Law & Accessibility
Two documents are mandatory on every website run on a business basis in Germany: the Impressum and the Datenschutzerklärung (privacy policy under GDPR). Missing either is a common trigger for a formal warning letter from a competitor, and these do happen in practice.
If you are operating a site that targets the German market — whether from Germany or abroad — these obligations apply to you. This article covers what each must contain, how to implement them correctly, and where the most common mistakes lie.
A page identifying the operator of the website. Required by § 5 of the German Digital Services Act. Applies to every site offered on a business basis (geschäftsmäßig), usually for payment, whether or not a Gewerbe is registered. What such a site needs beyond the legal pages is covered in the article on a website for a Gewerbe.
The details are the same for sole traders (Einzelunternehmer), freelancers (Freiberufler) and small businesses (Kleingewerbe).
A dedicated page, linked from the footer. Reachable from any page in at most two clicks. The label should be unambiguous: "Impressum" or "Legal Notice".
A formal warning letter (Abmahnung) from a competitor. First-time cost: €500 to €1,500 including the other party's legal fees. Repeat violations are more expensive.
Responsibility sits with whoever operates the site, not the agency that built it. If you cannot reach your own site right now because the developer stopped replying, here is how to get the domain and access back.
Much of what's written about the German legal notice assumes the business is based in Germany. If yours isn't, the answer depends on where you're established — and it's more forgiving than many people assume.
If you're established in another EU or EEA country and have no branch in Germany, the German legal notice rules in section 5 DDG don't bind you. Section 3 DDG sets out the country-of-origin principle: a provider established in another EU or EEA state follows the information rules of its home country, even when it addresses German customers in German. A Dutch company follows Dutch rules, a Polish one Polish rules.
In practice you're usually closer than you think. Those home-country rules implement the same EU directive, so the core information — who you are, where you're based, how to reach you, your registration details — overlaps considerably.
The principle doesn't cover everything. Section 3 DDG expressly excludes certain areas. Data protection under the GDPR applies to you regardless. So do the consumer protection rules that govern contracts with German consumers, and copyright. The country-of-origin principle only relieves you of the German information duties, not of these.
If you have a branch in Germany, German rules apply to it, and it needs a legal notice under section 5 DDG. If you set up a German company — a GmbH or UG — it counts as established in Germany, and its specific mandatory details apply in full.
If you're based outside the EU and EEA — in the United States, Switzerland, or the United Kingdom since Brexit — you can't rely on the country-of-origin principle. Here the legal position is genuinely unsettled. Some courts have held that a non-EU provider isn't bound by the German legal notice rules; others take the view that a provider deliberately targeting the German market is. If you actively sell to German customers, the safest course is to provide a legal notice that meets German requirements.
Whatever the strict legal position, there's also a practical one. German customers are used to finding a legal notice on every business website, and its absence reads as a warning sign. Even where you're not obliged to provide one under German law, a clear legal notice builds the trust you need to win German clients.
A document describing how your website processes personal data. Required by Article 13 GDPR for anyone who collects data — and virtually every website does, through server logs alone.
For each processing activity separately:
Controller. Name, address, contact — matches the Impressum.
What data. Server logs (IP, timestamp, browser), contact form (name, email, message), analytics services, cookies, embedded content.
Legal basis. Legitimate interest (Art. 6(1)(f)), consent (Art. 6(1)(a)), or contract performance (Art. 6(1)(b)).
Recipients. Hosting provider, email service, analytics tool, payment processor. With the host you also need a data processing agreement — more in the article on hosting, SSL and email.
Retention period. Specific timeframes or criteria for determining them.
Data subject rights. Access, rectification, erasure, restriction, portability, objection. Right to lodge a complaint with the supervisory authority.
Option 1 — generator. Free generators (Datenschutz-Generator.de, eRecht24) produce a usable text. You answer questions about the services your site uses and the generator assembles the document. Takes 20 to 40 minutes.
Option 2 — lawyer. Cost: €200–500 one-off. Advisable if your site processes sensitive data or if you want full assurance.
Do not copy another site's privacy policy. It describes different services and different data processing.
A dedicated page, linked from the footer. Do not combine it with the Impressum — they are two separate documents.
Only when non-essential cookies are set: analytics (Google Analytics, Matomo with cookies), advertising pixels, embedded video with tracking.
If your site uses only functional cookies (session, language preference, shopping cart). A website without analytics and without embedded third-party content may not need a cookie banner at all. When exactly a banner is required and how to do without one is covered in the article on cookie banners.
The banner must offer a genuine choice: accept, reject, customise. The reject button must be equally visible as the accept button. Non-essential cookies must not load before consent is given.
Google Fonts loaded from Google's servers transmit the visitor's IP address to Google without consent. In January 2022, a Munich court ruled this violates GDPR. Tens of thousands of formal warnings followed across Germany.
Self-host the fonts on your own server. Download the font files, reference them locally. Nothing changes for the visitor, but the IP address stays with your server.
The same principle applies to Google Maps (load only after consent) and any other third-party resources.
Open your site, press F12 (developer tools), Network tab. Reload the page. If you see requests to fonts.googleapis.com or fonts.gstatic.com, fonts are loading from Google's servers.
Impressum:
Privacy policy:
Cookies and third-party content:
| Item | Cost | Time |
|---|---|---|
| Impressum (self, via generator) | Free | 15 minutes |
| Privacy policy (generator) | Free | 30 minutes |
| Privacy policy (lawyer) | €200–500 | 1–2 weeks |
| Cookie solution | €0–50/year | 1–2 hours |
| Self-hosting fonts | Part of site build | 30 minutes |
Not acting is more expensive. A single Abmahnung for a missing Impressum starts at €500.
Do I need an Impressum if I only have an Instagram profile? Yes. The obligation applies to any commercial online presence, including social media profiles.
Can I list my home address? Yes, if it is your registered business address. Alternatively, a virtual office with a real postal address works.
Do German legal notice rules apply to a company based outside Germany? It depends on where you're established. A company based in another EU or EEA country without a German branch follows its home country's information rules under the country-of-origin principle in section 3 DDG, though the GDPR and German consumer law still apply. A company outside the EU and EEA, including the UK and Switzerland, can't rely on that principle, and the position is unsettled — providing a German-style legal notice is the safest choice.
Do I need the privacy policy in English if my site is multilingual? It is not strictly required, but recommended if you offer an English version. The German version is mandatory in any case.
I use Matomo instead of Google Analytics. Do I need a cookie banner? Depends on the configuration. Matomo can run without cookies (cookieless tracking) — then no banner is needed. With cookies, a banner is required.
What should I do if I receive an Abmahnung? Do not sign the Unterlassungserklärung without legal advice. It creates a permanent obligation. Consult a lawyer specialising in IT law.
Three things to check today:
Time required: one hour. Cost of not doing it: from €500 at the first incident.
If you are unsure whether your site meets the requirements, send me the URL. I will check for free and tell you what needs fixing.
This article provides general guidance and does not constitute legal advice.
TopicsLegal pages, GDPR, Warning letters
Law & Accessibility
Many websites show a banner they don't need; others need one and get it wrong. What Germany's § 25 TDDDG requires, and why 'cookieless' doesn't automatically mean 'no banner'.
Technology
Three things almost nobody thinks about until something goes wrong. Why server location matters, which contract is almost always missing, and how a font can lead to a warning letter.
Law & Accessibility
A German GmbH or UG needs more than a sole trader's legal notice. Which details are mandatory, why every business email needs the same ones, and where the UG sets a trap.