Imprint (Impressum) requirements for German websites in 2026

Among compliance failures, missing Impressums are unique: they are easy to spot, easy to enforce, and have a built-in private-enforcement mechanism in the form of the Abmahnung, a cease-and-desist letter from a competitor or specialised law firm. For SMBs operating in Germany, Austria, or Switzerland (DACH), the Impressum is the lowest-effort, highest-impact compliance fix on the list.

The legal basis

Germany. Until May 2024 the rule sat in §5 of the Telemediengesetz (TMG). It now lives in §5 of the Digitale-Dienste-Gesetz (DDG), the German implementation of the EU Digital Services Act. The substance is unchanged, same fields, same enforcement.

Austria. Two duties, routinely confused. The direct analogue of §5 DDG is §5 of the E-Commerce-Gesetz (ECG): provider identification for anyone offering an information-society service, with a fine ceiling of €3,000 under §26 ECG. Separately, §24 and §25 of the Mediengesetz (MedienG) require ownership and editorial disclosure on any “periodical electronic medium,” which courts have read broadly to cover commercial websites; §27 MedienG reaches €20,000. Most Austrian sites owe both. The required fields differ slightly from Germany’s.

Switzerland. A different basis and a narrower scope: Art. 3(1)(s) UWG (the Federal Act against Unfair Competition) requires a legal notice for sites offering goods or services in electronic commerce, and it names the email address as mandatory. A German-style Impressum satisfies it, but the fields differ (UID and commercial register rather than HRB and USt-IdNr.). See Impressum requirements for Swiss websites for the Swiss-specific checklist.

The German field-by-field checklist

§5 DDG requires the following information, presented leicht erkennbar, unmittelbar erreichbar und ständig verfügbar (easily recognisable, directly accessible, and continuously available):

• Full company name and legal form (GmbH, UG, AG, e.K., GbR, sole proprietorship, etc.).
• Authorised representative for legal entities (Geschäftsführer, Vorstand).
• Postal address, actual street address, not a P.O. box. This is the one that catches one-person businesses out: a home address is required if there is no business premises.
• Contact details enabling rapid electronic communication and direct contact: an email address (not just a contact form) and telephone or equivalent real-time channel.
• Commercial register entry if applicable: registry court and HRA/HRB number.
• VAT identification number (USt-IdNr.) if the business has one.
• Regulated profession (where applicable): chamber, professional title, country of issuance, professional regulations and how to access them. Doctors, lawyers, tax advisors, architects, real-estate agents fall into this category.
• No ODR platform link. This used to be a required field. It is not one any more, and leaving it in place is now the error — see below.
• Statement on consumer ADR participation: whether the business participates in alternative dispute resolution and where.
• Editorial responsibility (V.i.S.d.P.) where the site contains journalistic-editorial content. A blog with named authors arguably qualifies; this is where most SMBs over-disclose to be safe.

What auditors check beyond the fields

Beyond the contents, an Impressum audit looks at:

• Link visibility. The Impressum link is in the footer of every page. “Impressum” is the safest label, because it is the word German visitors look for — but it is not legally compulsory. The BGH held in I ZR 228/03 (20 July 2006) that a link marked “Kontakt” satisfied the duty too: the test is whether the information is easy to recognise and easy to reach, not whether one particular word was used. Our own detector accepts imprint, legal notice, mentions légales, aviso legal, colofon and note legali alongside Impressum. What does fail is a label a visitor cannot connect to provider information at all, or an Impressum buried inside a multi-page legal section.
• Number of clicks. Reachable in two clicks (one click is the standard interpretation). Hiding the Impressum behind a nav menu accordion is risky.
• Markup. The link is a real <a> tag, indexable by crawlers, not a JavaScript-only modal that bots cannot follow.
• Consistency with the privacy policy. The controller named in the Impressum is the same as in the privacy policy.
• Mobile presentation. The Impressum is just as accessible on small viewports as on desktop.

Common failures we see

P.O. boxes instead of street addresses. Common for digital freelancers; also non-compliant. The DDG requires a deliverable street address.

Contact form instead of email address. Courts have repeatedly held that a contact form alone does not satisfy the “rapid electronic communication” requirement. An email address must be provided.

Missing telephone number. §5 requires direct contact details. Telephone is the default; a chat tool that responds in real time during business hours arguably qualifies, but the safer answer is to publish a number.

A leftover ODR link. This one has inverted. Regulation (EU) 2024/3228 repealed Regulation (EU) 524/2013; the European ODR platform was switched off on 20 July 2025 and the Art. 14 trader-link duty ceased with it. Traders were required to take the link down. Most SMB Impressums still carry the boilerplate sentence and a link to ec.europa.eu/consumers/odr, which now points at a service that no longer exists — directing consumers to a dead redress route is itself misleading and actionable. Delete the sentence and the link.

Missing VAT ID. If you have a USt-IdNr., it has to appear. Confusingly, some SMBs add a Steuernummer instead, that is a different identifier and does not satisfy the requirement.

The Abmahnung pattern, and what changed in 2020

The mechanism is still live: a competitor or a specialised law firm finds a page without a compliant Impressum and sends a template letter demanding a signed, penalty-backed cease-and-desist undertaking. What changed is the money. Since 2 December 2020, §13(4) no. 1 UWG excludes reimbursement of the warning party’s costs for breaches of information and labelling duties in telemedia — and §5 DDG is precisely such a duty. §13a(2) UWG additionally bars a contractual penalty in a first warning against a business with fewer than 100 employees. The fee-farming economics that made Impressum warnings a business model were legislated out for this exact category of violation.

That is not a reason to leave it broken. The cease-and-desist undertaking is open-ended and survives long after the letter; breaching it later is what actually costs money. Competitors and Wettbewerbsvereine still send these letters, and courts still grant injunctions. The cure is an afternoon of work.

What Veracly actually checks

Narrower than you might want, and we would rather say so than imply otherwise. Veracly looks for an Impressum link on the pages it crawls and probes a bounded set of conventional paths (/impressum, /legal-notice, /mentions-legales and similar). It reports presence or absence, and the check only runs when the site’s primary country is Germany or Austria.

It does not read the page and tell you whether your legal form, register number, VAT ID or authorised representative is actually there. No §5 DDG field validation exists in the product, so we are not going to claim one. A free scan covers one page; weekly re-scans start at the Growth tier, Starter re-scans monthly. Field-by-field completeness is the checklist above, done once, by a human. Run a scan.

See also: What is a website compliance audit? · What is a GDPR cookie audit?