Legal requirements for business websites in 2026

1. The Impressum under § 5 DDG

Since May 2024, the obligation to provide an Impressum (legal notice) has been governed by the Digitale-Dienste-Gesetz (DDG, Digital Services Act), which replaced the former Telemedia Act (TMG). Little has changed in substance – but references to “§ 5 TMG” are outdated and should be replaced.

Every website operated for business purposes needs an Impressum – in practice, that means virtually every company website. It must be easy to recognise, directly accessible and permanently available; in practice: reachable from every page with a single click, for example via the footer.

Typical mandatory details:

• Name or company name and legal form; for companies, the persons authorised to represent them
• A postal address where legal documents can be served – a PO box is not enough
• Details for quick contact: an email address plus another direct channel, such as a phone number or contact form
• Commercial register entry with the registry court and number, if applicable
• VAT identification number, if applicable
• For regulated professions and activities requiring a licence: chamber, professional title and the competent supervisory authority

2. The privacy policy under the GDPR (DSGVO)

As soon as your website processes personal data – and every web server already does so with IP addresses – you need a privacy policy. Under Art. 13 GDPR (known in German as DSGVO), it must explain, among other things:

• who is responsible and how to contact them,
• which data is processed, for what purpose and on what legal basis,
• which service providers receive data (hosting, email, maps, chat …) and whether data is transferred to third countries,
• how long data is stored,
• what rights visitors have – including the right to lodge a complaint with a supervisory authority.

Important: the policy must match your website. A generator text that lists services you don’t use – or omits services that are embedded – is a common mistake.

3. Cookies and consent under § 25 TDDDG

Anything that isn’t strictly technically necessary – analytics, marketing, embedded videos, external chat tools – may only be loaded after active consent. This is set out in § 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), Germany’s data protection law for telecommunications and digital services.

• No optional scripts may run before consent is given.
• “Reject” must be as easy as “Accept” – no hidden links.
• It must be possible to change the selection at any time.

4. Accessibility under the BFSG

Since 28 June 2025, the Barrierefreiheitsstärkungsgesetz (BFSG, Germany’s Accessibility Strengthening Act, implementing the European Accessibility Act) has been in force. It mainly affects e-commerce services for consumers – for example online shops and websites through which consumers buy services or enter into contracts.

• Exemption: micro-enterprises providing services – fewer than 10 employees and no more than €2 million in annual turnover or annual balance sheet total.
• Purely informational websites with no sales or contract functionality are, according to the prevailing view, not covered.
• Violations can lead to orders from market surveillance authorities and fines of up to €100,000, as well as Abmahnungen from competitors.

Even if your business is exempt: good contrast, legible font sizes, alt text for images and keyboard navigation help every visitor – and Google too.

5. Other points that are often forgotten

• Encryption (HTTPS): mandatory as soon as forms transmit data – effectively standard today.
• Contact forms: only ask for the fields you really need, and describe them in the privacy policy.
• Images and copy: only use them if you hold the usage rights. Even photos “just quickly copied” can become expensive.
• Online shops: additionally need terms and conditions (AGB), cancellation policy, prices including VAT and shipping costs, and a correctly labelled order button (“zahlungspflichtig bestellen” – “order with obligation to pay”).

Checklist to tick off

• Impressum reachable from every page with one click, with a reference to § 5 DDG
• Full address, email and a second contact channel in the Impressum
• Privacy policy that exactly matches the services in use
• Cookie banner with an equally prominent “Reject” option, no scripts before consent
• Fonts and libraries served locally instead of from third-party servers
• HTTPS on all pages
• BFSG checked: does it apply, or are you exempt?

Conclusion

Covering the legal basics isn’t rocket science if it’s built in from the start. On every website we build, locally hosted fonts, genuine cookie consent and a clean structure for legal texts are standard. If you’re unsure whether your current website meets these requirements, we’ll be happy to take a look during a free initial consultation.

Frequently asked questions

Is an Impressum generator enough?+

For the basic structure, yes – but the details must be complete, correct and specific to your business, for example regarding chambers or register entries.

Do I need a cookie banner if I don’t set any cookies?+

If only strictly necessary technical functions are used, no consent is required. As soon as analytics, maps, videos or external services are loaded, it is.

Does the BFSG apply to my business website?+

If consumers buy services or enter into contracts through your website and your company isn’t exempt as a micro-enterprise, very likely. Purely informational websites are generally not covered.