A website can look professional and still be a liability. In Germany the legal layer is where small businesses get caught, because it is the part nobody looks at until a letter arrives. Rather than hand you a checklist and wish you luck, we run this pass on every build before launch.
I run this checklist on every site before it goes live, and I run it on sites people bring to me after something has gone wrong. It takes thirty minutes and it is worth doing properly.
1. Impressum: reachable in two clicks, complete, current
Every commercially operated site in Germany needs an Impressum, and it must be reachable in no more than two clicks from any page. That means a footer link, not something buried inside a privacy policy.
It must name a real legal entity, an address where documents can be received, at least one contact channel, the register number if you are in one, the VAT identification number if you have one, and the supervisory authority where a regulated profession applies. Handwerksbetriebe with a chamber membership often have disclosure obligations they do not know about.
The classic mistake is an Impressum that still shows the previous address, the previous owner, or a former agency's details. If your last builder put themselves down as the responsible party, that is their information on your legal page and it is your problem.
2. Cookie consent that actually blocks scripts
A banner that says "we use cookies" and then loads analytics, Meta pixel and a chat widget anyway is worse than no banner at all. Consent has to be given before the script runs, and refusing must be as easy as accepting.
Concretely, check three things. First, does a reject button exist on the first layer, at the same visual weight as accept? If a user has to open settings to say no, that is not valid consent. Second, do the scripts stay unloaded until consent is granted? Open the network tab, reload, decline, and look for anything hitting google-analytics.com, connect.facebook.net or a chat vendor. Third, is consent recorded and re-asked when the scope changes?
Most of this breaks because someone pastes a Google Tag Manager container into the head, and every tool configured inside it loads the moment the container loads. The fix is consent mode plus a proper CMP, or simply not using GTM for a small site.
3. AVV: the paperwork for every tool that touches personal data
An AVV, the Auftragsverarbeitungsvertrag under Article 28 DSGVO, is required for every processor handling personal data on your behalf. In practice that means your host, your email provider, your booking system, your newsletter tool, your CRM, your chat widget, and your analytics if it sees identifiable data.
Ask each vendor for their AVV. Serious providers have one linked in their footer. If a vendor cannot produce one, you cannot use them, and this is where a lot of cheap US SaaS tools fall over. Look specifically at where the data is processed and whether there are standard contractual clauses plus a transfer impact assessment behind it.
Keep the AVV documents somewhere you will find them in five minutes. When a customer asks who you share their data with, or when an authority asks, the answer is a folder, not a memory.
4. Data minimisation in your forms
Every field you collect needs a lawful basis, and every one of them is a thing you now have to protect, document and delete on request.
So ask what each field is for. Does your contact form really need a phone number and a company address, or does it need an email and one free-text box? Does the booking tool store a date of birth it will never use? Cut the fields you cannot justify, then check that the privacy policy names each remaining purpose.
Also check where submissions land. A form that emails you directly puts personal data in an inbox with no retention policy. A form that writes to a database you control is easier to answer a deletion request against.
5. Accessibility and the disclosure rules people forget
BITV and the Accessibility Strengthening Act now bite private operators in some circumstances, particularly in e-commerce and essential services. You do not need a full audit, but you do need alt text on meaningful images, real labels on form fields, keyboard navigation that reaches your menu, and colour contrast that survives a bright screen.
Then there is the platform disclosure layer. If you advertise on Google or Meta, your advertiser identity has to be verifiable. If you take bookings or payments, terms and a withdrawal notice for consumers are not optional. If you price things, the total price including VAT and any shipping has to be stated, and a "from" price with no clarification is a known warning-letter trigger.
6. Run the audit yourself, then keep it short
Do this once a year, and again whenever anyone adds a tool. The whole pass is: read your Impressum line by line, open the network tab and decline cookies, list every third-party script and match it to an AVV in your folder, delete two form fields, and check that your price display matches what you actually charge.
If you would rather someone else looked, send me your URL and I will tell you which of these you have already handled and which one is likely to cost you money first.
