Website legal requirements in Germany: legal notice, privacy, cookies & accessibility
Ajdin PodrinjaFounder of Grow · 7 years in marketing and webPublished 4 Aug 2026Updated 20 Oct 2026
What legal information does a business website in Germany need? Legal notice under § 5 DDG, GDPR privacy policy, cookie consent under § 25 TDDDG and the Accessibility Act — explained in plain English.
In Germany a website is not just marketing — it is a regulated space. Anyone operating a site for business purposes must provide certain information, and forgetting it can lead to formal warning letters (Abmahnungen) from competitors or associations. The good news: the key obligations are manageable and can be handled cleanly when the site is built.
1. Legal notice (Impressum) under § 5 DDG
Since May 2024 the legal notice requirement has been part of the Digital Services Act (Digitale-Dienste-Gesetz, DDG), replacing the former Telemedia Act (TMG). The content barely changed. Business websites must provide the following information in a way that is easy to find, directly accessible and permanently available:
- Full name or company name, including legal form and authorised representatives
- A postal address for service of documents — a PO box is not enough
- Email address and another fast way to get in touch (in practice usually a phone number)
- Commercial register entry with registration number, if applicable
- VAT identification number, if applicable
- For regulated professions (doctors, lawyers, architects): professional body, title and applicable rules
Common mistakes: the legal notice is three clicks away, hidden in the mobile menu or behind a vague label such as “Info”. The link should say “Impressum” and appear in the footer of every page. Also note: the link to the EU online dispute resolution platform is no longer required since July 2025, because the platform was shut down — remove old references.
2. Privacy policy under the GDPR
As soon as your website processes personal data — and practically every site does, if only through IP addresses in server logs — you need a privacy policy under Art. 13 GDPR. It must explain which data is processed for what purpose and on what legal basis, how long it is stored and which rights visitors have.
- The controller and contact details
- Every tool in use, individually: hosting, contact form, analytics, maps, videos, newsletter
- Legal bases (consent, contract, legitimate interest)
- Recipients and any transfer to third countries (e.g. the US)
- Retention periods and data subject rights, including the right to complain to a supervisory authority
What matters is that it matches the technology: a privacy policy that doesn't mention Google Analytics while it is installed is just as much a problem as having none. You also need a data processing agreement (DPA) with your service providers (hosting, newsletter, agency with access).
3. Cookie consent under § 25 TDDDG
The former TTDSG was renamed TDDDG in May 2024. Section 25 states that information may only be stored on or read from a device with consent, unless it is strictly necessary. In practice:
- Load analytics, marketing and tracking cookies only after active consent
- “Reject” must be as easy as “Accept” — equal buttons on the first layer
- No pre-ticked boxes
- Consent must be revocable at any time, e.g. via a link in the footer
- Host Google Fonts locally instead of loading them from Google's servers — otherwise the IP address is transferred without consent
A banner that only offers “OK”, or still loads tracking after “Reject”, is not only legally risky — it also distorts your statistics.
4. Accessibility (BFSG) since 28 June 2025
Since 28 June 2025, the German Accessibility Strengthening Act (BFSG) requires providers of certain products and services to be accessible — including e-commerce services, i.e. mainly online shops and booking flows aimed at consumers. Micro-enterprises with fewer than ten employees and annual turnover of no more than €2 million are exempt for services.
Even if your purely informational website isn't covered: good contrast, alt text for images, a logical heading structure and keyboard navigation help every visitor — and Google. We build these basics in by default.
5. Other obligations depending on your site
- Online shops: withdrawal notice, terms and conditions, prices incl. VAT and shipping, the “button solution” — more in our online shop guide
- Newsletters: double opt-in and an unsubscribe link in every email
- Editorial content (blog, magazine): additionally a person responsible under § 18(2) MStV
- Companies with more than ten employees: statement on participation in consumer dispute resolution (VSBG)
- SSL encryption (HTTPS) — effectively mandatory as soon as you have forms
Pre-launch checklist
| Item | Done when … |
|---|---|
| Legal notice | One click from every page, complete, with postal address |
| Privacy policy | Every tool on the site is described, up to date |
| Cookie banner | Reject is equal to accept, tracking only after consent |
| Fonts & maps | Hosted locally or loaded only after a click |
| Forms | HTTPS, only necessary required fields, privacy notice |
| Accessibility | Contrast, alt text and keyboard navigation checked |
- Do small businesses need a legal notice?
- Yes. The requirement applies to all business websites, regardless of turnover or legal form. Only purely private sites are exempt.
- Is a free privacy policy generator enough?
- For simple websites it often is, provided you fill it in carefully and update it with every technical change. For shops or complex tracking setups we recommend a legal review.
- Are legal pages included in your packages?
- Yes. Every website we build ships with a legal notice, privacy policy and a cookie banner with real choice, hosted in Frankfurt. Details on our pricing page.
