What legal texts does an online shop need?

What legal texts does an online shop need? The overview

The table shows which legal texts your online shop needs, whether they are mandatory, where they belong and which mistake occurs most often in practice.

Legal text	Mandatory?	Where to place it	Most common mistake
Legal notice (Impressum)	yes, for business offerings (Sec. 5 DDG)	reachable from every page with one click, usually in the footer	missing information, such as register number, authorised representative or incomplete legal form
Privacy policy	yes, as soon as personal data is processed (Art. 13 GDPR)	reachable from every page, also at forms and newsletter sign-up	describes tools that are not used at all, or omits tools that are used
Cookie consent	yes, for non-essential cookies and tracking (Sec. 25 TDDDG)	banner on the first visit, revocable at any time	tracking starts before consent, "reject" is hidden
Cancellation policy with model withdrawal form	yes, for distance selling to consumers (Sec. 312g BGB, Art. 246a EGBGB)	separate page, linked in the ordering process, sent with the order confirmation	exceptions wrong, wrong period, form missing
Terms and conditions	no, but customary	separate page, linked in the ordering process before the order button	copied from another shop, invalid clauses on warranty and liability
Mandatory information in the ordering process	yes, when selling to consumers (Sec. 312d, 312j BGB)	on the product page and order summary	order button incorrectly labelled, shipping costs or delivery time missing
Price information	yes, towards consumers (PAngV)	directly next to the price	unit price missing, no reference to VAT and shipping costs
Notice on consumer arbitration	yes, with a website or terms; exempt are those who employed no more than ten people on 31 December of the previous year and are not obliged to participate or have not undertaken to do so (Sec. 36 VSBG)	on the website and, if you use terms and conditions, together with them	missing, or still refers to the EU dispute resolution platform, which was discontinued on 20 July 2025 (Regulation (EU) 2024/3228)

Legal notice in an online shop: mandatory information and placement

The legal notice makes you identifiable as the provider. Since May 2024, the obligation to provide a legal notice has been set out in the Digital Services Act (Sec. 5 DDG), which took over the rules of the former Telemedia Act. The legal notice must be easily recognisable, directly accessible and permanently available. In practice, this means a "Legal notice" (Impressum) link in the footer of every page.

Mandatory information in the legal notice:

• full name, for companies the company name with legal form, such as "Muster UG (haftungsbeschränkt)"
• the person authorised to represent the business, for a UG and GmbH the managing director
• an address for service, a PO box is not enough
• contact details for quick contact, usually an email address and another contact channel; Sec. 5 DDG does not strictly require a telephone number, but it is mandatory in your shop's consumer information (Art. 246a Sec. 1 (1) no. 3 EGBGB)
• register and register number, if you are entered in the commercial register
• VAT identification number, if you have one
• additional information for regulated professions, such as the chamber and professional title

A legal notice hidden on an "About us" subpage or only reachable after several clicks is not sufficient. The same applies to shops on marketplaces and to social media profiles used for business: you need provider identification there too.

Privacy policy and cookie consent

Every online shop processes personal data: IP addresses when pages are visited, name and address when ordering, email addresses for the newsletter. You must provide information about this under Art. 13 GDPR. The privacy policy contains in particular:

• name and contact details of the controller and, where applicable, the data protection officer
• purposes and legal bases of processing
• recipients of the data, such as payment service providers, shipping providers, hosting, newsletter tool
• transfers to countries outside the EU
• storage period
• data subjects' rights: access, rectification, erasure, restriction, objection, data portability, complaint to the supervisory authority

The privacy policy must fit your shop, not just any shop. If you use a different analytics, newsletter or payment tool than the one described in the policy, it is incomplete. So check it every time you add or replace a tool.

Cookies and tracking: Storing and reading information on the user's device requires consent unless it is strictly necessary for the service (Sec. 25 TDDDG). Shopping basket and login are usually necessary; analytics and marketing tools usually are not. The cookie banner must offer a real choice: rejecting must be as easy as accepting. Tracking may only start after consent.

Cancellation policy and model withdrawal form

Consumers can withdraw from distance contracts within 14 days without giving reasons (Sec. 312g, 355 BGB). You must inform them about this before the order and provide them with the model withdrawal form. The safest approach is to use the statutory templates from the EGBGB and fill them in correctly (Annexes 1 and 2 to Art. 246a EGBGB).

What matters:

• State the start of the period correctly. For goods, the period usually starts on receipt of the goods; for services, on conclusion of the contract. Special rules apply to partial deliveries and subscriptions.
• Know the exceptions. There is no right of withdrawal, for example, for made-to-measure products, perishable goods and sealed hygiene products once unsealed (Sec. 312g (2) BGB); for digital content, it expires under certain conditions (Sec. 356 (6) BGB). You must provide information about the exceptions before the order (Art. 246a Sec. 1 (3) EGBGB).
• Regulate return costs. The consumer only bears the cost of returning goods if you have informed them of this beforehand (Sec. 357 (5) BGB).
• Send the cancellation policy. With the contract confirmation on a durable medium, for example as a PDF by email (Sec. 312f (2) BGB).

A defective cancellation policy is expensive: the withdrawal period then does not start and is extended by up to twelve months (Sec. 356 (3) and (4) BGB). Customers can therefore still withdraw after more than a year.

New since 19 June 2026: Online retailers must offer consumers an electronic withdrawal function, a clearly visible "withdrawal button" with which withdrawal can be declared directly online (Sec. 356a BGB, implementing Directive (EU) 2023/2673). The button must be labelled "withdraw from contract" or with equivalent wording, and must be permanently available and prominently placed during the withdrawal period. The withdrawal is sent via a second button "confirm withdrawal", and you confirm receipt without delay on a durable medium. The cancellation policy must also refer to the function (Art. 246a Sec. 1 (2) sentence 1 no. 1 EGBGB).

Terms and conditions in an online shop: mandatory or optional?

Does an online shop need terms and conditions? No, there is no legal obligation. Most shops still use them. Terms and conditions govern conclusion of contract, payment, delivery, retention of title and liability in your favour, to the extent the law allows. They also bundle a lot of mandatory information in one place. Without terms and conditions, this information must be provided elsewhere, for example on product pages or in the order summary.

The most common problems with shop terms and conditions:

• warranty for new goods shortened or excluded towards consumers
• liability excluded across the board
• transport risk imposed on the consumer
• B2B and B2C clauses mixed
• terms taken from another shop, with the wrong payment methods or delivery routes

What belongs in terms and conditions, which clauses are invalid and how to incorporate them correctly is explained in our guide What belongs in terms and conditions?. If you need terms and conditions for a special business model, there is Have terms and conditions drafted for €499 including VAT.

Mandatory information in the ordering process

Many cease-and-desist letters do not target the legal texts themselves, but the path to the order. Towards consumers:

Price information (PAngV): You state the total price including VAT and indicate whether shipping costs are added, for example "incl. VAT, plus shipping" with a link to the shipping cost overview. For goods sold by weight, volume, length or area, the unit price, for example per kilogram or litre, belongs directly next to the total price. For price reductions, you must state the lowest price of the last 30 days (Sec. 11 PAngV).

Product information: The essential characteristics of the goods are stated on the product page. Depending on the product, this also includes labelling such as the energy efficiency class or textile labelling (Regulation (EU) 2017/1369, Regulation (EU) No 1007/2011).

Delivery time: You state by when the goods will be delivered. Vague statements such as "delivery time not binding" are risky.

Payment methods and delivery restrictions: At the latest when the ordering process begins, it must be clear which payment methods are accepted and whether there are delivery restrictions, for example only to Germany (Sec. 312j (1) BGB).

Button solution: The button with which the customer submits the order must clearly indicate the obligation to pay, for example "zahlungspflichtig bestellen" (order with obligation to pay) (Sec. 312j (3) BGB). Immediately before it are the essential details: characteristics of the goods, total price, shipping costs and, for subscriptions, the term (Sec. 312j (2) BGB). If the button is not labelled correctly, no contract comes into existence under the law (Sec. 312j (4) BGB).

Cancellation button: If consumers take out subscriptions or other continuing obligations through your shop, you must enable cancellation via a cancellation button (Sec. 312k BGB).

Order confirmation: You confirm receipt of the order electronically without delay (Sec. 312i BGB). You send the contract content, terms and conditions and cancellation policy on a durable medium at the latest with delivery (Sec. 312f (2) BGB).

Product safety, accessibility and labelling

Product safety: The EU General Product Safety Regulation (GPSR, Regulation (EU) 2023/988) has applied since 13 December 2024. For consumer products sold online, the product page must show, among other things, the name and contact details of the manufacturer, or for manufacturers outside the EU a responsible person in the EU, information identifying the product, and warnings and safety information (Art. 19 GPSR).

Accessibility: Since 28 June 2025, the Accessibility Strengthening Act (BFSG) has also applied to many online shops selling to consumers. The shop and ordering process must then be usable without barriers, and you must provide information in an accessibility statement. Micro-enterprises providing services are exempt, i.e. businesses with fewer than ten employees and no more than €2 million annual turnover or balance sheet total (Sec. 2 no. 17, Sec. 3 (3) BFSG). The accessibility information is governed by Sec. 14 (1) no. 2 BFSG with Annex 3.

Further labelling: Depending on your product range, obligations under packaging law, electrical equipment and battery law or food law may apply, including registration obligations (Sec. 6 VerpackDG, Sec. 6 ElektroG, Sec. 5 BattDG). Before launch, clarify which obligations your product range triggers.

Marketplaces: Amazon, eBay, Etsy

What legal texts do I need for eBay? The same as in your own shop: legal notice, privacy policy, cancellation policy with model form and, where applicable, terms and conditions. This applies equally to Amazon, Etsy, Kaufland, OTTO and other marketplaces. On the marketplace, you are the seller and therefore responsible for your information, not the platform.

What to bear in mind on marketplaces:

• The legal texts belong in the fields the marketplace provides for them.
• Your terms must fit the platform's terms and refer to them where necessary.
• On Amazon, the platform determines many processes, such as returns. Your cancellation policy must still fit your offering.
• Product safety information also applies on marketplaces.

Selling to businesses (B2B) and abroad

B2B only: If you sell exclusively to businesses, the right of withdrawal, the button solution and many consumer information obligations do not apply. A legal notice and privacy policy remain mandatory. For the exception to hold, you must effectively exclude sales to consumers: a clearly visible notice, requesting the company name and, where applicable, VAT ID, and checking orders. A mere sentence in the terms and conditions is usually not enough.

Selling abroad: If you deliberately target consumers in other countries with your shop, their consumer law may apply, even if your terms agree on German law (Art. 6 Rome I Regulation). You then need legal texts under the law of the target country and in the relevant language. The Recht 24/7 legal texts subscription includes texts for Germany, Austria, Switzerland, France, the Netherlands, Belgium, Spain, Italy, the United Kingdom, Poland and an EU-wide English version.

Write them yourself, use a generator or a lawyer?

Can you write legal texts yourself? Yes, that is permitted. Where can I find free legal texts for my online shop? There are free templates and generators, for example from chambers, associations and providers. The question is who bears the risk if a text does not fit or is out of date.

Criterion	Write them yourself	Generator	Lawyer
Costs	free	free to paid, often by subscription	at Recht 24/7 €19.90 a month for all shop legal texts or €499 one-off for individual terms and conditions, each including VAT
Effort	high, you need to know the legal position	medium, fill in a questionnaire	low, provide details of your shop
Fits the shop	only as well as your legal knowledge	usually for standard shops, limited for special cases	individually tailored
Updates	by you	depending on the provider	ongoing on subscription
Liability	with you	depending on the provider	with the law firm, insured up to €2.5 million at Recht 24/7
Help with cease-and-desist letters	none	depending on the provider	advice and representation included in the Recht 24/7 subscription

What do legal texts for online shops cost? Depending on the route, from nothing up to a one-off lawyer's fee. At Recht 24/7, all legal texts together cost €19.90 a month including VAT, i.e. around €240 a year. Details on the page Legal texts for online shops. If you already have texts and want to know whether they hold up, a review of existing legal texts costs €259 including VAT.

Keeping legal texts up to date: what has changed recently

Most legal texts that receive cease-and-desist letters were not wrong from the start. They became wrong because laws changed. Examples from recent years:

Change	Since	What shops had to adapt
Cancellation button for consumer contracts (Sec. 312k BGB)	July 2022	cancellation option for subscriptions in the shop
Stating the lowest 30-day price for discounts (Sec. 11 PAngV)	May 2022	presentation of discounts
Digital Services Act (DDG) replaces the Telemedia Act	May 2024	statutory references in the legal notice
EU General Product Safety Regulation (GPSR)	December 2024	manufacturer and safety information on product pages
Accessibility Strengthening Act	June 2025	accessible shop, accessibility statement
Discontinuation of the EU online dispute resolution platform (Regulation (EU) 2024/3228)	20 July 2025	remove notice and link to the ODR platform
Electronic withdrawal function (Sec. 356a BGB)	19 June 2026	withdrawal button in the shop, notice in the cancellation policy

Plan a check of your legal texts at least once a year, and additionally whenever you add new tools, payment methods, countries or product groups.

Checklist: is your online shop legally compliant?

With this checklist you can make your online shop legally compliant, point by point. It does not replace an individual review, but it shows the typical gaps.

Legal texts

Ordering process

Products and marketing

Maintenance

Typical reasons for cease-and-desist letters in online retail

Legal texts are public; any competitor or association can check them in a few minutes. In practice, these mistakes lead to cease-and-desist letters particularly often:

1. Cancellation policy wrong. For example, a wrong period, a missing model form or an exception that does not even apply to the product range.
2. Legal notice incomplete. For example, for a UG the suffix "(haftungsbeschränkt)" or the managing director is missing.
3. Invalid clauses in the terms and conditions. Typical are shortened warranty periods and blanket exclusions of liability towards consumers.
4. Incorrect price information. Unit price missing, or a discount without stating the lowest price of the last 30 days.
5. Tracking without consent. Analytics or marketing cookies load before the visitor agrees.

Including the other side's legal fees, a cease-and-desist letter regularly costs a three- to four-figure amount. On top of that comes the cease-and-desist declaration with a penalty clause, which binds you for the future. If you have received a cease-and-desist letter, don't sign anything hastily; have it reviewed: Have a cease-and-desist letter reviewed by a lawyer for €169 including VAT. You can read more about prevention in the article Protecting your shop from cease-and-desist letters.