Impressum, privacy and cookies: what a German website needs.
A business website in Germany needs a few things the law asks for: an Impressum, a privacy notice, and a visitor’s yes before anything tracks them. Here’s what each one needs, what gets small businesses warning letters, and a checklist to go through. It’s a plain guide, not legal advice.
By the NeuWP team · Updated 22 October 2026 · 9 minute read
the short answer:
an Impressum, one click away
a privacy notice in plain words
no tracking before a yes
fonts from your own server
no old dispute link
photos you may use
first
Who this is for
A business based in Germany, with a website or a business profile.
In short: every business site in Germany needs an Impressum and a privacy notice, asks before it tracks anyone, and takes care with what its pages load from other companies.
The rules come from three places. The Impressum is in a German law of 2024, the Digitale-Dienste-Gesetz (DDG). The privacy notice is in the GDPR, the EU’s data protection law. Consent for cookies is in the TDDDG, a German law that was called the TTDSG until May 2024.
None of it is hard, and most of it can be checked in an afternoon. This guide says what the laws ask, with the sources at the end. It isn’t legal advice: every business is different, and laws change. For your own site, ask a lawyer, or your chamber (the IHK or the Handwerkskammer), which publish guides of their own.
who you are
The Impressum
Who is behind the site, and how to reach them.
In short: your name, address, email and register details, on a page called Impressum, linked from every page.
Since 14 May 2024, the rules are in § 5 DDG, which replaced § 5 of the old Telemediengesetz (TMG). If your Impressum still cites the TMG, change the reference to § 5 DDG.
What it needs
When
Your name, and the address where your business is based
Always
For a company: its legal form and who represents it, such as the managing director
A GmbH, UG, AG and the like
An email address, and a way to reach you quickly and directlychambers’ guides list a phone number too
Always
The register you’re in, and your number there, such as the Handelsregister and your HRB number
If you’re registered
The authority that supervises you
If your work needs a permit
Your chamber, your professional title and the country that gave it, and the rules of your profession, with where to read them
A regulated profession, such as a lawyer, an architect or a tax adviser
Your VAT ID (USt-IdNr.) or your business ID number (W-IdNr.)
If you have one
The share capital, and any part still unpaid
Only if you mention your capital at all
That the company is being wound up
A company in liquidation
1Where it goes
The law says it must be easy to recognize, directly reachable and always available. A link called “Impressum” in the footer of every page is the usual way. In 2006, the Federal Court of Justice accepted two clicks, through a page called “Kontakt” (BGH, I ZR 228/03). Courts have turned down less obvious names, such as “Backstage” or “Info”. Don’t keep it only in your terms, or only in a pop-up that needs a script.
2Your Facebook and Instagram pages too
A business profile counts as well. In 2011, a court found that a business’s Facebook page needed an Impressum (LG Aschaffenburg, 2 HK O 54/11). Give each business profile one, or a clear link to yours.
3If you publish articles like a magazine
A site with journalistic or editorial content, such as regular news or articles like a newspaper’s, must also name a person responsible for it, with their name and address (§ 18 of the Medienstaatsvertrag, MStV). Ask whether yours counts before you name someone.
4What a gap can cost
A detail that is missing, wrong or incomplete can be fined up to 50,000 euros (§ 33 DDG). The other risk is a warning letter, further down this page.
the small print
Two lines about disputes
One to take out, one to check.
1Take out the link to the EU’s dispute platform
The EU’s online dispute resolution platform (the “OS-Plattform”) closed on 20 July 2025, and the duty to link to it ended with it. If your Impressum, your terms or your shop still mention it, take that out. The link leads nowhere, and chambers warn that a leftover mention may be read as misleading.
2Check the line about consumer arbitration
One duty stays. If you sell to consumers and employ more than ten people, your website or your terms must say whether you’re willing or obliged to take part in dispute resolution before a consumer arbitration board (§ 36 VSBG). With ten people or fewer, counted on 31 December of the year before, you don’t need the line.
the Datenschutzerklärung
The privacy notice
What you do with visitors’ information, in words they can follow.
In short: say who you are, what you collect and why, who else receives it, how long you keep it, and what visitors can ask of you.
Article 13 of the GDPR lists what to tell people when you collect information from them. On a small business site, that means:
Who is responsible: your name and contact details, and your data protection officer’s, if you have one.
What you collect, and why, with the legal basis for each use: a contract, a consent, or an interest of yours, which you then name.
Who receives it: your host, your email provider, a booking tool, a newsletter service.
Whether it leaves the EU, and what protects it there.
How long you keep it, or how you decide.
What visitors can ask: to see their information, correct it, delete it, limit or object to its use, and take it with them.
That a consent can be taken back at any time, and that they can complain to a data protection authority.
Whether they have to give it, and what happens if they don’t.
Any decisions made about them automatically, if there are any.
Link it from every page, beside the Impressum, and next to every form. Write it for your own site: a generated text that names tools you don’t use, or leaves out the ones you do, is a wrong notice.
Your host handles your visitors’ information for you, so the GDPR asks for a written agreement with it (article 28). Ask your host for it.
the banner
Cookies and consent
Ask first, unless the site can’t work without it.
In short: anything a page stores on a visitor’s device, or reads from it, needs their yes first, unless it’s strictly needed for what they asked for. No tracking, no banner.
§ 25 TDDDG asks for consent before a site stores information on a visitor’s device or reads information stored there. That covers cookies and anything that works like them. The exception is what is strictly necessary to give the visitor something they asked for, such as a shopping basket.
The consent itself follows the GDPR. A box ticked in advance isn’t consent (Court of Justice of the EU, Planet49, 1 October 2019). And where a banner offers “Accept all”, a German court found in 2025 that “Reject all” belongs on its first screen too, just as easy to see (VG Hannover, as Lower Saxony’s data protection authority reported on 20 May 2025).
Check that statistics, ad pixels and embedded content really wait for the yes. A banner that asks while they already run asks too late.
If your site sets nothing beyond what it strictly needs, it doesn’t need a banner at all. For many small businesses that’s the simplest answer.
what your pages load
Google Fonts, maps and videos
Anything a page fetches from another company’s servers.
In short: keep your typefaces on your own server, and ask what every map, video and widget sends, and where.
Many websites load their typefaces from Google’s servers. When a page does, the visitor’s browser sends Google their internet address. On 20 January 2022, the Landgericht München I (3 O 17493/20) found that a site doing this without the visitor’s consent broke the GDPR. It ordered the site to stop and awarded the visitor 100 euros. The court noted that the fonts could have been kept on the site’s own server, with no connection to Google at all.
So the fix is to download the typefaces and serve them from your own server. Whoever looks after your site can do it.
The same question goes for anything else a page pulls in from another company as it opens: a map, a video, a booking widget, a chat button. Ask what each one sends, to whom, and whether it waits for the visitor’s yes.
1The letters of 2022
After the ruling, letters went out to website owners asking for money over Google Fonts. In December 2022, Berlin’s prosecutors searched the offices of a lawyer and his client on suspicion of fraud and extortion, in at least 2,418 cases where 170 euros had been asked. They said the visits behind the letters had been made by software, not by people. A letter that asks for money is not a court’s decision: have it checked before you pay.
when people write to you
Contact forms
Ask for what you need, and say what happens to it.
In short: a few fields, a secure connection, your privacy notice linked beside the button, and nobody added to a newsletter without their own yes.
Ask only what you need to answer. A name and an email or a phone number is often enough. The GDPR asks you to keep personal information to what you need (article 5).
Send it over https. The GDPR asks for security that fits the risk (article 32), and a form without it sends what people type unprotected.
Link your privacy notice next to the form, so people can read it at the moment they give you their details.
Keep the newsletter apart. Writing to you is not a yes to your newsletter. That needs its own consent.
Delete enquiries once you no longer need them, and say in the notice how long that is.
Name the service that sends the form’s emails, if it isn’t your host.
the Abmahnung
Warning letters
What they are, and what can start one.
In short: a warning letter asks you to stop something and to sign a promise. The gaps on this page can start one, and each can be fixed before anybody writes.
In Germany, a competitor, a business association or a consumer group can send a warning letter (Abmahnung) over a breach of the rules of fair competition. It asks you to stop, and to sign a promise with a penalty if it happens again. Since a ruling of the Court of Justice of the EU on 4 October 2024 (C-21/23), competitors can also go to court over a breach of the GDPR.
One rule helps small businesses. A competitor can’t make you pay for their warning over a missing detail of your Impressum or other online information, nor over a GDPR breach if you employ fewer than 250 people (§ 13 UWG). That rule is about a competitor’s costs only: associations aren’t held to it, and the thing still has to be fixed.
What can start a letter on a small business site:
An Impressum with a detail missing, or that is hard to find.
Statistics or ads that run before the visitor said yes.
Typefaces or other content loaded from another company’s servers without a basis.
A leftover link to the EU’s closed dispute platform.
A photo taken from somewhere else on the internet without a license. The photographer’s lawyer often asks for a license fee as damages, and their costs.
If a letter comes, note its deadline and don’t ignore it. Have a lawyer read it before you sign the promise or pay anything.
our side
What we do
On our own pages, and on the sites we build.
Our own pages. neuwp.com loads its typefaces from our own server, sets no cookies for its visitors and doesn’t track you, so it shows no banner. Who we are, our terms and our privacy notice are on one page, linked from every page.
The sites we build. They’re hosted on our server in the EU, with Hetzner, and backed up every night. We handle your visitors’ information as your processor, under article 28 of the GDPR, and our data processing agreement is part of every client’s agreement with us.
The words of your Impressum and your privacy notice are yours to give us, or your lawyer’s. We’re not lawyers, and we don’t give legal advice.
The free preview is a design to look at, hidden from search engines. It loads its typefaces from Google Fonts, and our privacy notice says so.
