Legal notice and privacy policy for German websites

This is not legal advice, but an overview of what is required for almost every commercial website in Germany. If in doubt, ask a lawyer or your chamber of crafts or commerce.

Legal notice (Impressum)

The obligation comes from § 5 of the German Digital Services Act (DDG). For a sole trader it includes:

• First and last name, for companies the company name and legal form.
• An address where documents can be served, meaning street and house number. A PO box is not enough.
• An email address and another quick way to get in touch, usually a phone number.
• If applicable: VAT identification number, commercial register and registration number.
• For trades that require a master craftsman qualification: the responsible chamber and the professional title.

The legal notice must be reachable from every page with no more than two clicks. A missing or incomplete legal notice can lead to a formal warning letter (Abmahnung).

Privacy policy

The General Data Protection Regulation (GDPR, Article 13) requires you to inform visitors about which data is processed. This always includes your host's server log files and, depending on the site, the contact form, embedded maps, videos, fonts from third-party servers and tracking. The policy has to match what the site actually does. A template from the internet that mentions Google Analytics although you do not use it is just as wrong as one that leaves it out although you do.

Cookie banner

A banner is only needed if the site sets cookies or uses similar techniques that are not strictly necessary (§ 25 TDDDG). Tracking, advertising networks and many embeds fall into this category. A site without such services does not need a banner. Fewer third parties means fewer banners and less risk.

What I do on every website

A legal notice and privacy policy are included in every package, tailored to how the site is actually built. I do not install tracking services, the fonts are on the site's own server, and a cookie banner is only added if you really include a service that needs one.

Contact form

A contact form processes personal data. The privacy policy must state which fields are collected, for what purpose, how long the data is kept and on what legal basis. A note at the form with a link to the privacy policy is common practice.

External services

Google Maps, YouTube, Google Fonts loaded from Google's servers, social media buttons: each of these services transfers visitor data to a third party. This usually requires consent, meaning a banner, and a section in the privacy policy. If you leave these services out or host them locally, you avoid that.

Frequently asked questions

Is an Impressum generator enough?

As a starting point, yes, if you fill in all fields honestly. Still check the result against the list above.

Do I need a legal notice as a small business?

Yes. The obligation applies to every commercial website, regardless of size or turnover.

What happens if I make a mistake?

Missing details can lead to a warning letter costing anywhere from a few hundred to a few thousand euros. Half an hour of work avoids the risk.