Mandatory pages: reachable, complete, current

What this is about

Four pages that German law requires or expects of most business websites: the imprint (Impressum), the privacy policy, the accessibility statement and — depending on the business model — terms and conditions (AGB).

What gets checked is not only whether they exist. But also: how you find them, whether they actually contain the required details, and whether they refer to laws that no longer exist.

Why it matters

For the imprint, the requirement is in § 5 DDG. Until May 2024 the law was called Telemediengesetz (TMG) and was then renamed Digitale-Dienste-Gesetz. That is more than cosmetics: an imprint that still cites “§ 5 TMG” refers to a provision that no longer exists. The same goes for the TTDSG, which became the TDDDG in the same month, and for the umbrella term “Telemedien”.

The legal text requires the imprint to be easily recognisable and directly reachable. That is a requirement on findability, not only on existence. A page you only find by guessing its address does not meet it — even if its content is perfect. In practice that means: a link clearly labelled “Impressum”, reachable in at most two clicks from every page. “Legal”, “Rechtliches” or “About us” are not enough as a label.

In terms of content, § 5 DDG requires: the full name, an address for service of legal documents, an electronic contact route and a second fast contact route, plus the register entry and VAT identification number where they exist. A sole trader has no register entry to publish — requiring one would be wrong for the majority of websites.

A detail that is wrong in many imprints: an email address assembled by JavaScript so that spam bots do not find it is not present in the delivered HTML at all. Whether that meets the requirement is a legal question — technically, at any rate, it is a detail that is not in the document the server delivers.

A second, very concrete pitfall: the EU platform for online dispute resolution was shut down on 20 July 2025. The link to it is still in countless imprints and email signatures. A dead link to an abolished platform can itself be grounds for a warning letter. Important here: only the EU platform link goes. The sentence on taking part in a dispute resolution procedure under the VSBG stays.

The privacy policy has to inform, under the information duties of Art. 13 and 14 GDPR, at the point where data is collected — so it has to be reachable from every page where something happens.

Finally, the accessibility statement depends on whether your offer falls under the accessibility obligations. Accessibility is now legally required for many consumer-facing providers. Whether and to what extent your business is affected depends on the individual case — on factors that are on no page: company size, turnover and whether you supply consumers. Your legal adviser clarifies that, not a technical check.

And the frame stays the same as everywhere in this field: whether the content of an imprint meets the provision is for a lawyer to judge. An audit report can establish presence, reachability and outdated references.

How to check it yourself

Open your website and look for the imprint without typing in the address. How many clicks do you need? What is the link called? Can it be reached from every page or only from the home page?

Then read through the imprint and search for the four outdated terms: “TMG”, “TTDSG”, “Telemedien” and a link to ec.europa.eu/consumers/odr. Each of them should be corrected.

Check whether a complete postal address is there — street with house number, postcode, town. A PO box is not enough, because it is not an address for service of legal documents.

Check the email address: open the page source (Ctrl+U) and search for it there. If it is not there, it is generated by a script.

And the same game for the privacy policy: can it be reached from every page, especially from the pages with forms?

What to do if it is missing

Put all mandatory pages in the footer, which is output on every page. That takes care of one-click reachability from everywhere, and the label is unambiguous.

Label the links literally: “Impressum”, “Datenschutzerklärung”, “Erklärung zur Barrierefreiheit”, “AGB”. No creative names.

For the texts themselves, use a provider that maintains them — eRecht24 or Schwenke are the usual addresses in the German market. The advantage of a maintained text is exactly the case this is about: when a law is renamed or a platform shut down, the update comes from there.

Remove the ODR link everywhere: imprint, terms and conditions, privacy policy, email signature, order confirmation, shipping confirmation.

Put the email address into the HTML as real text. Spam protection through obfuscation is largely ineffective today, and the price for it is a mandatory detail missing from the delivered document.

And for the accessibility statement: if the accessibility obligations apply to you, it belongs there — it is the documented part of an obligation whose technical part is due anyway.

This is not legal advice. For the specific wording, a lawyer specialising in IT law is responsible.

Sources

• § 5 DDG (until May 2024 TMG) governs the imprint duty with name, address, contact, register entry and VAT ID where applicable; the TTDSG was renamed TDDDG in May 2024; GDPR Art. 13/14 information duties at the point of collection; BFSG since 28.06.2025 with an exemption for micro-enterprises under 10 employees and at most EUR 2 million; eRecht24 or Schwenke as practical standard sources for legal texts -- @ctx:atlas-legal-dach-website-compliance-stack@1
• Imprint reachable in at most two clicks from every page; link clearly labelled “Impressum”, not “Legal” or “About us”; minimum content full company name, address, contact, VAT ID and register entry; EU ODR platform abolished by Regulation (EU) 2024/3228 as of 20.07.2025, remove all references, a dead link can itself be grounds for a warning letter, places to check are imprint, terms and conditions, privacy policy, email signature and order and shipping confirmation; no legal advice -- @ctx:atlas-legal-german-ecommerce-compliance@3
• Findability as a check of its own, because § 5 DDG requires “easily recognisable and directly reachable” and a page only found by guessing its address does not meet that; outdated references to TMG, TTDSG, “Telemedien” and the shut-down EU platform link; the VSBG sentence stays mandatory and is not removed with it; a PO box is not an address for service of legal documents; email addresses assembled by script are missing from the delivered HTML; require a register entry only for the corresponding legal form; conditional duties such as the accessibility statement depend on headcount, turnover and audience and cannot be rated “failed” -- @ctx:projects-tools-checky-workbench-docs-tech-specs-probe-catalog-trust@7
• Publishing an accessibility statement as an expectation of the EAA directive; BFSG fines of up to EUR 100,000 per breach -- @ctx:atlas-legal-eu-accessibility-act@2