The legal shell of a website

Required by § 5 DDG on every commercial site reachable from Germany - the paragraph moved from the TMG to the DDG in May 2024, so a template citing § 5 TMG is announcing its own age.

It must name the legal person: full name (for a sole trader, your real first and last name - a brand alone is not enough), a street address where papers can be served (no PO box), an email address, and if you have them the VAT ID and the commercial register entry. It must be reachable from every page in two clicks, under a link a reader would recognise.

Required by the GDPR the moment you process anybody’s data, which a signup form, an analytics script or a server log already is. It lists what is collected, on what legal basis, for how long, and who else sees it - which means every third-party service in the chain: hosting, analytics, payment, email.

It has to reflect what the site actually does, and it has to be updated when the stack changes. Adding Stripe adds a paragraph. A copied notice describing tools you do not run is its own violation.

Consent banners: only needed for what actually needs consent (tracking cookies, third-party embeds). A site that sets no tracking cookies needs no banner, and adding one anyway is pure friction.

Not legally mandatory - the default rules of contract law apply without them - but in practice the place where you set the things you care about: what exactly is being bought, when access starts and ends, what happens on non-payment, which law applies.

For consumers, terms are only binding if presented before purchase and only where they do not undercut consumer protection law, which cannot be contracted away. Terms translated from a US template ("as is, no warranty, arbitration in Delaware") are partly void in the EU and read as such.

EU consumers have a 14-day right of withdrawal on online purchases. For digital products and subscriptions there is a well-worn exception: the right lapses when the consumer expressly agrees to immediate delivery and acknowledges losing the withdrawal right - which is why every checkout for digital goods carries exactly that checkbox. Without it, the withdrawal window runs and the customer can reclaim payment after a month of use.

The policy must state the mechanics: how to withdraw, the model form the law prescribes, and what is refunded when. A defective cancellation notice extends the window to a year and is a favourite Abmahnung target.