Last updated: 22 October 2026 · By Maurice, freeehouse team · About 3 minutes to read
A note first
This guide gives an overview of the law as of 22 October 2026. It is not legal advice and does not replace a check of your individual case. A lawyer, your chamber or your trade association can give you binding information for your business.
From TMG to DDG
Since 14 May 2024, the duty to provide an Impressum has been in the Digitale-Dienste-Gesetz, DDG for short (German Digital Services Act). It replaced the Telemediengesetz. According to IHK Bonn, the mandatory details have not changed in substance, only the name of the law.
If your Impressum still refers to § 5 TMG, you should update it. A reference to a section is not required. The former TTDSG is now called TDDDG as well.
What belongs in the Impressum
§ 5 para. 1 DDG requires the following details for digital services offered as a business, usually for payment, as far as they apply to you. They must be easy to recognise, directly accessible and permanently available.
- Name and address of the establishment, and for legal entities also the legal form and authorised representatives.
- Details for fast electronic contact, including an email address.
- The competent supervisory authority, if your activity requires official authorisation.
- Commercial register, register of associations or similar register, with the register number.
- For regulated professions: the chamber, the legal professional title with the state where it was awarded, and the professional rules.
- VAT identification number or economic identification number, if you have one.
- For capital companies in winding-up or liquidation, a note to that effect.
Where the Impressum has to be
Easy to recognise and directly accessible means in practice: a link in the footer of every page with a clear word such as Impressum. On a phone the link must be just as reachable as on desktop.
Violations of § 5 para. 1 DDG are administrative offences under § 33 DDG. The fine can be up to €50,000.
What belongs in the privacy policy
The privacy policy fulfils the duty to inform under Art. 13 GDPR. It becomes due when you collect personal data. That already happens when the page is opened, through server logs, and at the latest with the contact form. Art. 13 requires, among other things:
- Name and contact details of the controller, meaning your business.
- Contact details of a data protection officer, if you have one.
- Purposes of the processing and the legal basis.
- For legitimate interest: which interest.
- Recipients of the data, for example your host or a map service.
- Transfers to third countries and the basis for them.
- Storage period or the criteria for it.
- The rights to access, rectification, erasure, restriction, objection and data portability.
- The right to withdraw consent, and the right to lodge a complaint with a supervisory authority.
Cookies and consent
§ 25 TDDDG regulates when a website may store or read information on the visitor's device. In principle only with consent based on clear and comprehensive information.
Without consent it is only possible if the storage is strictly necessary for a service the user has expressly requested to work. If you do without statistics and advertising services that set cookies, you often do not need a cookie banner. Whether that applies to you depends on the services you use.
Fines under the GDPR
Art. 83 GDPR provides two tiers. Up to 10 million euros or 2% of worldwide annual turnover, whichever is higher, for example for data security obligations. Up to 20 million euros or 4% for violations of principles, consent and data subject rights. These are maximums, and authorities must decide proportionately in each case.
Practical steps
List every service your website uses: host, form, maps, videos, fonts, booking tool, statistics. For each service you need a section in the privacy policy. Many chambers and associations offer templates or generators.
Check both once a year and after every change to the website. freeehouse builds websites so that fonts and images come from your own server and no consent is needed for the basic functions. As the operator, you are responsible for the texts of the Impressum and privacy policy yourself.
If you want a new website without unnecessary third-party services, you can request a free draft from freeehouse.
If you want your current website rebuilt without paying for the build: freeehouse builds it by hand, and you only pay for hosting with care, cheaper than today. Claim your spot on the waiting list
Frequently asked questions
Does a small business need an Impressum?
If you run the website as a business, as a rule yes. § 5 DDG lists the mandatory details. This is not legal advice.
Is a phone number enough instead of email?
No. § 5 para. 1 no. 2 DDG requires details for fast electronic contact including an email address.
What does a missing Impressum cost?
Under § 33 DDG, a violation of § 5 para. 1 can be punished with a fine of up to €50,000. Cease-and-desist letters (Abmahnungen) may follow.
Do I need a privacy policy without a contact form?
Usually yes, because data such as the IP address is already processed when the page is opened. Art. 13 GDPR then requires informing visitors.
Does the Impressum have to cite § 5 DDG?
No, a reference to a section is not required. An outdated reference to the TMG should be corrected, though.
Sources
- DDG § 5 Allgemeine Informationspflichten, accessed 22 October 2026
- DDG § 33 Bußgeldvorschriften, accessed 22 October 2026
- Art. 13 DSGVO Informationspflicht bei Erhebung, accessed 22 October 2026
- Art. 83 DSGVO Geldbußen, accessed 22 October 2026
- TDDDG § 25 Schutz der Privatsphäre bei Endeinrichtungen, accessed 22 October 2026
Providers' prices and terms change often. What counts is what's in your customer account and your contract. Not legal advice.
Read more
Ready for a new website?
We're currently testing freeehouse with a first round of businesses. Claim your spot on the waiting list.