If you want to check your legal notice (Impressum) or your privacy policy, it is best to start with the formal points: whether both pages can be reached from every subpage, whether the usual mandatory information is present and whether trackers only load after consent has been given. These points can be determined well from the outside – and this is exactly where most notes arise in practice.
Checking formally means looking, not assessing
A formal check establishes whether something is there, not whether its content is appropriate. It answers questions such as “Is there an email address in the legal notice?” or “Does an analytics service already load before anyone clicks in the cookie banner?”. Whether a text correctly describes your actual situation, on the other hand, is a legal question. That is for a lawyer to clarify, or for data protection issues possibly also your data protection officer.
Common possible deficiencies in the legal notice
In Germany, the mandatory information in the legal notice is mainly set out in the DDG (Digitale-Dienste-Gesetz, the German Digital Services Act); depending on the legal form and sector, further requirements may apply. Typical notes in a formal check are:
- Hard to find: the legal notice can only be reached in a roundabout way, is missing on individual subpages or disappears in the mobile view.
- Incomplete contact details: there is only a contact form, but no email address.
- Missing company details: the legal form, persons authorised to represent the company such as the management, or register details are missing.
- VAT identification number missing, although the business has one.
- Outdated details: after a move or a change in management, the old information is still online.
- Legal notice as an image: the details can neither be copied nor read by screen readers.
Many of these points do not arise from carelessness, but because the business has developed and the website has not kept up.
Common possible deficiencies in the privacy policy
Under the GDPR (in German: DSGVO), the privacy policy is meant to explain to visitors which personal data the website processes and what rights they have. Formally, the following points are noticed most often:
- Not accessible: the link is missing, leads nowhere or is only present on the home page.
- No longer up to date: new services such as embedded videos, map services or an analytics tool do not appear, but services that were removed long ago do.
- Controller missing: it is not clear who is responsible for the data processing and how to reach them.
- Leftover templates: placeholders such as “[Company name]” are still in the text. This happens more often than you might think, and it is surprising how long it goes unnoticed.
- Trackers before consent: analytics or advertising services already load before visitors have agreed in the cookie banner. On the question of when consent is required, the main rules besides the GDPR are those of the TDDDG (the German Telecommunications Digital Services Data Protection Act).
What a formal check can do – and what it cannot
A formal check is a good early warning system, but no substitute for a legal review. It can reliably show whether pages can be reached, whether the usual information is present and whether trackers load before consent. If it is repeated regularly, it also notices when something changes, for example because an agency has installed a new plugin.
What a formal check cannot do is assess whether your texts are complete and accurate in the individual case. Nor does it include wording for legal texts. For such questions, it is advisable to consult a lawyer.
A short checklist for your website
You can answer these questions yourself in a few minutes:
- Can you find the legal notice and privacy policy on every page, including on a smartphone?
- Does the legal notice state the name, address, legal form, management and an email address?
- Are all the details up to date?
- Does the privacy policy name the services your website actually uses today?
- Does everything stay quiet as long as you have not yet clicked anything in the cookie banner?
Unfortunately, the last question cannot be answered with the naked eye. You will find further points on technology and security in the guide Website check: 10 points for every company website.
Formally checked with PlugTheBug
PlugTheBug checks the legal notice, privacy policy and other legal texts regularly and exclusively formally: whether mandatory information is present and accessible, whether the privacy page can be reached and whether trackers load before consent. There is no legal assessment of the individual case and no suggested wording – your lawyer remains responsible for that. Every finding is measured a second time before it is sent, and you only receive notes that really matter.
If you would like to know how your legal texts stand formally, have your website checked or compare the PlugTheBug packages.