GDPR-Compliant Website in Germany 2026 — What Freelancers & SMEs Need to Know
GDPR-compliant website for the German market: cookie consent, imprint requirements, privacy policy, tracking consent and practical implementation for small businesses and freelancers.
The GDPR has been in effect since 2018 — and yet most small businesses and freelancers still make basic mistakes. I regularly take over websites from other providers and see the same issues: missing cookie banners, incomplete privacy policies, incorrect tracking setup.
If you’re an international freelancer or business owner building a website for the German market, this guide is for you. German data protection laws are among the strictest in Europe, and violations can cost you.
What’s Changed in 2026?
The GDPR itself is stable. But case law has evolved:
- Cookie consent is mandatory, not optional. The European Court of Justice reaffirmed in 2024: no non-essential cookie may be set without active consent. This affects Google Analytics, Facebook Pixel, and similar services.
- “Dark patterns” in cookie banners are illegal. A banner where “Reject” is harder to find than “Accept” is not permitted. Both options must be equally easy.
- Google Analytics remains vulnerable. Austrian and other European data protection authorities continue to classify Google Analytics as non-GDPR-compliant without sufficient safeguards for US data transfers.
The 5 Most Common Mistakes (and How to Fix Them)
1. Missing or Manipulative Cookie Consent
The problem: Many websites have either no cookie banner or one that highlights “Accept” and hides “Reject.”
The solution: Use a consent manager that meets these criteria:
- “Reject all” is as easy as “Accept all” (one click)
- Users can choose between categories (necessary, statistics, marketing)
- Consent is documented and can be revoked
- No tracking before consent
I recommend Cookiebot or Osano for small websites. Both offer free tiers up to a certain page count.
2. Incomplete Privacy Policy (Datenschutzerklärung)
The problem: Many privacy policies are too generic or don’t list all services actually used.
The solution: Your privacy policy must include:
- Who you are (name, address, contact details)
- What data you collect (personal data, technical data)
- For what purpose you collect data (contract fulfillment, analytics, marketing)
- On what legal basis (consent, legitimate interest, contract)
- What third-party services you use (Google Analytics, Google Fonts, YouTube, etc.)
- How long you store data
- What rights users have (access, deletion, rectification, data portability)
- Whether and how data is transferred to third countries
Use the eRecht24 Privacy Policy Generator or DGD Generator for legally sound privacy policies in German. English-only policies are not sufficient for the German market if your site targets German users.
3. Missing Imprint (Impressum)
The problem: German law requires an imprint on every commercial website. International freelancers often skip this.
The solution: According to §5 TMG (Telemedia Act), your imprint must include:
- Full name (for freelancers: first and last name)
- Full address (no PO boxes)
- Contact details (email, phone)
- For registered companies: registry details, VAT ID
The imprint must be easily recognizable, directly accessible, and permanently available — reachable with one click from every page.
Important for international freelancers: If you target the German market, you’re subject to German law. You need an imprint and a GDPR-compliant privacy policy, even if you’re based outside Germany.
4. Tracking Without Consent
The problem: Google Analytics, Facebook Pixel, and similar services are often loaded without consent.
The solution: All tracking services must:
- Obtain active consent before loading
- Be technically implemented so they don’t load without consent
- Allow users to revoke consent
I use consent-based loading: tracking code only executes after the user actively agrees. This can be implemented with any consent manager.
5. Insecure Contact Form Handling
The problem: Contact forms that send data unencrypted via email or have no privacy notice in the form.
The solution:
- SSL encryption is mandatory (HTTPS)
- Privacy notice directly in the form (“By submitting, you agree to the processing…”)
- No sensitive data via unencrypted email
- Optional: PGP encryption or use of encrypted form services
GDPR Checklist for Your Website
- SSL certificate installed (HTTPS)
- Imprint complete and easily accessible
- Privacy policy complete and up to date (in German if targeting German market)
- Cookie consent banner installed and correctly configured
- No tracking before consent
- Contact form with privacy notice
- Email transmission encrypted
- External services (Google Fonts, YouTube, Maps) GDPR-compliant
- Embedded third-party content reviewed
Practical Implementation for International Sites
On my projects, I take a pragmatic approach:
- No Google Analytics — I use Plausible Analytics or Umami, which work without cookies and are GDPR-compliant. No consent banner needed, yet you get meaningful statistics.
- Self-hosted fonts — Google Fonts are loaded locally, not from Google’s servers. This also saves load time.
- Self-hosted maps — Instead of Google Maps, I use OpenStreetMap or Leaflet.
- Data minimization by design — I only collect data that’s actually needed.
If you must use Google Analytics: it’s possible with a properly implemented consent manager and a Data Processing Agreement (DPA) with Google. But for most SMEs and freelancers, a privacy-friendly alternative is simpler and safer.
What Happens If You Don’t Comply?
GDPR violations in Germany can result in:
- Fines — up to €20 million or 4% of annual global turnover
- Warning letters (Abmahnungen) — from competitors or legal firms, costing €500–€3,000+ in legal fees
- Court orders — forcing you to change or take down your website
The risk is real. I’ve seen freelancers receive Abmahnungen within weeks of launching a site without proper privacy compliance. Prevention is far cheaper than the cure.
My Advice for International Freelancers
- Get a German-law-compliant privacy policy generated. Don’t copy from other sites. Use a generator.
- Add a proper imprint. Yes, even if you’re not based in Germany but target German clients.
- Use privacy-friendly analytics. Plausible, Umami, or Fathom — no cookies, no consent needed.
- Self-host what you can. Fonts, maps, analytics — everything you self-host reduces third-party risk.
- Get legal advice if you’re unsure. A one-time consultation with a German IT lawyer costs €200–€500 and can save you thousands.
Need help making your website GDPR-compliant? I offer a website compliance check and can implement all the technical measures needed. Email me at arnaut@miran.at.