Two pages are missing surprisingly often, even though they are quick to produce: the legal notice (Impressum) and the privacy policy. Both are mandatory for commercially used websites in Germany, regardless of company size. This text is a practical overview, not legal advice — when in doubt, ask a lawyer.
Legal notice: what belongs in it
Since May 2024 the provider identification is governed by section 5 of the German Digital Services Act (DDG), previously by the Telemedia Act. It usually contains:
- name and address; for companies also the legal form and the authorized representatives
- a phone number or another route for quick contact, plus the email address
- commercial register and registration number, where applicable
- the VAT identification number, where applicable
- for regulated professions: the chamber, the professional title and the country that granted it
- for editorial content: the person responsible
The legal notice has to be reachable from every page within at most two clicks — a link in the footer does that.
Privacy policy: what it has to explain
Article 13 GDPR requires you to state clearly, at the time of collection, what happens to the data. In practice that means:
- who the controller is and how to reach them
- what data is collected simply by visiting, such as server log files, and how long it is kept
- what happens to form data, why it is collected and when it is deleted
- which third-party services are embedded: hosting, fonts, maps, analytics, advertising pixels
- the rights to access, rectification, erasure, objection and complaint
Cookies and consent
Access to a user's device that is not technically necessary requires prior consent under section 25 TDDDG. That covers analytics and advertising tools, but not a shopping basket or a language setting.
A clean banner meets three conditions: refusing is as easy as accepting, nothing loads before the choice is made, and the choice can be changed later. If you only use analytics, it is worth considering doing without it entirely.
Most warning letters do not come from complicated cases, but from missing pages and embedded services nobody wrote down.
Common mistakes
- a legal notice as an image instead of text
- a generated privacy policy listing services that are not used at all — or missing the ones that are
- fonts, maps or videos loaded from third-party servers on the first visit without consent
- a contact form with no note about what the data is used for
- details never updated after a move or a change of legal form
How we do it
Every BNK Web site goes live with a legal notice and a privacy policy, fonts are served with the page instead of from a third-party server, and analytics or advertising pixels only run after explicit consent. The texts belong to you and can be changed whenever something about your company changes.