Website for Germany: Impressum and GDPR Checklist

A website aimed at Germany needs more than German text; German law makes certain pages and behaviours mandatory. Short answer: every commercial site needs a complete Impressum (legal notice) page, a privacy policy (Datenschutzerklärung) that complies with the DSGVO (the German name for the GDPR), and prior consent for every non-essential cookie and tracking tool. If you sell online, add the wording of the order button, information about the 14 day right of withdrawal and, for subscriptions, a cancellation button. This article is a checklist, not legal advice; have the final texts approved by a lawyer who knows German law or by a reputable legal text generator.

Why is a website for Germany a separate job?

In many countries a missing legal notice or a flawed cookie banner goes unnoticed. In Germany, competitors and certain associations can send a formal warning called an Abmahnung for gaps they consider unfair competition; it usually comes with a demand to sign a cease and desist declaration and a lawyer’s bill. So a missing Impressum is not just an SEO or trust issue, it is a direct cost risk. We covered the general language setup in our multilingual website article and the steps of selling abroad in our e-export guide; this article focuses only on the legal pages and technical behaviour specific to Germany.

What must the Impressum page contain?

Since 2024 the Impressum obligation is set out in section 5 of the Digital Services Act (DDG); before that the rule lived in the TMG. Every site offered for business purposes is covered, and a company based outside Germany is not exempt, because what counts is the audience the site targets. The minimum content is:

• The full company name and legal form, and a postal address where documents can be served; a PO box is not enough.
• For legal entities, the names of the people authorised to represent the company (managing directors or board).
• An email address for quick contact plus a second direct channel, in practice a phone number.
• The commercial register the company is entered in and the registration number.
• The VAT identification number, if one exists.
• For regulated professions, the competent supervisory authority and professional chamber.

The page must be easy to find and reachable from anywhere in at most two clicks: in practice every page has a link labelled “Impressum” in the footer. Other labels such as “Legal” and an address hidden in an image are common reasons for warnings. Write the details as text; an address inside an image can neither be copied nor read by screen readers.

The rule is simple: the Impressum sits in the footer of every page, under exactly that name, reachable in at most two clicks. A missing or hidden legal notice is the easiest way to receive an Abmahnung in Germany.

A GDPR compliant privacy policy (Datenschutzerklärung)

Under Article 13 GDPR the privacy policy names the controller and explains which data is processed, for what purpose, on what legal basis, for how long, who receives it and what rights the user has. The critical point for Germany is that the text matches what the site actually does: where form data goes, which country the server is in, and which analytics and map services are loaded must each be stated. We described the Turkish equivalent in our KVKK compliant website article; both texts follow the same logic, but the German version must use DSGVO terminology in the form German users expect. A text copied from another site describes that site’s services and is usually wrong.

Cookie consent: consent first, scripts second

In Germany, storing or reading information on a device requires the user’s prior consent under section 25 TDDDG unless it is technically necessary. Technically this means Google Analytics, advertising pixels and embedded videos must not load before the user clicks “Accept”. Showing a banner is not enough; the scripts must run conditionally after the choice is made. German data protection authorities expect rejecting to be as easy as accepting: the first layer needs an equally visible “Ablehnen” (reject) button and no pre-ticked boxes. You will find a consent based analytics setup in our Google Analytics 4 setup article.

Google Fonts and external resources

In January 2022 the Munich Regional Court ordered a site owner to pay 100 euros in damages for loading Google Fonts from Google’s servers and thereby passing the visitor’s IP address on without consent; a wave of mass warning letters on that basis followed. The fix is simple: serve fonts from your own server. In Next.js, next/font does this automatically, downloading the font at build time and serving it from your own domain:

// app/layout.tsx: the font is downloaded at build time, the browser never calls Google
import { Inter } from 'next/font/google';

const inter = Inter({ subsets: ['latin', 'latin-ext'], display: 'swap' });

export default function RootLayout({ children }: { children: React.ReactNode }) {
  return (
    <html lang="de" className={inter.className}>
      <body>{children}</body>
    </html>
  );
}

The same logic applies to Google Maps, YouTube embeds and libraries loaded from external CDNs. The common solution for maps and videos is the “two click” approach: show a static preview first and load the external content only when the user clicks. It also makes the page faster; for other speed items see our website speed article.

Extra requirements when selling online to Germany

• Order button: the button in the final step must clearly state the payment obligation; the established German wording is “zahlungspflichtig bestellen”. With a vague label such as “Continue” or “Complete”, the contract may be treated as not concluded.
• Right of withdrawal: consumers must be told about the 14 day right of withdrawal and how to use it (Widerrufsbelehrung), and be given a withdrawal form.
• Prices: the price shown to consumers is the total including VAT, and shipping costs must be visible before the order.
• Subscriptions: continuing contracts concluded online require an easy to find cancellation button (Kündigungsbutton) on the site.
• Accessibility: the Accessibility Strengthening Act (BFSG), in force since June 2025, covers most e-commerce sites selling to consumers, with an exemption for micro-enterprises. The technical side is in our WCAG accessibility article.

Pre-launch checklist for Germany

• Does every page footer link to “Impressum” and “Datenschutz”?
• In the browser’s network tab, do any requests go to Google, Meta or another third party before consent? They must not.
• Is “Ablehnen” on the first layer of the cookie banner and as visible as “Akzeptieren”?
• Do fonts, icons and libraries come from your own domain?
• Does the privacy policy name every service the site actually uses?
• Has the German copy been read by a native German speaker? Machine translation is not an acceptable risk for legal texts.

Conclusion

What makes the difference on a website for Germany is not design but three basic rules: a complete Impressum reachable from everywhere, a GDPR text that describes what the site really does, and a technical setup that sends no third party request before consent. Set these up from day one and the German version launches smoothly; add them later and the script loading logic often has to be rewritten. If you want a site that works in several languages, German included, on a GDPR compliant foundation, take a look at our web development service or get a free quote.