Legal Basis: DDG and GDPR
The legal notice obligation derives from multiple legal sources. The Digital Services Act (DDG) has replaced the Telemedia Act (TMG) since 2024 and regulates provider identification for digital services in Germany. The GDPR supplements the requirements with the obligation to provide a privacy policy. Additionally, industry-specific regulations may require further mandatory details, such as trade regulations for certain professions or the Commercial Code for registered merchants.
The central provision is § 5 DDG, which substantively continues the former § 5 TMG. According to it, every provider of a digital service must keep certain information easily recognizable, immediately accessible, and permanently available. Non-compliance can be sanctioned as an administrative offense with fines of up to 50,000 euros.
Required Details by Business Type
Sole Proprietors and Freelancers
- Full name: First and last name of the operator (for sole proprietors, also the business name if different)
- Physical address: Complete postal address with street, number, postal code, and city. A P.O. box is not sufficient.
- Contact option: Email address and at least one additional means of quick electronic contact (phone or contact form with timely response)
- VAT ID: VAT identification number if available. If no VAT ID has been assigned, this detail is not required.
- Economic ID: Once the Economic Identification Number is assigned, it must also be stated.
Regulated Professions (Doctors, Lawyers, Architects, Tax Advisors)
In addition to general details, regulated professions must provide: the exact professional title and the state in which it was awarded, the responsible chamber or supervisory authority, the relevant professional regulations with citation (e.g., Federal Bar Association for lawyers), and where applicable, reference to the applicable professional code of conduct.
GmbH, UG (Limited Liability), and AG
- Company name: Full company name as registered including legal form suffix (GmbH, UG (haftungsbeschränkt), AG)
- Registered office: Address as per commercial register
- Authorized representative: Name of the managing director (GmbH/UG) or board member (AG). For multiple directors, only those authorized to represent need be listed.
- Commercial register: Registration court and registration number (e.g., HRB 12345, Local Court Munich)
- VAT ID: VAT identification number
- Share capital: For GmbH and UG, only required if share capital is still being built up
Additional Details for Online Shops
- Consumer dispute resolution: Statement per § 36 VSBG on whether you are obliged or willing to take part in dispute resolution proceedings before a consumer arbitration board, including name and address of the responsible body where applicable. The EU online dispute resolution platform was shut down on 20 July 2025; the former obligation to link to it has lapsed and the link should be removed from existing imprints.
- Supervisory authority: If official authorization is required, name and address of the responsible supervisory authority
Accessibility: The Two-Click Rule
The legal notice must be accessible from every page of the website within a maximum of two clicks. This requirement applies equally to desktop and mobile versions. The link must be labeled as Legal Notice, Imprint, Contact, or in a way clearly identifiable to the user. Hidden links only visible after scrolling or links in flyout menus appearing only on hover may fail the accessibility requirement.
Particularly problematic: cookie banners, pop-ups, or other overlays must not block access to the legal notice. When a cookie banner fills the entire screen and the legal notice link is in the footer, it cannot be clicked. This is a standalone legal violation.
On mobile devices, the footer is often far down the page and gets obscured by hamburger menus or fixed cookie banners. Test the accessibility of your legal notice across different screen sizes and with an active cookie banner.
The Five Most Common Legal Notice Mistakes
1. Missing VAT ID
If a company has a VAT ID, it must be stated in the legal notice. The absence of this information is one of the most common reasons for warning letters. The VAT ID is a mandatory detail under the DDG and cannot be replaced by the tax number. The tax number is an internal identifier of the tax office and does not belong in the legal notice.
2. Outdated Information
A relocation, change of managing director, change of legal form, or renaming must be promptly updated in the legal notice. Outdated information constitutes a violation even if not intentionally incorrect. Especially in fast-growing companies with frequent personnel changes, updating the legal notice is often forgotten.
3. Incomplete Commercial Register Details
Corporations must state the registration court and registration number. Frequently, the registration court is missing or the information is incomplete (e.g., only HRB 12345 without naming the local court). The correct format is, for example: Local Court Munich, HRB 12345.
4. Insufficient Contact Details
An email address alone is insufficient under current law for many business types. The DDG requires a means for quick electronic contact enabling immediate communication. In practice, this means: email address plus phone number or a contact form assuring a response within one business day.
5. Legal Notice as Image Only
Some operators display the legal notice as an image or PDF to protect against spam crawlers. This is problematic since images cannot be read by screen readers and fail to meet accessibility requirements under the BFSG. Search engines also cannot index the content. Use HTML text for all legal notice details.
Privacy Policy as a Complement to the Legal Notice
In addition to the legal notice, a complete privacy policy is mandatory. It must list all services and data processing activities actually in use, including hosting providers, analytics tools, contact forms, newsletter services, social media integrations, payment providers, and embedded third-party scripts.
The privacy policy must be accessible from every subpage, just like the legal notice. It should be on a separate page from the legal notice since both documents serve different legal functions. While combining both pages is not explicitly prohibited, it is not recommended by data protection experts.
Legal Notice Requirements on Social Media
The legal notice obligation applies not only to your own website but also to commercially used social media profiles on Facebook, Instagram, LinkedIn, X (Twitter), and other platforms. A link to the website's legal notice is the simplest solution, provided the link is reachable within a maximum of two clicks.
On platforms that do not offer a dedicated legal notice field, the info section or website URL in the profile can be used. The key requirement is that legal notice details are accessible without detours. Missing legal notices on social media profiles are a common but frequently overlooked reason for warning letters.
Automated Legal Notice Checking with XICTRAQ
XICTRAQ checks the accessibility and basic completeness of your legal notice and privacy policy as part of the compliance module. The system verifies with each scan cycle:
- Is the legal notice page accessible from every subpage within a maximum of two clicks?
- Is the legal notice obscured by cookie banners or other overlays?
- Is the page accessible on mobile devices and at various screen sizes?
- Does the page contain basic required details (name, address, contact)?
- Is the privacy policy also accessible and present?
- Are new services and scripts detected that require updating the privacy policy?
When deterioration occurs, you receive a notification with concrete recommendations. This ensures your required legal pages remain compliant after every website update and design change. This is particularly important after a relaunch or redesign when templates and navigation structures are modified.
Checklist: Implementing the Legal Notice Correctly
- Full name or company name with legal form suffix
- Physical postal address (no P.O. box)
- Email address plus phone or contact form
- VAT ID (if available)
- Commercial register with court and number (for corporations)
- Authorized representative (for legal entities)
- Professional title and chamber (for regulated professions)
- Consumer dispute resolution statement per § 36 VSBG (for online shops)
- Accessibility: maximum 2 clicks from every page, including mobile
- Not obscured by cookie banners or overlays
- Privacy policy as a separate, accessible page
- Social media profiles with legal notice link
Warning Letter Costs and Current Legal Developments
Warning letters for defective legal notices typically cost between 500 and 2,000 euros, plus your own legal consultation costs (German Bar Association). The most frequently cited issues are missing VAT IDs, incomplete commercial register details, and unreachable legal notice pages. Since the DDG, stricter requirements for electronic contact options also apply.
Proactive compliance monitoring with XICTRAQ helps minimize such legal risks. Instead of waiting for a warning letter, you identify potential problems early and can fix them before they result in legal consequences. The investment in automated monitoring is minimal compared to the cost of a single warning letter. Combined with the security scan, you get a complete picture of your website's legal and technical condition.
Frequently Asked Questions About the Legal Notice
Do I need a legal notice if my website is purely private?
Can I provide a contact form instead of a phone number?
Do I need to state my tax number in the legal notice?
How quickly must I update changes in the legal notice?
Do social media profiles need a legal notice?
How does XICTRAQ check my legal notice?
This article is based on data from: BSI.