GDPR checklist for a German company website

German company websites are subject to some of the strictest rules in Europe: the GDPR, the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG), the Digital Services Act (DDG, which replaced the Telemedia Act) and the case law of German courts. Warning letters (Abmahnungen) for missing imprints or Google Fonts loaded from Google's servers have cost many companies money and nerves.

This checklist covers what we check on every website we build. It is a technical and practical guide, not legal advice; have your final legal texts reviewed by a lawyer or your data-protection officer.

1. Imprint (Impressum)

Every commercial website in Germany needs an imprint under § 5 DDG, reachable from every page with at most two clicks, usually a link in the footer.

• Full company name and legal form
• Postal address (no P.O. box)
• Names of the managing directors or owner
• Email address and a second fast contact channel, usually a phone number
• Commercial register and registration number, if registered
• VAT identification number, if available
• Responsible person for editorial content under § 18 (2) MStV, if you publish journalistic content such as a blog

2. Privacy policy

The privacy policy must explain, in clear language, which personal data you process, why, on what legal basis, for how long, and with which service providers. In practice the most common gaps are:

• Hosting provider and server log files
• Contact forms and where submissions are stored
• Newsletter tools
• Analytics and what is measured
• Embedded content such as maps, videos or booking widgets
• Transfers to third countries such as the USA and the safeguards used
• Retention periods for enquiries and applications
• Rights of data subjects and the competent supervisory authority

Keep it current. Every new tool on the website means a new section.

3. Cookies and consent

Under § 25 TDDDG, storing or reading information on a visitor's device requires consent unless it is strictly necessary for the service the user requested. Practical consequences:

• Necessary cookies (session, language, the consent choice itself) need no consent.
• Analytics, marketing and third-party embeds need prior consent, unless you use a privacy-friendly setup that stores nothing on the device.
• "Reject" must be as easy as "Accept". German supervisory authorities expect both options on the first layer of the banner with equal visual weight. No pre-ticked boxes, no dark patterns.
• Nothing loads before consent. Check with your browser's developer tools that no third-party request happens before the visitor decides.
• Consent must be revocable, for example via a "Cookie settings" link in the footer.

The best cookie banner is the one you do not need. With cookieless analytics and self-hosted resources, many company websites only need consent for optional embeds.

4. Fonts

Since a 2022 court ruling in Munich, loading Google Fonts from Google's servers without consent has triggered a wave of warning letters, because the visitor's IP address is transferred to Google. The solution is simple: host fonts yourself. Modern frameworks such as Next.js do this automatically at build time.

5. Contact forms

• Use HTTPS everywhere.
• Collect only what you need; mark optional fields as optional.
• Add a short privacy notice with a link to the privacy policy. A consent checkbox is common practice in Germany, even though contract-related enquiries can also rely on other legal bases.
• Document where submissions go (email provider, CRM, CMS) and sign data processing agreements with these providers.
• Define a retention period and delete old enquiries.
• Protect forms against spam with privacy-friendly tools, and mention them in the privacy policy.

6. Embedded content

Google Maps, YouTube, Instagram posts, booking calendars and chat widgets load content from third-party servers and transfer data as soon as they appear. Use a two-click solution: show a placeholder with an explanation and load the content only after the visitor clicks. Remember the choice if the visitor agrees for good.

7. Analytics

You have three options:

• Cookieless analytics such as Plausible, Fathom or Vercel Web Analytics, which do not store anything on the device and do not create profiles. In many cases this works without a consent banner, but you still need to describe it in the privacy policy.
• Google Analytics 4 or similar tools with consent, configured for data minimisation, and with the third-country transfer documented.
• No analytics at all, which is legal but leaves you blind.

Whatever you choose, track only what you need: page views and conversion events such as form submissions are usually enough.

8. Hosting and processors

List every service provider that processes personal data on your behalf (hosting, CMS, email, forms, analytics, CRM) and sign a data processing agreement (AVV) with each. Prefer providers with EU data centres. For US providers, check whether they are certified under the EU-US Data Privacy Framework and document the safeguards.

9. Security

• HTTPS with a valid certificate and HSTS
• Up-to-date software: plugins and CMS versions are the most common attack vector
• Security headers such as X-Content-Type-Options and a sensible Referrer-Policy
• Backups and a plan for incidents, because data breaches must be reported to the authority within 72 hours

A static or server-rendered site built with a headless CMS has a much smaller attack surface than a classic plugin-heavy installation.

10. Accessibility

Since June 2025 the German Accessibility Strengthening Act (BFSG) applies to many digital products and services for consumers, including online shops and booking services. Even where it does not strictly apply, accessible websites reach more people and rank better. Aim for WCAG 2.2 AA: sufficient contrast, keyboard navigation, alt text, clear headings and forms with labels.

The quick self-check

• Imprint complete and linked in the footer?
• Privacy policy lists every tool on the site?
• Banner offers "Reject" and "Accept" with equal weight, and nothing loads before consent?
• Fonts self-hosted?
• Maps, videos and booking widgets behind a click?
• Forms over HTTPS with a privacy notice, and submissions deleted after a defined period?
• Data processing agreements in place with every provider?
• Software up to date and backups tested?

Common mistakes we find in audits

• A consent banner that loads analytics or embeds before the visitor decides.
• Google Fonts or icon fonts still loaded from external CDNs by a theme or plugin.
• Contact forms that send data by unencrypted email to a private mailbox without a retention rule.
• A privacy policy generated years ago that does not mention half of the tools in use.
• YouTube videos embedded directly instead of behind a click.
• Missing register number or VAT ID in the imprint.

Conclusion

A legally sound website in Germany is less about long legal texts and more about technical discipline: load nothing from third parties without consent, host fonts yourself, document every tool and keep the site up to date. When we build websites with Next.js and a headless CMS, these points are part of the standard setup, which is why many of our sites need a consent banner only for optional embeds.

Get a GDPR-friendly website