Interception measures and information requests under Section 170 TKG for small providers

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and Telecommunications Interception Ordinance (Telekommunikations-Überwachungsverordnung, TKÜV) as amended on 22 October 2026, checked on 6 November 2026. This is general information, not legal advice. Which duties apply to your company in an individual case is a question for a lawyer admitted in Germany and, for open questions of interpretation, also for the Bundesnetzagentur (BNetzA), the German Federal Network Agency. Quotations from German statutes and other German sources on this page are our own unofficial translations. Only the German text is legally binding.

This page covers role, thresholds and organisation. We do not describe interception technology, handover and interfaces or the technical directive TR TKÜV, and we offer no service for them.

Who is obliged under Section 170 TKG?

Two groups. Subsection 1 applies to anyone who operates a telecommunications installation used to provide publicly available telecommunications services. The term installation is broad: Section 3 no. 60 TKG includes technical equipment, systems and servers. Subsection 2 applies to anyone who provides publicly available services using another operator's installation, for example a telephony provider on a service provider's platform.

For operators of installations under subsection 1, these are the core duties:

• from the start of operation, provide technical equipment at their own expense and make organisational arrangements for implementing interception measures without delay (no. 1),
• without delay after the start of operation, notify the BNetzA that the arrangements are in place and name an authorised recipient in Germany for service of documents (no. 3),
• provide proof: send documents to the BNetzA without delay, at the latest one month after the start of operation, and agree a date for an inspection (no. 4); on request, permit a new inspection (no. 5),
• tolerate technical means of authorised agencies on their own premises where the Article 10 Act (G 10) or the BND Act provides for this (no. 6).

Service providers under subsection 2 make sure, when selecting the operator of the installation, that it can implement orders without delay. Without delay after starting the service, they inform the BNetzA which services they provide, who implements interception orders for their users and to which office in Germany documents can be served. Changes to these details and to the details of the authorised recipient must be notified without delay under subsection 3. The BNetzA provides notification forms for both groups.

How your company is classified as a telecom provider overall is explained on the page telecom providers and notification under Section 5 TKG.

Which TKÜV threshold applies to what?

The well-known threshold of 10,000 users applies only to the interception equipment. Under Section 3(2) sentence 1 no. 5 TKÜV, no arrangements under Part 2 TKÜV are required for an installation to the extent that no more than 10,000 users are connected to it. This exception does not apply to network nodes that route a publicly available voice service abroad (Section 3(2) sentence 2). Further exceptions cover, for example, pure transit networks without connections, network nodes for interconnection with the internet and pure transmission paths. Wi-Fi networks have their own threshold of 100,000 users, explained on the page Wi-Fi hotspots and the TKG.

There is no 10,000 threshold for information on traffic data under Part 4 TKÜV. Part 4 applies to operators and providers of publicly available services to the extent that they provide services to end users. Anyone who provides services to no more than 100,000 end users only gets simplifications: after notification by the authorised agency, they may receive and answer orders without delay within their normal business hours and do not have to make certain further arrangements (Section 31(5) TKÜV). Information requests must be answered digitally. Anyone who does not have to maintain an interface of their own under Section 174(7) TKG provides at least the e-mail-based procedure, and fax is not permitted (Section 31(1), (2)).

Information on customer data under Section 174 TKG applies, regardless of both thresholds, to anyone who provides telecommunications services on a commercial basis or contributes to them. The procedure for this is shown on the page customer data under Sections 172-174 TKG.

A sentence such as “below 10,000 users there are no interception duties” is therefore wrong. In our reading, the correct statement is: below 10,000 connected users, the interception equipment under Part 2 falls away, and the information duties remain. Cooperation in an individual case also remains: Section 170(4) sentence 2 TKG and Section 3(3) TKÜV leave Section 100a(4) of the German Code of Criminal Procedure (StPO) unaffected. Under that provision, anyone who provides telecommunications services or contributes to them must enable an ordered interception and provide the necessary information without delay. Whether and to what extent they must make arrangements for this is determined by the TKG and the TKÜV.

Does the notification to the BNetzA also fall away below 10,000 users?

That is open. Section 170(4) says that subsections 1 to 3 do not apply “to the extent that” the TKÜV provides exceptions for the installation. In Section 3(2), the TKÜV says that “no arrangements need to be made”. Whether this also removes the notification under Section 170(1) no. 3 and the naming of an authorised recipient in Germany cannot be derived with certainty from the wording. We have not found a published statement by the BNetzA on this (as of 6 November 2026).

We recommend putting the question in writing to the responsible unit 218 of the BNetzA (interception measures and provision of information) and filing the answer. The enquiry should name the installation, the services, the number of connected users and the counting method. Until the answer arrives, in our view nothing speaks against naming an authorised recipient in Germany to the BNetzA.

What does a small provider have to organise?

Above all reachability, responsibility and confidentiality. The TKÜV regulates this in detail for installations above the threshold, and parts of it apply accordingly to information under Part 4:

• Reachability: Anyone who must make arrangements under Part 2 can be reached by telephone at all times to be notified of an order, and outside business hours receives it without delay, at the latest after six hours (Section 12(1) TKÜV).
• Office in Germany: An office located in Germany, with its normal business hours, must be given to the BNetzA, and changes notified without delay. Through Section 31(2) TKÜV, in our reading this also applies to receiving orders on traffic data, and so also below 10,000 users.
• Queries: Telephone queries from authorised agencies are received by competent staff (Section 12(3) TKÜV). For information on traffic data, this is sufficient within business hours.
• Contractor: A service provider may take over the tasks in an interception case, but it must not belong to the authorised agency (Section 5(3) TKÜV). The control of the interception must be operated in Germany (Section 14(1)).
• Confidentiality: Information on how orders are implemented must not become accessible to unauthorised persons (Section 15(1) TKÜV). For information on customer data, the duty of silence towards the persons concerned under Section 174(6) TKG applies.
• Responsible persons: For the proof under Section 19 TKÜV, the company states its name and registered office and the persons responsible for the interception equipment. The BNetzA issues a notice of compliance within four weeks of the inspections.

For the documents, the BNetzA offers model concepts: for voice service, internet access and e-mail service in version 2.4, and for information on traffic data in version 2.1. The technical details are in the TR TKÜV, currently edition 9.0, published in Official Gazette 18/2026 of 23 September 2026. Under Section 170(8) TKG, new requirements must be met at the latest one year after they apply to the obliged party. When the directive changes, existing equipment without deficiencies has three years.

Breaches can be fined under Section 228 TKG per offence: missing notifications under Section 170 (subsection 2 no. 39) and failing to name an authorised recipient (no. 44) up to EUR 10,000, missing equipment or arrangements (no. 42) up to EUR 500,000. The overview is on the page fines under Section 228 TKG.

Example: organisational checklist for a small network operator

Fictitious example, not a client. A regional cable and fibre network operator with 11 employees offers internet access over its own access network, to which 7,800 users are connected. It sells telephony under its own name, but technically it runs over a carrier service provider's platform, and it has no voice routing abroad of its own. It expects more than 10,000 users within two years. The checklist shows what applies today and what is added once the threshold is exceeded, in our reading and with invented details:

The count in row 2 triggers everything in the fourth column. If you only count once a year, you may notice late that the threshold has been exceeded.

Three typical gaps

If you want to know where your company stands on its TKG duties overall, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.