What legal requirements must a website meet in Germany?

Does a website need a legal notice (Impressum) – and what must it contain?

Under Section 5 DDG, a legal notice (Impressum) is required for providers of digital services offered on a business basis, generally for a fee – in practice, that means virtually every company website, including that of a trade business or a freelancer. The DDG replaced the Telemedia Act (TMG) in May 2024; references to the TMG are therefore outdated and should be updated. The legal notice must be easy to recognize, directly accessible and permanently available.

Typical mandatory details include the name and a serviceable postal address (one at which legal documents can be delivered), for companies the legal form and the authorized representatives, details for quick contact including an email address, commercial register court and registration number, and a VAT identification number if one exists. Additional details apply to licensed activities and regulated professions, such as the competent supervisory authority or chamber. For sole proprietors, the full first and last name is required.

• Name or company name and a serviceable postal address
• Legal form and authorized representatives
• Email address and one further way to reach you quickly
• Commercial register court and registration number, if applicable
• VAT identification number, if applicable
• Chamber, professional title or supervisory authority for certain professions

Do I need a legal notice for a private website?

Purely private websites, such as a family blog or a photo page for friends, generally do not fall under the DDG's legal notice requirement because they are not operated on a business basis. The line is crossed quickly, though: banner ads, affiliate links, sponsored posts or promoting your own services can turn a seemingly private page into a business offering.

The Interstate Media Treaty (Medienstaatsvertrag) also requires the provider's name and address for offerings that do not serve exclusively personal or family purposes; for journalistic-editorial content, a responsible person is added. This can also affect blogs that regularly publish opinion-forming posts. Anyone unsure whether their own site still counts as private should have this clarified legally in the individual case. This section does not replace legal advice.

Do I need a privacy policy for my website?

As a rule, yes. Just by visiting a website, the server processes personal data such as the IP address; at the latest with a contact form, a newsletter or embedded services such as maps or videos, more is added. The GDPR obliges controllers to inform data subjects about this processing – on websites, this is done in the privacy policy.

A privacy policy states, among other things, the controller, the purposes and legal bases of processing, recipients such as hosts or analytics services, possible transfers to third countries, retention periods and the rights of data subjects, including the right to lodge a complaint with a supervisory authority. What matters is that it matches the technology actually in use. Generators help as a starting point but do not replace checking against what your website really loads.

Cookie banner and consent under the TDDDG

Under Section 25 TDDDG, information may only be stored on or read from visitors' devices if they have consented – unless it is strictly necessary for the service they expressly requested. This mainly affects analytics and marketing tools, embedded videos, maps or social media plugins. Technically necessary cookies, for example for a shopping cart or the language setting, do not need consent.

A consent banner must offer genuine choice: in the view of the data protection supervisory authorities, declining should be as easy as agreeing, and services requiring consent may only be loaded afterward. A common mistake in practice: the banner is visible, but fonts, maps or tracking already load in the background beforehand. A technical check shows whether your banner really works.

Which websites have to be accessible?

The German Accessibility Strengthening Act (BFSG) has applied since June 28, 2025. It covers, among other things, e-commerce services for consumers – above all online stores and websites through which consumers conclude contracts, such as bookings. Microenterprises that offer services are exempt; these are companies with fewer than ten employees and annual turnover or an annual balance sheet total of no more than €2 million.

Purely informational websites without contract conclusion are, in the widespread view, not covered by the BFSG; public bodies are subject to their own requirements under the BITV 2.0. Regardless of obligation, accessibility pays off: readable contrasts, alternative texts and keyboard operation help all visitors. Whether your offering falls under the BFSG, you should have checked legally in the individual case.

Further obligations: store, newsletter, images and encryption

Anyone selling to consumers additionally needs, among other things, a withdrawal notice with a model withdrawal form, correct price information and a clearly labeled order button. For newsletters, the double opt-in procedure has become established, which lets you prove consent. The link to the EU online dispute resolution platform that was formerly required lapsed when the platform was shut down in July 2025 – old notices should be reviewed.

For images, texts, fonts and videos you need the necessary usage rights; an image from a Google search is not automatically free to use. Forms should be transmitted exclusively over an encrypted HTTPS connection, and you conclude data processing agreements with your host and other service providers. Violations of such obligations can result in warning letters (Abmahnungen) from competitors or associations.

Checking your website for legal compliance: what specialists and technology contribute

Making a website legally compliant is teamwork. The legal assessment – for example which details belong in your legal notice or whether the BFSG applies – is the job of attorneys or data protection officers. An agency can review the technical side: which cookies are set, which external connections does the page open, and does anything load before consent?

We support you with this technical review and implementation: hosting fonts locally, placing services behind the consent banner, securing forms, improving accessibility and linking legal texts cleanly. The content of the legal texts comes from you, your attorney or a specialized legal-text service. If you wish, we coordinate directly with your attorney or data protection officer. This page gives a general overview and does not replace legal advice.