preservation Order (transmitted to the provider as an EPOC-PR certificate) under the e-Evidence Regulation runs in parallel and is expected to be even more relevant in practice.
What Is Quick Freeze?
Quick freeze is the targeted alternative to general data retention. Instead of storing everyone’s traffic data in advance, authorities can order a provider to “freeze” data that already exists about specific persons or locations, as soon as there is a concrete reason. The data is kept from being deleted in routine processes, and the authorities then have time to obtain a court order for disclosure.
| Quick freeze (§ 100g(7) StPO-E, § 176 TKG-E) | IP address retention (§ 177 TKG-E) | |
|---|---|---|
| Trigger | Individual order | No trigger, applies to all connections |
| Obligated parties | All public telecom services and those who participate (approx. 3,000) | Internet access providers only (approx. 700) |
| Data | Traffic data (location and cell data only for offences of considerable significance), no content | Public IP, ports, line and user ID, timestamps |
| Duration | Up to 3 months, plus up to 3 months by court order | 3 months, with rolling deletion for ongoing assignments |
| Disclosure | Only on a separate request (§ 175 TKG-E, § 100g StPO) | Only for subscriber identification (§ 174 TKG) and e-Evidence |
We cover the second instrument in detail in our next article on IP address retention.
Legal Basis and Who Can Order a Freeze
- § 100g (7) StPO-E (criminal prosecution): ordered by the public prosecutor, and in urgent cases by its investigators (police, customs investigation). Maximum three months, with a court-ordered extension of up to three more months on application of the prosecutor.
- § 25a BPolG-E (Federal Police, threat prevention): written order by the President of the Federal Police Headquarters or the head of a directorate, maximum three months, extendable by a court by up to three months at a time.
- BKAG: corresponding powers for the Federal Criminal Police Office.
- Federal states: the Bundesrat has asked for preservation powers for state police as well. This is still open in the committee.
- § 176 TKG-E authorises providers of publicly available telecommunications services, and those who participate in providing them, to process the data. The provider served with the order stays responsible. It can have the data stored by a service provider, whom it names to the BNetzA on request.
Which Data Is Covered?
In scope (traffic data under § 3 No. 70 TKG):
- Connection data: calling and called numbers, IMSI, IMEI, timestamps, duration, service type (voice, SMS, data)
- Location data, including cell IDs. An order can also cover entire radio cells if it describes them narrowly in space and time.
- Internet session data: assigned IP address, ports, start and end, volume
Out of scope:
- Content of communications (message text, call content)
- Data from the new IP address retention under § 177 TKG-E
- Usage data of digital services (covered by a separate provision)
- Subscriber data, which is requested through regular information requests, not frozen
The freeze normally covers data that already exists when the order arrives. It extends to data arising later only where the underlying collection power would also allow future or real-time data. The order states the data and the period to be preserved (§ 101a(1) No. 3(b) StPO-E). Providers do not have to create data that their systems do not generate.
Provider Obligations Step by Step
1. Receive the Order and Check It Formally
- Accept the order in writing. Electronic channels (ETSI-ESB / E-Mail-ESB) are expected in the TR TKÜV, with details still open.
- Check the formal requirements: authorised authority, legal basis, identifier or cell description, data types, period, end date, duration of no more than three months.
- There is no substantive legality review. That responsibility lies with the authority.
- Ask the authority if identifiers or cell descriptions are unclear.
2. Freeze the Data
- Without delay and completely, extract the relevant records from mediation and CDR systems, HLR/HSS logs, packet gateway (PGW/UPF) session logs, RADIUS/Diameter accounting and location logs.
- Suspend the routine deletion of these records, which normally happens after a few days or weeks.
- Store them separately from all other subscriber data on a secured and reliable system.
- Apply state-of-the-art technical and organisational measures: encryption, access control, four-eyes principle and logging.
- Keep the data ready for immediate transmission.
3. Manage the Freeze
- Monitor the deadline and wait for any court extension. Without an extension, the data is deleted when the order expires.
- Keep the order confidential. Informing the subscriber or third parties is an administrative offence.
- Log all access under § 35 TKÜV, which will also cover the new legal bases on which data is stored.
4. Disclose Only on a Separate Request
Disclosure is not automatic. It requires a separate request, typically a court order under § 100g (1) to (4) StPO or § 25 BPolG. The usual rules then apply: formal check by qualified staff or automatically, secured transmission, and the ETSI-ESB obligation for providers with 100,000 or more contract partners. For European orders, disclosure follows a European Production Order.
5. Delete Irreversibly
- Delete the data without delay and irreversibly after transmission, or when the order expires.
- Document the deletion. Failure to delete is subject to fines.
- For European preservation orders: delete once preservation is no longer required under Regulation (EU) 2023/1543.
6. Inform the Regulator and Meet the Deadlines
- Once the service starts, inform the BNetzA how the requirements are implemented, and report any changes without delay.
- On request, tell the BNetzA who stores the frozen data. This is where an external service provider is named.
- The BNetzA plans regular checks.
- Timeline: § 176 TKG-E applies from the day after promulgation; the draft has no transition period for it (only § 177 gets six months). Technical details will follow in the TKÜV and TR TKÜV. Whether the § 170(8) TKG grace periods apply to them is open.
Compensation (JVEG, New Annex 3)
| Item | Amount |
|---|---|
| Freeze per identifier (incl. location data) | EUR 25 |
| Freeze per radio cell / each further cell | EUR 40 / + EUR 5 |
| Freeze by address / area / route (per 10 km started) | EUR 75 / EUR 190 / EUR 65 |
| Last known location | EUR 85 |
| Per extension | EUR 25 |
| Per disclosure after a freeze | EUR 20 |
Amounts are reduced by 20 % when billed through central contact points. The explanatory memorandum expects only about 600 to 1,100 national orders per year. For most providers, readiness matters more than volume.
Practical Challenges
- “Without delay” means 24/7 readiness. Automating extraction and freezing is the only realistic way to comply.
- MVNOs depend on their host network. Cell, location and data session logs usually sit with the host MNO. Without a contractual data supply, an MVNO cannot comply with cell-based orders, so this must be clarified in the wholesale agreement. See MVNO vs MNO responsibilities.
- Security level of the storage must match what the TKÜV and TR TKÜV will require. Designing to today’s BNetzA and BSI standards avoids costly rework later.
- Data protection: an external service provider needs a data processing agreement (Art. 28 GDPR), and its staff must be bound by telecommunications secrecy.
- Parallel e-Evidence orders: European Preservation Orders under Article 6 of Regulation (EU) 2023/1543 must be handled with the same rigour. See our e-Evidence solutions.
How ICS Helps: Quick Freeze as a Managed Service
ICS International Carrier Services has more than 20 years of experience in telecommunications, lawful interception and compliance and holds multiple BNetzA acceptances. ICS can act as your service provider for the complete freeze process. You remain the obligated party, and ICS is named to the BNetzA as the entity that stores the data.
- Order intake: via the existing written channels, and via ESB / E-Mail-ESB once the TR TKÜV defines them, with formal check, queries to the authority, deadline calendar and extension management.
- Data extraction: connectors to your mediation/CDR systems, PGW/UPF logs and RADIUS/Diameter accounting, with a snapshot of the data the order names and, where the order covers later data, continued collection until the deadline.
- Secured freeze vault: one encrypted container per order, hash-based integrity evidence and four-eyes access.
- Disclosure on a separate request via ESB, with a handover record.
- Automated, logged, irreversible deletion, with a deletion certificate for you.
- BNetzA documentation: implementation documents, change notifications and audit support.
- JVEG billing for all freeze and disclosure items, combined with our e-Evidence Compliance Platform for European orders.
Learn more about our data retention and quick freeze services. Prepare now instead of scrambling when the law takes effect. Contact ICS for a readiness assessment.
Frequently Asked Questions
What is quick freeze?
Quick freeze is a procedure in which authorities order a telecommunications provider to preserve existing traffic data about specific persons or locations without delay. The data may only be disclosed later, on a separate legal basis, and must otherwise be deleted.
How long must frozen data be kept?
Under the German draft, a preservation order is valid for up to three months. A court can extend it by up to three months. After transmission or expiry, the data must be deleted irreversibly.
Does a Sicherungsanordnung cover content or IP retention data?
No. It covers traffic data only; location and cell data can be included where the offence is of considerable significance. It does not cover the content of communications, subscriber data, usage data of digital services or data stored under the new IP address retention.
Who is obligated to implement quick freeze orders?
All providers of publicly available telecommunications services, including OTT messaging and e-mail services (around 3,000 companies according to the draft). They can use a service provider for storage but remain responsible.
How does quick freeze relate to the EU e-Evidence Regulation?
The e-Evidence Regulation introduces a European Preservation Order (transmitted to the provider as an EPOC-PR certificate) with a similar purpose. Under Article 6(3) of the Regulation, a European Preservation Order may only be issued if it could have been ordered under the same conditions in a similar domestic case. The Sicherungsanordnung creates that domestic counterpart, and providers will have to handle both types of order.
Disclaimer: This article provides general information based on the German government bill (BT-Drs. 21/6581) as of October 2026, after the Legal Affairs Committee hearing. It does not constitute legal advice. Provisions, deadlines and technical details may change during the parliamentary process and in the TKÜV / TR TKÜV.
Related Articles
- MVNO vs MNO: Who Is Legally Responsible for Lawful Interception?
- What Is e-Evidence? A Complete Guide
- LI Compliance as a Service: What SLAs Should You Actually Demand?
