Impressum and GDPR: Legal Requirements for Websites in Germany
Key takeaways
- An Impressum is mandatory on every commercial website in Germany, including sole traders.
- The privacy policy must concretely describe what data you collect, not use generic language.
- Loading Google Fonts from Google's servers transmits visitor IP addresses without consent — this has been penalised.
- A cookie banner is only needed when non-essential cookies are used.
- Getting everything right takes a few hours. Not doing it costs from €500 at the first formal warning.
Two documents are mandatory on every commercial website operating in Germany: the Impressum and the Datenschutzerklärung (privacy policy under GDPR). Missing either is a common trigger for a formal warning letter from a competitor, and these do happen in practice.
If you are operating a site that targets the German market — whether from Germany or abroad — these obligations apply to you. This article covers what each must contain, how to implement them correctly, and where the most common mistakes lie.
Contents
Impressum — mandatory legal notice
What it is
A page identifying the operator of the website. Required by § 5 of the German Digital Services Act. Applies to all commercial sites, including sole traders with a Gewerbe.
What it must contain
- Full legal name (not a brand name alone)
- Physical postal address (a P.O. box does not qualify)
- Email address
- Phone number (effectively required following recent case law)
- VAT ID if assigned
- Commercial register entry and court if applicable
Where to place it
A dedicated page, linked from the footer. Reachable from any page in at most two clicks. The label should be unambiguous: "Impressum" or "Legal Notice".
What happens if it is missing
A formal warning letter (Abmahnung) from a competitor. First-time cost: €500 to €1,500 including the other party's legal fees. Repeat violations are more expensive.
Privacy policy under GDPR
What it is
A document describing how your website processes personal data. Required by Article 13 GDPR for anyone who collects data — and virtually every website does, through server logs alone.
What it must describe
For each processing activity separately:
Controller. Name, address, contact — matches the Impressum.
What data. Server logs (IP, timestamp, browser), contact form (name, email, message), analytics services, cookies, embedded content.
Legal basis. Legitimate interest (Art. 6(1)(f)), consent (Art. 6(1)(a)), or contract performance (Art. 6(1)(b)).
Recipients. Hosting provider, email service, analytics tool, payment processor.
Retention period. Specific timeframes or criteria for determining them.
Data subject rights. Access, rectification, erasure, restriction, portability, objection. Right to lodge a complaint with the supervisory authority.
How to create it
Option 1 — generator. Free generators (Datenschutz-Generator.de, eRecht24) produce a usable text. You answer questions about the services your site uses and the generator assembles the document. Takes 20 to 40 minutes.
Option 2 — lawyer. Cost: €200–500 one-off. Advisable if your site processes sensitive data or if you want full assurance.
Do not copy another site's privacy policy. It describes different services and different data processing.
Where to place it
A dedicated page, linked from the footer. Do not combine it with the Impressum — they are two separate documents.
Cookie consent
When required
Only when non-essential cookies are set: analytics (Google Analytics, Matomo with cookies), advertising pixels, embedded video with tracking.
When NOT required
If your site uses only functional cookies (session, language preference, shopping cart). A website without analytics and without embedded third-party content may not need a cookie banner at all.
How to do it correctly
The banner must offer a genuine choice: accept, reject, customise. The reject button must be equally visible as the accept button. Non-essential cookies must not load before consent is given.
Google Fonts — the hidden trap
The problem
Google Fonts loaded from Google's servers transmit the visitor's IP address to Google without consent. In January 2022, a Munich court ruled this violates GDPR. Tens of thousands of formal warnings followed across Germany.
The fix
Self-host the fonts on your own server. Download the font files, reference them locally. Nothing changes for the visitor, but the IP address stays with your server.
The same principle applies to Google Maps (load only after consent) and any other third-party resources.
How to check
Open your site, press F12 (developer tools), Network tab. Reload the page. If you see requests to fonts.googleapis.com or fonts.gstatic.com, fonts are loading from Google's servers.
Checklist
Impressum:
- Dedicated page exists
- Linked from footer
- Full legal name
- Physical address
- Email and phone
- VAT ID (if applicable)
Privacy policy:
- Dedicated page (separate from Impressum)
- All services described
- Legal bases stated
- Data subject rights listed
- Controller with contact details
Cookies and third-party content:
- Non-essential cookies load only after consent
- Banner offers genuine reject option
- Fonts self-hosted
- Maps and videos load only after consent
What correct implementation costs
| Item | Cost | Time |
|---|---|---|
| Impressum (self, via generator) | Free | 15 minutes |
| Privacy policy (generator) | Free | 30 minutes |
| Privacy policy (lawyer) | €200–500 | 1–2 weeks |
| Cookie solution | €0–50/year | 1–2 hours |
| Self-hosting fonts | Part of site build | 30 minutes |
Not acting is more expensive. A single Abmahnung for a missing Impressum starts at €500.
Frequently asked questions
Do I need an Impressum if I only have an Instagram profile? Yes. The obligation applies to any commercial online presence, including social media profiles.
Can I list my home address? Yes, if it is your registered business address. Alternatively, a virtual office with a real postal address works.
Do I need the privacy policy in English if my site is multilingual? It is not strictly required, but recommended if you offer an English version. The German version is mandatory in any case.
I use Matomo instead of Google Analytics. Do I need a cookie banner? Depends on the configuration. Matomo can run without cookies (cookieless tracking) — then no banner is needed. With cookies, a banner is required.
What should I do if I receive an Abmahnung? Do not sign the Unterlassungserklärung without legal advice. It creates a permanent obligation. Consult a lawyer specialising in IT law.
Summary
Three things to check today:
- Impressum — complete, with address and phone number
- Privacy policy — describes your actual services
- Fonts — not loading from Google's servers
Time required: one hour. Cost of not doing it: from €500 at the first incident.
If you are unsure whether your site meets the requirements, send me the URL. I will check for free and tell you what needs fixing.
This article provides general guidance and does not constitute legal advice.