In many projects the imprint and the privacy policy are produced on the last day: a quick template, a link in the footer, done. That is precisely where the complaints come from that cost money and patience later on. The requirements are manageable once they have been sorted out: the German Digital Services Act determines who stands behind an online offering, the General Data Protection Regulation governs what happens to visitor data, and the German Civil Code sets out how consumers must be informed about their right of withdrawal. This guide orders the mandatory details, shows what each legal form adds, and names the error patterns that typically get noticed first. It does not replace legal advice in an individual case.
Legal pages belong to the website, not to its appendix
Legal pages are often treated as a formality to be handled quickly at the end of a project. In reality they are tied to the website more closely than almost any other content: the privacy policy describes the functions that actually run on the site, the imprint names the provider behind the domain, and both have to be reachable from every subpage. As soon as the website changes, the text changes with it. Adding a contact form means processing names and email addresses from that moment on. Publishing a second language version means the mandatory details are needed there as well. Moving the registered office or changing the legal form means updating the imprint before the first invoice with the new address goes out. Legal pages therefore belong in the same maintenance routine as content, technology and design. Anyone who has a website created with AI support should make sure the mandatory pages come from the same data source as the rest of the site structure. Otherwise a second, disconnected body of text grows alongside it and drifts away from reality over the months without anyone noticing.
The legal basis for provider identification has shifted recently. Since 2024 (Federal Law Gazette, German Digital Services Act of 6 May 2024) the obligation no longer sits in the Telemedia Act but in section 5 of the German Digital Services Act, abbreviated DDG. The catalogue of details was carried over almost unchanged, the reference was not: anyone still citing section 5 TMG in the footer is invoking a provision that no longer exists in that form. On its own this is rarely the core of a dispute, but it is a reliable indicator that the page has not been reviewed for a long time. A missing or incomplete provider identification is also a regulatory offence; the fine can reach 50,000 euros (German Digital Services Act, provisions on regulatory fines). In practice, however, the fine is not the most frequent risk. Letters from competitors or associations demanding a cease and desist are far more common, as are follow-up questions from supervisory authorities that take an incomplete privacy policy as a reason for closer inspection.
This article does not replace legal advice
Provider identification under section 5 DDG
The obligation applies to providers of commercial digital services that are usually offered for payment. That is broader than many assume: what matters is not whether something is sold on the website, but whether the site serves a business purpose. A trade business with a single page of services, a restaurant with a menu, a law firm with a contact page and an association that collects membership fees are all covered. Purely private or family offerings without any business connection are excluded. The details must be easily recognisable, directly accessible and permanently available. Those three terms are not a flourish, they are the actual test: easily recognisable means a label that visitors can place without thinking. Directly accessible means a short, reliable route without detours. Permanently available means the page is not missing part of the time, for example because a script loads it late or because it was forgotten in one language version.
- Name and address of the provider, and for legal entities the legal form and the authorised representatives as well. A PO box is not sufficient; an address at which documents can be served is required.
- Details that allow rapid electronic contact and direct communication, including at least an email address.
- The competent supervisory authority, where the activity requires official authorisation.
- Register and registration number, where an entry exists: commercial, association, partnership, cooperative or company register, together with the registering court.
- For regulated professions the chamber, the statutory professional title, the state in which it was granted, the professional rules and a note on how they can be accessed.
- VAT identification number or business identification number, where one exists. The tax number issued by the tax office does not belong here.
- For stock corporations, partnerships limited by shares and limited liability companies in liquidation, a corresponding note.
- For journalistic and editorial offerings, an additional responsible person with name and address under section 18 paragraph 2 of the Interstate Media Treaty.
One point causes recurring debate: the telephone number. Section 5 DDG requires details that allow rapid electronic contact and direct communication, and expressly names only the email address. The Court of Justice of the European Union has ruled that a second route for direct and effective communication must exist alongside the email address, but that it need not be a telephone line (Court of Justice of the European Union, case C-298/07). An electronic enquiry form can be sufficient provided replies typically arrive within 30 to 60 minutes (Court of Justice of the European Union, case C-298/07); anyone unable to sustain that response time should name a further route such as a phone number or a callback offer. In practice this means a contact form with proper enquiry handling is more than a sales channel, it forms part of meeting a statutory information duty. If you rarely take calls, keep an eye on your own response times and publish a number when in doubt.
What each legal form adds
The basic catalogue applies to everyone, the details differ by legal form. The most frequent gaps appear where a detail is self-evident to the business and is therefore left out of the text: the sole trader names the trading style but not the personal name. The civil law partnership names one partner although all of them have to be listed. The limited liability company names the firm but not its managing directors. Since 1 January 2024 a civil law partnership can also be entered in the company register and then carries the suffix eGbR; where such an entry exists, register and registration number belong in the imprint. A second classic is the confusion between tax number and VAT identification number: the imprint takes the VAT identification number, where one exists. The tax number issued by the tax office has no place there and should not be published, if only to reduce the risk of misuse.
| Legal form | Additionally required | Common gap |
|---|---|---|
| Sole trader without register entry | first and last name, address for service, contact route | trading style only, personal name omitted |
| Registered merchant (e. K.) | firm with legal form suffix, commercial register, court, number | legal form suffix dropped in the footer |
| Civil law partnership (GbR) | all partners by name, company register for a registered eGbR | only one authorised partner named |
| GmbH and UG (limited liability) | managing directors, commercial register, court, number | managing director missing or outdated |
| Stock corporation (AG) | management board, chair of the supervisory board, register | chair of the supervisory board not named |
| Registered association (e. V.) | board under section 26 Civil Code, register and number | board not updated after an election |
| Regulated profession | chamber, professional title, granting state, professional rules | professional rules not made accessible |
Chambers and official authorisations
Easily recognisable, directly accessible, permanently available
How short the route to the imprint has to be was settled early by the Federal Court of Justice: reachability through two references, in the decided case through the labels contact and imprint, satisfies the requirement of direct accessibility (Federal Court of Justice, judgment of 20 July 2006, I ZR 228/03). What matters is less the number of clicks than the clarity of the label. Terms such as backstage, info or service are risky because visitors do not expect provider identification behind them. The plain pairing of imprint and privacy policy in the footer of every page has proven itself, extended by a withdrawal notice where contracts are concluded online. It is equally important that these references can actually be operated. A link that cannot be focused with the keyboard or that sits in insufficient contrast is not permanently available in practice. The requirements from the European Accessibility Act and WCAG 2.2 AA and the requirement of easy recognisability point in the same direction here.
- Imprint and privacy policy are reachable from the footer of every page, including blog posts and error pages.
- The labels read imprint and privacy policy, not info, legal or service.
- The pages are delivered with the site rather than being loaded later by a script.
- Each language version has its own legal pages under its own address, referenced in the hreflang annotations.
- The links can be reached with the keyboard, have a visible focus indicator and sufficient contrast.
- The pages are indexable and not set to noindex by accident, so that they remain findable through search as well.
- After a rebuild, the old addresses of the legal pages redirect to the new ones.
The privacy policy describes what actually happens
Article 13 GDPR requires the data subject to be informed at the time of collection, in a concise, transparent, intelligible and easily accessible form, using clear and plain language (Article 12 GDPR). The privacy policy is therefore not a legal package insert but a description of actual operations. This is exactly where template texts fail: they describe an average case that has little to do with the specific website. A text listing map services, video embeds and audience measurement while the site uses none of them is as inaccurate as one that omits the contact form in use. Both stand out during a review, and both can be established with a glance at the source code. Anyone who wants to know which processing operations require consent in the first place and which do not will find the logic in the article on GDPR and consent on the website. The privacy policy then describes what remains after that assessment.
Controller
Name, address and contact route of the body that decides on purposes and means, extended by the data protection officer where one is appointed.
Purposes and legal bases
For each processing operation the purpose and the legal basis; where it rests on a legitimate interest, that interest has to be named specifically.
Recipients and third countries
Who receives data, for example hosting or shipping, and whether any transfer takes place outside the EU, each with its basis.
Retention period
The storage period or, where that is not possible, the criteria used to determine it, such as statutory retention obligations.
Data subject rights
Access, rectification, erasure, restriction, objection and portability, each with a workable route for exercising the right.
Withdrawal and complaint
The note that consent can be withdrawn at any time and that a complaint can be lodged with a supervisory authority.
Two further points are regularly overlooked. First, language: a website addressing an international audience needs the mandatory details in every language version it delivers. An English home page with a privacy policy available only in German meets the requirement of easy accessibility only to a limited degree. How language versions are separated cleanly and marked up through hreflang and translated addresses therefore also determines whether the legal texts reach their audience. Second, currency: processing operations change as functions are added. A new newsletter, an application form, a booking calendar or an assistant on the site all change the data flows. Without a fixed routine the text stays at the state of the launch day. A short review with every functional change plus a full review once a year, documented with date and reason, works well in practice.
Keep the version date visible
Withdrawal notice for online offerings
As soon as contracts with consumers are concluded through the website, the right of withdrawal comes into play. For distance contracts consumers have a right of withdrawal under section 312g paragraph 1 of the German Civil Code; the period is 14 days (section 355 paragraph 2 Civil Code) and starts, depending on the type of contract, with the conclusion of the contract or with receipt of the goods. Consumers have to be informed about this right before the contract is concluded, using the details set out in Article 246a of the Introductory Act to the Civil Code; official model texts for the notice and the withdrawal form are annexed to that provision. If the notice is missing or defective, the period is extended considerably: the right of withdrawal then expires no later than 12 months and 14 days (section 356 paragraph 3 Civil Code) after the regular start of the period. For a shop, a booking process or a digital subscription this is the single most expensive mistake in this field. Which building blocks a website needs depends on the sales channel; the overview of services shows what is included.
- Purely informational sites without an ordering option usually need no withdrawal notice; what matters is whether a contract can be concluded online.
- Contracts between businesses are not covered by the consumer right of withdrawal; anyone serving both audiences should separate the ordering process accordingly.
- Section 312g paragraph 2 Civil Code lists exceptions, for example goods made to customer specification or sealed goods unsealed for reasons of hygiene.
- For services that are to begin before the period expires, an express request by the consumer and a note about the expiry of the right of withdrawal are required.
- For continuing obligations that can be entered into online, section 312k Civil Code additionally requires a clearly labelled cancellation button.
- The notice does not only belong on a page of its own: it has to be brought to the consumer's attention before the order is placed and confirmed in text form afterwards.
{
"domain": "your-domain.com",
"languages": ["de", "en"],
"legal_pages": {
"imprint": {
"path": { "de": "/impressum/", "en": "/imprint/" },
"legal_form": "GmbH",
"representatives": ["First Last"],
"register": { "court": "Local court, sample city", "number": "HRB 000000" },
"vat_id": "DE000000000"
},
"privacy": {
"path": { "de": "/datenschutz/", "en": "/privacy/" },
"as_of": "2026-07-26",
"processing": ["contact_form", "server_logs", "consent_store"]
},
"withdrawal": {
"active": false,
"reason": "no contract is concluded through the website"
}
},
"footer": ["imprint", "privacy"]
}Typical warning-letter risks and how they arise
Warning letters over missing mandatory details are a well-established business, although the cost risk has shifted. Since the reform of the German Act against Unfair Competition in 2020, competitors can no longer claim reimbursement of their costs for breaches of information and labelling duties on the internet (section 13 paragraph 4 number 1 UWG); for a first warning letter to smaller businesses, agreeing a contractual penalty is also excluded (section 13a paragraph 2 UWG). The claim for injunctive relief itself remains, however, and once a cease and desist declaration has been signed, every repetition becomes expensive. There is a technical aspect on top of that: rebuilding a website after several years often moves the addresses of the legal pages as well. If the old addresses lead nowhere, the mandatory details are no longer reachable for everyone who saved an old link. How to avoid that is described in the article on a relaunch without ranking loss; the redirects described there are not a bonus for search engines here, they are part of accessibility.
| Error pattern | Why it stands out | Remedy |
|---|---|---|
| Reference to section 5 TMG | the provision was replaced in 2024 | cite section 5 DDG instead |
| Legal form or representative missing | a register check takes seconds | copy the details from the register extract |
| Privacy policy names unused services | the source code shows what really loads | align the text with actual operations |
| Imprint only on the home page | opening any subpage is proof enough | place the reference in the footer of every page |
| Legal pages missing in the second language | the language switch leads back to German | one page per language with its own address |
| PO box instead of a street address | service of documents is not possible | state the full address including house number |
| Dead reference to the dispute platform | the target was shut down in July 2025 | remove the reference, review the VSBG note |
The old standard sentence on dispute resolution is obsolete
Creating legal pages per domain and keeping them consistent
The organisational core of the topic is not the one-off creation but consistency over time. XICflow therefore creates imprint and privacy policy automatically per domain as page types of their own, in every active language and with a separate address per language version. The drafts are derived from the details of the business and from the functions actually switched on: if a contact form is active, the privacy policy describes its processing; if an assistant or a blog is added, the text grows with it. For online offerings a withdrawal page is available as well. The footer links are not a hand-maintained menu entry but part of the page shell, so that they are present on subpages, blog posts and error pages alike. What that flow looks like from briefing to finished site is shown in the overview of how the creation works; anyone who wants to know who stands behind the offering will find the details on the about page.
Created per domain
Imprint and privacy policy are produced for every domain and every language version, each with its own address and its own version date.
Connected to the site
The functions switched on determine the processing operations described, so that text and operations do not drift apart.
Reachable over time
The links sit in the page shell; if an address changes, the old path stays reachable through a redirect.
Automatically generated texts do not replace a professional review, they shorten it. Instead of a blank page there is a complete draft at the start that already reflects the business details, the functions in use and the language versions; the review then concentrates on what really affects operations. What the result looks like can be seen in the example sites, where footer and mandatory pages are delivered along with everything else. Which functions are included at which level is set out in the pricing overview. For ongoing maintenance a fixed rhythm works well: a short check with every functional change, a full review once a year and a note recording the state that was reviewed. That effort is modest and saves the later search for who last edited which version.