Website Legal Requirements in Germany: Imprint, Privacy Information and Cookie Consent

What does a company website in Germany have to show?

A company website in Germany has to deal with three sets of rules, listed in the table below. The third one covers storing and reading information on a visitor’s device, which is what cookies do. Other laws can add duties, and § 5 (2) DDG says so expressly.

This guide explains what each text says in plain English. It does not review court decisions and does not replace advice. The German wording of the laws is authoritative, and the English here is Digital030’s own working translation.

What must the imprint (Impressum) contain under § 5 DDG?

Section 5 (1) DDG lists the information a provider has to keep available for business-like digital services that are normally offered for payment. The information has to be easy to recognise, directly reachable and permanently available. This is the paragraph usually cited for the German imprint.

The details § 5 (1) DDG lists

• Your name and the address at which you are established. For legal entities, also the legal form and the authorised representative. If you state capital figures, the share or basic capital, and the total of outstanding contributions where not everything has been paid in.
• Details that allow fast electronic contact and direct communication, including the email address.
• The competent supervisory authority, if the service is offered as part of an activity that needs official permission.
• The commercial register or similar register you are entered in, and the registration number.
• For regulated professions within the meaning of the directives the paragraph names, the chamber you belong to, the statutory professional title and the state in which it was granted, and the professional rules that apply, with a note on how to access them.
• Your VAT identification number or your economic identification number, if you have one.
• For stock corporations, partnerships limited by shares and limited liability companies that are in winding up or liquidation, a statement to that effect.
• For providers of audiovisual media services, the member state and the competent regulators.

The paragraph does not prescribe a layout or an order. It asks that the details are easy to recognise, directly reachable and permanently available. A link in the footer of every page is the usual way to meet that wording. The text does not mention a number of clicks, and it names the email address but no telephone number. Court decisions may exist on points like these, and this guide has not reviewed case law, so a lawyer should confirm your setup.

Whether a site falls under § 5 depends on the opening words, business-like digital services normally offered for payment. If your site presents a business that sells products or services, plan on having an imprint. Borderline cases, for example purely private pages, are for a lawyer to judge. You can see what a German company imprint looks like on Digital030’s own imprint page (German).

What does the privacy information have to say under GDPR Article 13?

Article 13 applies where personal data are collected from the person themselves, for example through a contact form. The controller has to provide the listed information at the time the data are obtained. Article 12 (1) adds that the information must be concise, transparent, intelligible and easily accessible, in clear and plain language. The page that carries it is usually called a privacy policy, in German Datenschutzerklärung.

Article 13 (1) and (2) list the following points.

• Who is responsible, with contact details, and the contact details of the data protection officer where there is one.
• The purposes of each processing activity and its legal basis. Where the basis is legitimate interests under Article 6 (1) (f), the interests pursued.
• The recipients or categories of recipients, if any.
• Any intended transfer to a country outside the EU or to an international organisation, with the safeguards relied on.
• How long the data are stored, or the criteria used to decide that.
• The rights to access, rectification, erasure, restriction of processing, objection and data portability.
• The right to withdraw consent at any time, where consent is the basis.
• The right to lodge a complaint with a supervisory authority.
• Whether providing the data is a statutory or contractual requirement, and what follows if someone does not provide it.
• The existence of automated decision-making, including profiling, where it applies.

Article 13 (4) says these duties do not apply where and as far as the person already has the information. Article 6 (1) lists six legal bases for processing. They include consent, the performance of a contract or steps taken at the person’s request before a contract, a legal obligation, and legitimate interests unless the person’s interests or rights override them. Choosing the right basis for each purpose is a legal decision, and the privacy information has to name it.

Copying a generic privacy policy is risky, because Article 13 asks about your own purposes, recipients and storage periods. List every form, tool and embedded service on your site, describe each one, and have a lawyer or data protection officer review the result.

When do cookies and similar technology need consent under § 25 TDDDG?

Storing information on a visitor’s device, or reading information that is already stored there, is only allowed if the visitor has consented on the basis of clear and comprehensive information. That is the rule in § 25 (1) TDDDG, which also says that the information and the consent must follow the GDPR. Section 25 (2) names two exceptions. The first applies where the only purpose is carrying out the transmission of a message over a public telecommunications network. The second applies where the storage or access is strictly necessary so that the provider of a digital service can deliver a service the user has expressly requested.

The law was called TTDSG until 14 May 2024, when it was renamed TDDDG. You will still see the old name in older articles and in the web address of the official text. The German data protection authorities, working together as the Data Protection Conference (DSK), state in their November 2024 guidance that the new § 25 matches the old one in content.

What the supervisory authorities say

The DSK guidance for providers of digital services, version 1.2 of November 2024, is not law. It shows how the authorities read the text, and it says the following in summary.

• Section 25 applies whether or not the information is personal data. It is technology-neutral and covers cookies and also other techniques, such as web storage objects and fingerprinting that reads properties of the device.
• Not every cookie needs consent. A banner should only be used where consent is actually needed, because otherwise visitors get the wrong impression that they have a choice.
• The authorities do not state that reach measurement is generally allowed without consent. They add that even simple visitor counting is not automatically part of the basic service, because that depends on the purpose it serves and on the configuration.
• While a banner is shown, scripts that may access the device or process personal data, and content from third-party servers, should not load as far as consent is needed for them. The banner must not block access to the imprint and the privacy information.
• Options in a banner must not be pre-set to active. Withdrawing consent must be as easy as giving it, which GDPR Article 7 (3) also says.
• A refuse option on the first level of the banner is not required in every design. It is needed where visitors have to interact with the banner to continue, and the authorities say that this condition is very often met in common designs.

The GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person’s wishes, by a statement or a clear affirmative action (Article 4 (11)). Recital 32 adds that silence, pre-ticked boxes or inactivity should not constitute consent. Article 7 (1) requires the controller to be able to demonstrate that consent was given.

Which tools need consent depends on what they store and read. Ask whoever built the site for a list of all cookies and scripts, and decide tool by tool whether an exception in § 25 (2) applies.

How do contact forms and newsletter sign-ups fit in?

A contact form collects personal data directly from the person, so Article 13 applies. Show the privacy information at the point of collection, for example as a short note with a link beside the submit button. Ask only for what you need. Article 5 (1) (c) requires personal data to be adequate, relevant and limited to what is necessary for the purposes.

A newsletter checkbox is a consent request. Article 7 (2) says that a consent request inside a wider declaration must be clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Recital 32 rules out pre-ticked boxes. Article 7 (4) says that, when assessing whether consent is freely given, utmost account is taken of whether a service depends on consent to processing that is not necessary for it. Keep the newsletter box separate from the contact request and leave it unticked.

Sending marketing emails afterwards is a separate question under § 7 UWG. It needs the addressee’s prior express consent unless the narrow exception for existing customers applies. Our guide to cold email in Germany walks through that text.

What changes if your company is based outside Germany?

The texts use two triggers, where the provider is established and who the service is offered to. For a company outside Germany the answer can differ from rule to rule. The following points stay close to the wording.

• Section 5 DDG asks for the address at which you are established. It does not ask for a German address.
• Section 3 (1) DDG says that providers established in Germany remain subject to German law when they offer digital services in another EU member state, as far as the EU Digital Services Act does not apply directly. Section 3 (2) says that the free movement of digital services offered in Germany by providers established in another member state is not restricted, subject to paragraphs 5 to 7. Section 3 (3) no. 4 leaves the law on the protection of personal data unaffected. Section 3 (4) no. 3 takes the admissibility of unsolicited commercial communications by email out of paragraphs 1 and 2.
• Section 1 (3) TDDDG says that the act applies to all companies and persons that have an establishment in its area of application, or provide services or contribute to them, or make goods available on the market.
• GDPR Article 3 (2) applies the regulation to controllers that are not established in the Union where the processing relates to offering goods or services to people in the Union, or to monitoring their behaviour in the Union. Article 27 then requires a written designation of a representative in the Union, with exceptions listed in paragraph 2.

No text answers in one place which rules apply to your website. A lawyer who knows both your home country and German law can. Writing the imprint and the privacy information in the language of your visitors is the safer choice, since Article 12 (1) asks for intelligible information in clear and plain language.

A legal checklist for your website before launch

1. Write an imprint that covers every item of § 5 (1) DDG that applies to you.
2. Link the imprint from the footer of every page so that it is easy to recognise and always available.
3. List every form, script, plugin and embedded service on the site.
4. Write privacy information that covers the Article 13 points for each of them, in clear and plain language.
5. Link the privacy information from every page and next to every form.
6. Check for each tool whether it stores or reads information on the visitor’s device, and whether an exception in § 25 (2) TDDDG applies.
7. If consent is needed, use a banner that holds back the scripts until the visitor decides, with no pre-set options and an easy way to withdraw.
8. Keep the newsletter box unticked and separate from the contact request.
9. Record what consent was given, when, and on which wording (Article 7 (1)).
10. If you are based outside Germany, ask a lawyer how §§ 3 and 5 DDG, § 1 (3) TDDDG and GDPR Articles 3 and 27 apply to you.
11. Check whether other laws add duties for your sector. Section 5 (2) DDG leaves them unaffected.
12. Review the whole set whenever you add a tool or change a form.

If you want a website that gives these pages a clear place in the design, see our web design service in Berlin. We do not give legal advice, so the text of the pages should come from a lawyer or a data protection officer. Founders can use the same list as part of our marketing checklist for new businesses.

Frequently asked questions

Sources

• DDG § 5 Allgemeine Informationspflichten (official German text): Imprint duties. The German text is authoritative (accessed 2026-10-19)
• Digitale-Dienste-Gesetz (DDG), full text: § 3 on the country-of-origin principle. The page records an amendment of 12 May 2026 that its documentation had not yet fully processed (accessed 2026-10-19)
• TDDDG § 25 Schutz der Privatsphäre bei Endeinrichtungen (official German text): Consent for storing and reading information on devices. The web address still carries the former abbreviation TTDSG (accessed 2026-10-19)
• Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), full text: § 1 (3) on the scope and the renaming of 14 May 2024 (accessed 2026-10-19)
• Regulation (EU) 2016/679 (GDPR), Official Journal L 119, 4.5.2016, English text: Articles 3, 4, 5, 6, 7, 12, 13 and 27 and recital 32, read in the copy hosted by the Polish data protection authority UODO. The official publication is on EUR-Lex (accessed 2026-10-19)
• Data Protection Conference (DSK), guidance for providers of digital services (OH Digitale Dienste), version 1.2, November 2024: How the German supervisory authorities read § 25 TDDDG and consent banners. Guidance, not law (accessed 2026-10-19)

General information as of 19 October 2026, not legal advice. Laws change. The German versions of the laws are authoritative, and the English wording here is a working translation by Digital030. Check your own case with a lawyer or the competent authority.