Avoid website legal warnings: the most common traps

What is a website warning letter?

In Germany, an Abmahnung is not a court decision. It is a request to stop an alleged legal violation. Section 13 of the Act Against Unfair Competition sets out what such a warning must state clearly, including the sender, the alleged breach and any claimed costs.

Do not ignore it, but do not sign blindly either. Cease-and-desist declarations can have long-term effects. Save screenshots of your website, check the deadline and seek legal advice if the claim is serious. This guide is not legal advice; it highlights practical website areas that should stay clean.

Imprint: which details are often missing?

The German Impressum is a classic risk area. Section 5 DDG requires business digital services to keep provider information easily recognisable, directly accessible and permanently available. Depending on your legal form, this includes name, address, authorised representatives, quick electronic contact including email, register details and professional information where relevant.

Common mistakes are a PO box instead of a proper address, missing legal form, outdated managing directors, no email address or an imprint that is not reachable from every page. Your social profiles and Google Business links should also lead to the same responsible business identity.

• Make the imprint reachable from every page
• Keep company name, legal form, address and representatives current
• Provide an email address and a fast contact option
• Add register, VAT ID or supervisory authority only where applicable
• Update the imprint immediately after moving or restructuring

Privacy policy: why a generator is not enough

A privacy policy must explain which personal data is processed and for what purpose. Article 13 GDPR is the practical core: users should be able to identify the controller, purposes, legal bases, recipients, retention periods and their rights.

Generators help, but only if the selected modules match the real website. Contact forms, hosting, analytics, maps, newsletters, booking systems, job applications and embedded videos must be reflected accurately. A managed website should be easy to review when new tools are added.

Cookies and tracking: when is consent needed?

Not every cookie needs a banner. But Section 25 TDDDG says that storing information on a user device or accessing stored information generally requires consent. Exceptions mainly cover access that is strictly necessary to provide a service explicitly requested by the user.

For small businesses this means: shopping cart, login or security cookies are different from marketing tracking, retargeting, external analytics or ad tools. Google Analytics, Meta Pixel, YouTube, Google Maps or similar services should only load after valid consent where required.

• Document technically necessary cookies
• Load marketing and analytics tools only after consent
• Make rejecting as easy as accepting
• Record consent without collecting excessive data
• Re-check the banner after plugin or tool changes

Images, icons and text: where does copyright become risky?

Attractive visuals can become expensive if the licence is missing. Section 97 of the German Copyright Act allows claims for injunction and damages in case of infringement. This can affect photos, icons, illustrations, maps, texts, PDF downloads, product images and sometimes even agency material if rights were not transferred clearly.

Keep simple documentation: source, licence, permitted use and required credit. Save stock licences. For AI images, also check that they do not imitate brands, real people or recognisable third-party works.

Google Fonts, maps and embeds: why local is often safer

Google Fonts became a major warning-letter topic in 2022 because dynamic loading from Google servers can transmit IP addresses. Many mass claims were later challenged, but the technical solution remains simple: host fonts locally and use external connections deliberately.

The same logic applies to maps, YouTube videos, review widgets, chat tools and booking systems. If data flows to third parties immediately on page load, you need a proper legal basis and transparent information. A two-click solution is often pragmatic.

How can small businesses reduce risk without constant stress?

The best protection is a repeatable process, not a one-time clean-up. Define who approves changes to the website, plugins, tracking, forms and images. Review legal texts after each new service and at least once a year.

In a website subscription, maintenance, updates, SSL, backups and small content changes should be clearly defined. Our plans start at €79 per month; legal advice is not included, but technical traps such as local fonts, clean forms and transparent tool use can be avoided from the start.