Legal pages are nobody’s favourite part of a website, but in the EU they are not optional, and some mistakes are expensive. Here is a plain-language checklist to go through before launch.
1. A legal notice (imprint)
The EU’s E-Commerce Directive requires anyone offering services online to make basic information about themselves easy to find. In practice that means a legal notice page, linked from every page (usually in the footer). It typically includes:
- Your full name or company name and legal form
- A postal address (not just a PO box)
- An email address and another fast way to reach you, usually a phone number
- Your trade or company register and registration number, if registered
- Your VAT identification number, if you have one
- For regulated professions (lawyers, tax advisers, architects, doctors): your professional title, the chamber you belong to and the rules that apply to you
Germany is the strictest here. The Impressum is required by § 5 of the Digital Services Act (Digitale-Dienste-Gesetz, DDG), which replaced the old § 5 TMG in May 2024. Missing or incomplete details can lead to warning letters (Abmahnungen) from competitors. If you work with German clients or target Germany, take it seriously.
2. A privacy policy
As soon as your website processes personal data, and almost every website does (contact forms, analytics, embedded maps, booking tools, even server logs), the GDPR requires you to tell visitors clearly:
- Who is responsible for the data, with contact details
- What data you collect and why (the purposes)
- The legal basis for each purpose (consent, contract, legitimate interest…)
- Who receives the data, including service providers such as your host, form tool or booking tool
- Whether data leaves the EU, and on what basis
- How long you keep it
- Visitors’ rights: access, correction, deletion, objection, and the right to complain to a data protection authority
A generic template copied from another site is a common mistake. Your policy must describe your tools. Every time you add a new service (a newsletter, a chat widget, a video embed), update it.
3. Cookies and consent
Under the EU’s ePrivacy rules, you need visitors’ consent before storing or reading anything on their device that is not strictly necessary for the site to work. That covers most advertising and tracking cookies, and many analytics tools. In Germany this is § 25 of the TDDDG.
What regulators expect from a cookie banner:
- Nothing non-essential runs before the visitor chooses
- Rejecting is as easy as accepting, ideally a “Reject all” button on the first layer
- No pre-ticked boxes
- Visitors can change their mind later
The simpler route: use privacy-friendly analytics that don’t set cookies or store anything on the device, and self-host your fonts. Many sites can then do without a consent banner altogether. Our own site works this way: cookieless analytics and no tracking cookies. (You still mention the analytics in your privacy policy.)
About fonts: in 2022 a German court (LG München I) ruled that loading Google Fonts from Google’s servers passed visitors’ IP addresses to Google without a legal basis, and awarded damages. Hosting fonts on your own server avoids the issue entirely, and is faster too.
4. Contact forms
- Ask only for what you need. Name, email and message are usually enough.
- Make sure the site runs on HTTPS so the form is encrypted.
- Mention the form and where its data goes in your privacy policy.
- If you want to add people to a newsletter, ask with a separate, unticked checkbox. Sending an enquiry is not consent to marketing.
5. Accessibility
The European Accessibility Act has applied since 28 June 2025. It requires many products and services sold to consumers to be accessible, including e-commerce: online shops, booking and ticketing, banking, and more. In practice, websites are measured against the European standard EN 301 549, which builds on the WCAG guidelines (level AA).
Who is exempt: microenterprises that provide services, meaning fewer than 10 employees and an annual turnover or balance sheet of no more than 2 million euros. A small studio with an online booking tool may well fall under this exemption. A growing shop may not.
Exempt or not, accessibility is good business. The basics:
- Enough colour contrast between text and background
- Text that can be enlarged without breaking the layout
- Descriptions (alt text) for meaningful images
- Everything usable with a keyboard, with visible focus
- Forms with clear labels and error messages
- Video with captions where speech carries the meaning
- Respect for visitors who switch off animations in their device settings
6. If you sell online
Online shops have extra duties under EU consumer law. Among the most important:
- Clear pre-contract information: total price including taxes and delivery costs, the main features of the product, payment and delivery terms.
- The 14-day right of withdrawal for most distance sales, with clear instructions and a model withdrawal form.
- An unambiguous order button. The final button must make clear that the order means paying, such as “Order with obligation to pay” or “Buy now”. A plain “Continue” is not enough.
- Terms and conditions that customers can save or print.
One thing you can remove: the EU’s Online Dispute Resolution (ODR) platform closed on 20 July 2025, and the obligation to link to it was abolished (Regulation (EU) 2024/3228). If your site or terms still link to it, take the link out.
7. AI-generated content
Since 2 August 2026, the transparency rules of the EU AI Act (Article 50) apply. For most business websites, two points matter:
- Chatbots must make clear to visitors that they are talking to an AI, unless it is obvious.
- Deepfakes (AI-generated or manipulated images, audio or video that look like real people, places or events and could be mistaken for authentic) must be labelled as artificially generated or manipulated. For clearly artistic or creative work, a light disclosure that doesn’t spoil the work is enough.
Separately, check the terms of the AI tools you use. Some ask you to credit them when you publish their output; most say you are responsible if the output infringes someone else’s rights. We label our own self-initiated concepts, which use AI-generated imagery, on our work page.
8. Images, fonts and texts
- Use only images you have the rights to: your own, licensed stock, or openly licensed works with the required credit.
- Check font licences. Some fonts are free for print but need a separate web licence.
- Don’t copy texts from other websites, including legal texts. They are protected too, and they won’t describe your business correctly.
The checklist
- Legal notice / imprint, linked in the footer of every page
- Privacy policy that names your real tools
- No non-essential cookies before consent, or none at all
- Fonts hosted on your own server
- HTTPS everywhere, minimal contact forms
- Accessibility basics, and a check whether the EAA applies to you
- For shops: price information, withdrawal rights, a clear order button, terms
- No outdated ODR link
- Chatbots and deepfakes labelled as AI
- Licences for every image, font and video
We can set up the technical side of these foundations as part of your website. The legal texts themselves should come from, or be checked by, your lawyer or adviser. If you are unsure whether your current site is covered, get in touch.