By country

Terms & Conditions Generator Germany

GDPR plus BDSG, the TDDDG cookie rules, the Impressum duty and a live Abmahnung industry.

Generate your terms and conditions Read the terms and conditions guide

German AGB are policed twice: by the § 305 ff BGB rules on standard business terms, which strike out surprising or unreasonably disadvantageous clauses, and by competitors who read them looking for something actionable.

Germany is the strictest practical market in the EU, not because GDPR reads differently there but because three extra layers sit on top. The Bundesdatenschutzgesetz fills the GDPR opening clauses, the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, formerly TTDSG) governs cookies in § 25, and the Digitale-Dienste-Gesetz carries the Impressum duty in § 5.

Enforcement is also decentralised. Sixteen state authorities plus the federal commissioner supervise different sectors, and they coordinate through the Datenschutzkonferenz rather than acting as one body. Guidance that is settled in one Land is sometimes still contested in another.

The distinctive German risk is private enforcement. Competitors and Abmahnvereine send cease-and-desist letters with cost demands over a missing Impressum, an unlawfully embedded Google Font or a cookie banner without a same-level reject button. That happens on a timescale of weeks, long before any regulator would act.

What a terms and conditions in Germany has to cover

Incorporation of the AGB at the right moment, with the text accessible and storable
The statutory Widerrufsbelehrung and model withdrawal form, in the prescribed wording
Statutory warranty of two years on consumer goods, which cannot be shortened for new goods
The Button-Lösung: an order button labelled with a legally binding payment obligation
Dispute resolution information under the German implementation of the ODR rules

How Germany actually moves personal data

Google Fonts and other remote assets

A Munich court held that loading Google Fonts from Google’s servers transmits the visitor’s IP address without a basis. Self-hosting fonts, maps and scripts is now the German default, and the policy should say which assets are self-hosted.

Employee data under § 26 BDSG

German employment processing has its own basis and its own limits, and works council co-determination applies to any tool capable of monitoring performance - which includes most analytics and ticketing systems.

Payment by Rechnungskauf and SEPA direct debit

Buy-now-pay-later and invoice purchase are dominant in German e-commerce and involve creditworthiness checks by SCHUFA or Creditreform, which is a disclosure and an Article 22 question at the same time.

Consent records under § 25 TDDDG

The burden of proving consent sits with you, and German courts have been willing to look at the actual banner implementation rather than the policy’s description of it.

Newsletter double opt-in

German case law effectively requires confirmed opt-in with a logged confirmation email. Single opt-in lists are the ones that generate Abmahnungen.

Third parties the draft will ask you about

Stripe · Klarna · PayPal · SCHUFA · DHL · Hetzner · IONOS · Matomo · CleverReach · Datev

The rules that apply

GDPR + BDSG

The BDSG carries German rules on employee data (§ 26), video surveillance, and the threshold at which a Datenschutzbeauftragter becomes mandatory.

§ 25 TDDDG

Consent before storing or accessing information on a device, with a narrow strictly-necessary exemption. This is the German cookie rule, and it is not GDPR.

§ 5 DDG - Impressum

A complete legal notice with company form, register number, VAT ID, managing directors and a contact route. Missing it is the most-abmahnt defect on the German web.

Mandatory data protection officer

Required where twenty or more people are constantly engaged in automated processing, or where processing needs a DPIA - a far lower bar than the GDPR default.

Widerrufsbelehrung

Distance-selling cancellation instructions in the statutory form. Getting the wording wrong extends the cancellation window from fourteen days to twelve months.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

The German checklist

Publish a complete Impressum
Company name and legal form, address, contact, register court and number, VAT ID, and the person responsible for editorial content where you publish one.
Self-host every third-party asset you can
Fonts, icon sets, maps and analytics. Anything that phones home before consent is a live risk.
Check the DPO headcount threshold
Count everyone who regularly handles personal data automatically - including part-timers and contractors.
Use the statutory cancellation wording
Copy the model Widerrufsbelehrung and model withdrawal form rather than rewriting them.
Log double opt-in confirmations
Keep the confirmation email, timestamp and IP for every subscriber; it is the evidence that ends a marketing complaint.

Where this usually goes wrong

No Impressum, or an incomplete one

It must be reachable in two clicks from every page and carry the register court, register number, VAT ID and representative. This is the single most common cause of a German cease-and-desist letter.

Loading fonts, maps or scripts from US servers before consent

Each remote asset transmits an IP address. German courts have awarded damages for exactly this, and the fix - self-hosting - is cheaper than the letter.

A cookie banner where reject is a text link

Under § 25 TDDDG the German authorities expect reject at the same level as accept. The DSK guidance is explicit.

Not appointing a Datenschutzbeauftragter when the headcount rule bites

Twenty people regularly processing personal data by automated means triggers the duty regardless of company size, and the appointment must be notified to the state authority.

Wrong Widerrufsbelehrung wording

The cancellation instruction is prescribed almost word for word. A paraphrase extends the withdrawal period to a year and is independently actionable.

Frequently asked questions

Do I need a German-language privacy policy?

If you address the German market, yes in practice. Transparency under Article 12 requires plain, intelligible language for the audience, and German courts have treated English-only notices aimed at German consumers as failing that test.

What is an Abmahnung?

A formal cease-and-desist letter, usually from a competitor or an association, demanding you stop a practice and pay their legal costs. It is a private enforcement mechanism with no regulator involved, and it moves in weeks.

Is Google Analytics legal in Germany?

It can be, with consent obtained before the tag fires, IP anonymisation configured, a processor agreement in place and a documented transfer assessment. What is not defensible is loading it on page one before any consent.

When do I need a Datenschutzbeauftragter?

When twenty or more people are constantly engaged in automated processing of personal data, or when your processing requires a DPIA, or when you process for commercial transfer or market research. The threshold is German, not GDPR.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.