Impressum, privacy policy, cookies: legal basics for websites in Germany

First, the honest disclaimer: I'm a web designer, not a lawyer, and this isn't legal advice. For anything specific to your business, ask a lawyer or use a reputable generator for legal texts. What I can do is explain which pieces a German website usually needs and how they're built, because a lot of that is design and code, not law.

The Impressum

Almost every business website in Germany needs an Impressum, a page with your name, address, contact details and, depending on your business, things like your VAT ID, register entry or professional chamber. The legal basis is section 5 of the Digital Services Act (DDG), which replaced the old TMG in 2024. It has to be easy to find, which in practice means a link in the footer of every page.

The privacy policy

If your website processes personal data, and almost every website does, even through server logs or a contact form, you need a privacy policy under the GDPR. It explains what data you collect, why, how long you keep it and who else receives it, like your hosting provider or newsletter tool. It has to match what your site actually does. A copied policy that lists tools you don't use, or misses ones you do, isn't much help.

The easiest privacy policy to write is the one for a website that collects very little.

Cookie banners

You need consent before storing or reading anything on a visitor's device that isn't strictly necessary for the site to work. That's what the cookie banner is for. Analytics, advertising pixels and many embedded videos or maps need consent. A site that doesn't use any of those may not need a banner at all.

If you do need one, "accept" and "reject" should be equally easy. Pre-ticked boxes and a hidden reject button aren't a valid design choice, they're a legal risk.

Fonts, maps and videos

Embedding things from third-party servers sends your visitors' IP addresses to those servers. Courts in Germany have taken this seriously; in 2022 a Munich court ruled against a site that loaded Google Fonts directly from Google. The practical answer is simple: host fonts on your own server, and load maps or videos only after the visitor clicks to allow it.

Accessibility

Since 28 June 2025 the Barrierefreiheitsstärkungsgesetz (BFSG) requires many online shops and other digital services for consumers to be accessible. Very small businesses providing services are exempt, but accessibility is good practice regardless: readable contrast, proper headings, alt texts, a site you can use with a keyboard. Most of it costs little if it's built in from the start and a lot if it's added later.

How I handle this

I build sites to collect as little data as possible: self-hosted fonts, no tracking unless you need it, external content only after consent. The legal texts themselves come from you or your lawyer, and I make sure the site actually matches what they say.

The best legal page is a short one, because there was very little to declare.