Match legal notices and privacy information to actual website operations

A legal notice and privacy information serve different purposes. The legal notice identifies the service provider and relevant contact details. Privacy information explains the actual processing of personal data. Both need to match the published website and responsible organisation. An updated company name does not resolve a missing newsletter integration. A lengthy privacy policy does not correct the wrong provider identity.

Jurisdiction and review date: Germany and the European Union, checked on 9 November 2026. This guide describes an inventory and editorial implementation process. It is neither individual legal advice nor a complete audit of a particular website. The examples are fictional. The required details and legal grounds must be assessed for the actual organisation.

Start with the actual service provider

The visible brand is not always the legal provider. A product name, agency identity or domain may belong to an individual business, a company or another organisation. Establish who actually provides the digital service before writing the notice. The details should rest on verifiable organisational records.

For companies, compare the legal form, representation, address and relevant registration details. Copying an existing page can preserve a former director or outdated address unnoticed. Another project's legal notice is not a reliable source of company data. Different brands within one group do not necessarily share the same provider.

A useful internal record links domain, service, legal provider and the person responsible for changes. This is an organisational recommendation rather than an additional duty to publish an internal project register. Visitors need the applicable provider information, not the organisation's complete internal allocation of responsibilities.

Assess the applicable legal-notice details

Section 5 of the German Digital Services Act contains general information requirements for the services within its scope. The information must be easily recognisable, directly accessible and permanently available. The current reference is the DDG. References copied unchanged from an old template to the former Telemedia Act should therefore be reviewed.

Depending on the case, relevant details include name and address, legal form and authorised representation for legal persons, and applicable registration information. The provision also requires details enabling rapid electronic contact and direct communication, including an email address. An unattended form alone should not be assumed to resolve the practical contact requirements of a particular service.

Further details apply under their respective conditions, including supervisory authorities, certain regulated professions, existing VAT or business identification numbers and liquidation status. Not every number held by a business should therefore be published. A private tax number is not interchangeable with those identifiers. Supervisory authorities or professional titles must not be borrowed from somebody else's template.

Consider additional editorial responsibility

Section 18 of the Interstate Media Treaty contains further information duties. The linked official version publishes the provision of the treaty between the German states. For journalistic and editorial services, paragraph 2 requires an additional responsible person with name and address under its conditions. That person must meet the legal requirements.

A corporate blog cannot be conclusively classified merely because it is called a blog. Its content, presentation and function need examination. Nor is the editorially responsible person automatically any project contact. Where several responsible people are named, the part of the service assigned to each must be apparent.

This assessment remains separate from provider identity. Correctly identifying an editorially responsible person does not replace required company information. Conversely, a company legal notice does not automatically answer every media-law question raised by an extensive editorial offering. The organisational record should show which requirement each published detail addresses.

Do not keep copying obsolete ODR platform notices

Many older templates still link to the European Online Dispute Resolution Platform. Regulation (EU) 2024/3228 repealed the underlying regulation with effect from 20 July 2025. New complaints could no longer be submitted from 20 March 2025. The former platform is consequently not a currently available complaint route that a contemporary template should continue advertising unchanged.

That does not remove every other consumer dispute resolution information duty. Section 36 of the German Consumer Dispute Resolution Act contains conditional general information requirements concerning willingness or obligation to participate and, where applicable, the competent conciliation body. The small-business exception in paragraph 3 concerns the specified information duty. It is not a general exemption from the entire Act.

Section 37 instead addresses information after an unresolved dispute concerning a consumer contract. That differs from the general website text. A duty to provide information and a duty to participate are also different questions. An accidental choice in a template must not replace the organisation's actual position.

Inventory processing activities rather than just tools

Privacy work begins with processes. What data arises when a page is requested? What happens to a contact enquiry? Who receives a newsletter registration? Does an external map load immediately or only after a separate action? The answer should cover the complete flow rather than ending at the visible form.

A contact form might send a message to a mailbox, save an additional record and involve an abuse-detection service. Whether this actually happens must be established. The description must not name a database that is not used. Equally, actual copies and recipients must not disappear from the inventory just because they are invisible in the browser.

The inventory therefore combines technical observation, contracts and information from responsible staff. A network inspection reveals certain browser requests. It does not by itself establish all subsequent server-side processing. Conversely, a supplier agreement does not prove a service is enabled on the published page. Both sides need comparison.

Present the information requirements understandably

Article 12 of the General Data Protection Regulation requires concise, transparent, intelligible and easily accessible information in clear language. Article 13 governs information where personal data is collected from the person concerned. Such information is generally required at collection. There is no general subsequent one-month allowance for that situation.

Relevant details include the controller, any applicable representative and data protection officer, purposes and legal bases, and recipients or recipient categories. They also include retention duration or its criteria, relevant individual rights and the right to complain. Withdrawal needs consideration where processing rests on consent.

Further information may be required for the particular activity, including legitimate interests, third-country transfers, obligations to provide data or certain automated decisions. A short section can be understandable, but it must not discard necessary information until only a tool name remains. Links to more detailed material can support an intelligible structure without concealing essential facts.

Where data is not obtained from the person concerned, Article 14 and its additional information, deadlines and exceptions need separate examination. Finding an address in a public source does not establish a blanket exemption. A changed processing purpose may also require further information before processing for that new purpose begins.

Do not assign purpose and legal basis by intuition

A legal basis does not fit merely because templates use it frequently. A particular enquiry about entering a contract differs from a voluntary marketing subscription. Security logs serve another purpose than detailed advertising profiles. A single catch-all sentence can hide these distinctions across several data flows.

The legal assessment must match actual operation. Where consent is intended, its purpose and later withdrawal should be clear. Where legitimate interests are relied upon, examine the applicable conditions and information requirements. Simply adding the phrase legitimate interest does not make processing lawful.

Privacy information does not create an otherwise missing permission. An unresolved legal-basis question belongs in internal clarification rather than being concealed by confident wording. For additional advertising and analytics functions, limiting or removing unnecessary processing can also be a sensible operational decision. The description should then be updated to reflect what remains.

Separate device access from subsequent processing

Section 25 TDDDG concerns storing information on users' devices and accessing information already stored there. Its scope is not limited to traditional cookies or personal information. It establishes a consent requirement and two bounded exceptions. Subsequent processing of personal data must additionally be assessed under the GDPR.

The strictly necessary exception relates to a digital service explicitly requested by the user. A function is not necessary merely because it helps the operator's commercial analysis. Conversely, the mere existence of a website does not require a consent window. The techniques and purposes actually used determine the assessment.

The Lower Saxony data protection authority's TDDDG information explains these separate questions and valid consent requirements. Older explanations must be read with their publication context. The current statute remains decisive. Referring to legitimate interests does not replace consent required by section 25 where no exception applies.

Inspect the published page in several states

Comparing text alone does not reveal whether an external service starts before the intended choice. Technical examination should begin with a fresh browser state. Rejection, consent and later withdrawal are then examined separately. A previously stored decision must not silently distort the first-visit observation.

Inspect relevant network connections, cookies and other storage mechanisms. The checks must fit actual functions. A deferred map can behave differently from a font file or analytics call. One incidentally uneventful page request does not prove complete technical or legal compliance.

A useful observation identifies the page, state, triggered connection and corresponding activity. Personal form content or complete session identifiers should not unnecessarily enter public evidence. Real enquiries require bounded handling of test data. A technical observation establishes behaviour within its conditions, while the legal conclusion still needs the wider facts.

A fictional operational record with open fields

The following example is an internal working record for a fictional contact activity. Unknown recipients and retention rules remain open. It is not a publishable privacy notice and grants no legal clearance. German keys are retained across both language versions.

{
  "lernfall": true,
  "vorgang": "KONTAKT-01",
  "ausloeser": "bewusstes Absenden des Kontaktformulars",
  "daten": ["Rueckmailadresse", "Nachricht"],
  "browser_beobachtung": "noch zu pruefen",
  "server_und_mailweg": "noch zu ermitteln",
  "empfaenger": null,
  "aufbewahrung": null,
  "rechtsgrundlage": "offen",
  "hinweisabschnitt": "Kontaktanfragen",
  "entscheidung": null
}

Replace these fields with supported facts after investigation. Responsibility for answers should be apparent. Development can explain the delivery route while operations knows actual handling and retention. Legal assessment follows from the evidence; it is not automatically calculated from an apparently complete list.

Publication brings the relevant information together in understandable language. Internal paths, credentials and manufacturing notes do not belong in the public explanation. The audience needs the actual process and its rights. Internally, the responsible organisation additionally needs the evidence supporting those statements.

Establish retention and recipients rather than guessing

A convenient number of days is no substitute for an existing deletion process. An enquiry can produce a message, mailbox copy, backup and later contract record with different contexts. Explain the actual purpose and relevant periods or criteria. One identical period everywhere is not automatically appropriate.

Recipients and their roles must also be accurate. Different organisations may provide hosting, email, analytics and maps. A supplier's legal form does not conclusively determine its data protection role. Necessary agreements, subcontractors and possible third-country connections must be examined against the actual service.

A link to another company's privacy policy can supplement information. It does not automatically replace the operator's own explanation. Nor can “all data stays in Germany” be inferred from one server location when other involved processing steps remain unknown. Avoid geographical assurances unsupported by the complete flow.

Check accessibility and consistency

The legal notice and privacy information should be reachable through understandable links. Checks should cover the homepage, internal pages, narrow layouts and the language versions actually offered. A consent window or another overlay must not practically prevent access to required information.

Compare related contact points too. Does the form identify a different controller from the privacy notice? Does the unsubscribe route reach the correct newsletter service? Is a new form already operating while only the previous flow is described? These inconsistencies provide concrete clues that records have diverged.

Repeat the comparison after changes. A new service, delivery route, company or analytics purpose can affect the notices. An updated date alone does not establish that review occurred. A short change record linked to the published version makes maintenance more accountable and targeted.

Checklist for the next comparison

Forms deserve particular attention to required fields. General enquiries do not necessarily need the same information as an order. Additional birth dates or postal addresses should serve an explainable purpose. A blanket mandatory checkbox saying the user agrees to a privacy policy does not establish the correct legal basis. The notice first provides information. Where a particular additional processing operation requires consent, that consent must fit its purpose.

A newsletter subscription cannot simply be inferred from a contact enquiry. Establish whether data actually enters a mailing list and what triggers that transfer. Examine confirmation evidence and unsubscribe behaviour in the real service. A description of a documented signup process is inaccurate if the application does not perform that process. Conversely, an unobtrusive default setting can create an additional activity that belongs in the assessment.

For external embeds, examining only the obvious main request may miss earlier connections. A preview image, font file or script can already contact another service. A visually quiet placeholder is therefore not automatically evidence that no relevant connection occurs before selection. This does not mean every connection requires identical consent. It means technical facts must be sufficiently understood before their legal classification.

Likewise, an analytics claim such as anonymous or cookie-free needs examination. The absence of one storage technique describes only part of the operation. Recorded events, addresses and other characteristics and their possible personal connection need separate assessment. A data-minimising configuration can matter, but it cannot be assumed merely from the product's name.

Finally, maintenance benefits from clear triggers. Adding a map or changing email providers should prompt consideration of the related notices and evidence in the same change. Someone needs responsibility and a record identifying the version examined. This also prevents a removed function from remaining indefinitely described as active processing. The goal is an accurate account of operation rather than a growing catalogue of every tool ever considered.

• Establish the legal provider and associated domains unambiguously.
• Check legal form, representation, address and relevant registration details.
• Assess additional professional, media and consumer information duties.
• Identify obsolete references to the discontinued ODR platform.
• Inventory processing from collection through recipients to deletion.
• Assess purpose, legal basis and possible consent for each activity.
• Distinguish first visit, rejection, consent and withdrawal technically.
• Describe retention, suppliers and routes using actual evidence.
• Make required information understandable and available at the appropriate time.
• Compare technology, operations and published wording after changes.

A reliable state comes from connecting facts with understandable information. The notices then match the actual service and remain maintainable when it changes.