Operates a social platform, in Germany

NetzDG §§ 1, 4, 4a, 5 · Read the law's page

• If you operate for profit a platform on which users share any content with other users or make it available to the public, and no other Member State is your country of establishment under section 2 of the Digitale-Dienste-Gesetz, designate an authorized recipient in Germany for service of documents in German court proceedings about unlawful content, and draw attention to him on your platform in an easily recognizable and directly accessible manner (section 5).
• In an administrative procedure of the Bundesamt für Justiz, give it on request information about the measures taken to implement the Act, the number of registered users in Germany and the complaints about unlawful content received in the previous calendar year (section 4a(3)).

JMStV Sec. 5a · Read the law's page

• Applies to the provider of a video-sharing service established in Germany.
• Take appropriate measures to protect children and adolescents from offers that impair their development.
• Consider setting up and operating systems for age verification, and systems through which parents can control access to such offers.
• Set up systems with which users can rate the offers they upload, readable by the age verification and parental control systems.

MStV §§ 91-95, 115 · Read the law's page

• If you provide a media intermediary (a telemedium that also aggregates, selects and presents third parties' journalistic and editorial offerings in a generally accessible way) used in Germany and reaching one million users a month there, designate an authorized recipient in Germany for service of documents in fine proceedings and make him known in your offering in an easily recognizable and directly accessible manner (section 92).
• Keep easily perceptible, directly accessible and permanently available the criteria that decide whether content gains access to your media intermediary and whether it stays, and the central criteria of aggregation, selection and presentation of content and their weighting, including information on how the algorithms you use work, in understandable language (section 93(1)).
• If your media intermediary has a thematic specialization, make it perceptible through the design of your offering, and make changes to the published criteria or to that orientation perceptible without delay in the same way (section 93(2) and (3)).
• If you offer a social network, ensure that telemedia in it are labelled as section 18(3) requires, namely that content or messages created automatically by a computer program show that they are automated where the account used appears from its outward form to be meant for natural persons (section 93(4)).
• Do not discriminate against journalistic and editorial offerings on whose perceptibility you have a particularly high influence: do not systematically depart, without objectively justified reason, from your published criteria in favor of or to the detriment of a specific offering, and do not apply criteria that directly or indirectly unfairly and systematically hinder offerings (section 94(1) and (2)).
• Produce the necessary documents to the competent Landesmedienanstalt on request (section 95).

Medienstaatsvertrag (MStV), § 18 Abs. 3 · Read the law's page

• If you operate an automated account in a social network whose profile looks like one provided for natural persons, label each piece of content or message that a computer programme creates automatically as created and sent automatically using a programme that controls the account (Medienstaatsvertrag, section 18(3)).
• Place the notice legibly before or beside the content or message; it counts as automatic creation also where the programme sends a prepared content or a pre-programmed message (section 18(3)).
• If you provide a media intermediary that offers a social network, ensure that telemedia within the meaning of section 18(3) are labelled (section 93(4)).

JuSchG Sec. 24a · Read the law's page

• Applies to providers of online platforms that are accessible to minors in Germany.
• Take appropriate and proportionate measures to ensure a high level of privacy, safety and protection of children and teenagers within the service, the duty of Article 28(1) of Regulation (EU) 2022/2065 that Section 24a(1) recites and the BzKJ enforces.

UrhDaG §§ 1-22 · Read the law's page

• If your service stores and makes publicly available a large amount of copyright-protected content that users upload, which you organize and promote for profit, make best efforts to acquire the contractual rights for the public communication of those works; you meet this duty by acquiring rights that are offered to you, that are available through representative right holders you know, or that you can acquire through collecting societies or dependent exploitation bodies established in Germany (section 4(1)).
• Where an author granted the right of public communication to a third party other than a collecting society or a digital distributor, still pay the author appropriate remuneration for contractual uses (section 4(3)); pay appropriate remuneration for public communications for caricature, parody or pastiche (section 5(2)) and for presumably permitted uses (section 12(1)).
• Point your users, in your general terms and conditions, to the statutory permissions for quotation, caricature, parody, pastiche and the other permitted uses (section 5(3)).
• When a right holder demands it and supplies the information needed, block or remove the work and keep it unavailable as far as possible, according to high industry standards and proportionality (section 7(1)); on a sufficiently substantiated notice, end the public communication by blocking (section 8(1)). Do not make unavailable uploads whose use is legally permitted or that infringe no copyright (section 7(2)). Start-up providers are exempt from section 7(1) while their service has no more than 5 million different visitors a month on average, and small providers are rebuttably presumed not to be obliged (section 7(4) and (5)).
• Inform the user immediately of a blocking and of the right to complain under section 14 (section 7(3)), and inform the right holder immediately of the public communication of a presumably permitted use and of the right to complain (section 9(3)).
• Keep presumably permitted uses publicly communicated until the complaint procedure ends (section 9(1)); where an upload is to be blocked automatically at the time of upload and is not a minor use, tell the user of the blocking demand, point out the need for a statutory permission and let the user mark the use as legally permitted (section 11(1)); where it is to be blocked only after upload, treat it as presumably permitted for 48 hours even without a marking (section 11(2)).
• Run an effective, free and speedy complaint procedure for users and right holders, notify the complaint to all parties without delay, give them the opportunity to comment and decide within one week of filing, with decisions taken by impartial natural persons (section 14(1), (3) and (5)); where a trusted right holder declares after review by a natural person that the presumption of permitted use is to be rebutted and that continued communication significantly impairs economic exploitation, block immediately until the complaint procedure ends (section 14(4)).
• Exclude for an appropriate period, from the blocking procedures, a purported right holder who repeatedly demands the blocking of another's work as their own or of a work in the public domain, and from the marking of permitted uses a user who repeatedly marks a use falsely as permitted; ensure as far as possible that works abusively blocked are not blocked again (section 18(1), (4) and (5)).
• Give a right holder, on request, appropriate information on the contractual use of their repertoire and on how your procedures for blocking unauthorized uses work (section 19(1) and (2)).
• If you are not established in another Member State under section 2 of the Digitale-Dienste-Gesetz, appoint an authorized recipient in Germany for court proceedings in accordance with section 5 of the Netzwerkdurchsetzungsgesetz (section 20).

TerrOIBG §§ 1-7 · Read the law's page

• After receiving an enforceable removal order, remove the terrorist content and block access to it within one hour, as Article 3(3) of Regulation (EU) 2021/784 requires and as Article 4(2) read with Article 3(3) requires (section 6(1) numbers 1 and 3).
• As a hosting service provider, send the Bundesnetzagentur by 1 March of each year the information under Article 21(1), second sentence, point (c) of the Regulation for the previous calendar year (section 3(2)).
• Comply with the other duties of the Regulation that section 6(1) makes administrative offences to breach: informing the competent authority (Article 3(6), also as applied by Article 4(2), and Article 14(5) first sentence); restoring content and lifting a block after a decision under Article 4(7) or Article 10(2); taking the specific measures of Article 5(2), first subparagraph, within twelve months of the authority's finding of exposure; reporting under Article 5(5); acting on orders under Article 5(6) and Article 6(2), second sentence; preserving removed content and related data for the prescribed period (Article 6(1) with 6(2)); publishing the transparency report (Article 7(2) with (3)); setting up the complaint mechanism at the time the measure is taken and informing the complainant (Article 10(1) and (2)); giving the content provider the information and the copy that Article 11(1) and (2) require; notifying the contact point and passing on information without delay after becoming aware (Article 14(5) second sentence); designating and setting up a contact point (Article 15(1)); and designating a legal representative and notifying the authority (Article 17(1) and (4)).
• When using a technical means under Article 5(3), second sentence, ensure that material that is not terrorist content is not removed, and add to your terms and conditions, within twelve months of the authority's finding that you are exposed to terrorist content, the measures you take under Article 5(2), first subparagraph (section 6(2)).

DDG § 6 Abs. 3 und 4, §§ 10, 11 · Read the law's page

• If you operate a video-sharing platform, provide users who upload user-generated videos with a function to declare whether a video contains audiovisual commercial communication (section 6(3)).
• Label as such audiovisual commercial communication that users have uploaded on your video-sharing platform once you know of it, through a user's declaration or otherwise (section 6(4)).
• Agree effectively with your users that they may not distribute on the platform audiovisual commercial communication that breaches section 20 of the Tabakerzeugnisgesetz or section 10 of the Heilmittelwerbegesetz (section 11).
• Give the authority competent under Land law, on request, information on the criteria in section 2(2) to (7) of the Act, so far as it needs them for its tasks under section 9 (section 10(1)).

DDG §§ 12-14, 20, 25, 27, 29, 33 · Read the law's page

• Comply with the articles of the Digital Services Act whose breach section 33(4) and (5) of the Digitale-Dienste-Gesetz makes an administrative offence when committed intentionally or negligently (in the case of Article 16(6), repeatedly): Articles 9(1) and (5) first sentence, 10(1), 11(1) and (2) first sentence, 12(1) and (2) first sentence, 13(1) with 13(2), 13(4), 14(2) and (3), 15(1) (also as applied by Article 24(1)), 16(1) and (2), 16(5), 16(6) first sentence, 17(1) with 17(2) first subparagraph second sentence, 17(3) or 17(4), 20(1) with 20(2) or (3), 20(4) second sentence, 20(5) and (6), 21(1) second subparagraph, 22(1), 24(3) first sentence and (5), 25(1), 26(1), (2) and (3), 27(1) and (3), 28(2), 30(1), (3), (5), (6) and (7), 31(1) first subparagraph and (2), 32(1) and (2).
• If you are a person named in Article 51(1) of the Digital Services Act, give the Coordination Office for Digital Services, or the Bundeszentrale für Kinder- und Jugendmedienschutz or the Federal Commissioner for Data Protection and Freedom of Information where competent under section 12(2) and (3), the information it asks for, and tolerate the inspection of business records and entry to premises during normal business hours (section 25(1)).
• When an authority finds that you have not met a Digital Services Act obligation, comment within the reasonable time it sets and remedy the failure within the time it sets or without delay (section 27(2)).
• Comply with an order for the measures needed to ensure compliance that the authority issues under section 27(3) once the period for remedying has passed (section 27(3) and (4)).

DDG §§ 7, 8 · Read the law's page

• If you provide only the transmission of information a user supplies in a communications network, or access to a communications network, and a user used your service to infringe an intellectual property right, block the use of the information at the right holder's request where the right holder has no other way to remedy the infringement and the blocking is reasonable and proportionate (section 8(1) and (2)).
• Comply with court or authority orders to remove information or block its use; section 8(4) leaves them untouched even where you have limited responsibility under Articles 4 to 6 of the Digital Services Act and section 7.
• Do not deliberately collaborate with a user of your service to commit unlawful acts or to infringe another's intellectual property: the protection in section 7(3) and the exclusion of costs in section 8(3) do not apply if you do.
• If you give users internet access over a wireless local network, an authority may not require you to register users, to demand a password before access or to stop offering the service permanently; identifying users, requiring a password or taking other measures is voluntary (section 7(2)).

BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of 22 October 2026 (BGBl. 2026 I Nr. 318), § 32 · Read the law's page

• This binds a besonders wichtige Einrichtung or wichtige Einrichtung under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider among the digital-service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
• Notify the BSI's and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe's joint reporting office without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating whether the incident is suspected to be unlawful or malicious or to have cross-border effect.
• Follow with a full notification within 72 hours of becoming aware, confirming or updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on the BSI's request, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once you have finished handling it.
• Where you operate a critical facility (Betreiber kritischer Anlagen), additionally report the type of facility and critical service affected and the incident's effect on that service.

BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of 22 October 2026 (BGBl. 2026 I Nr. 318), §§ 28, 30, 38 · Read the law's page

• Adopt technical and organisational measures adequate and proportionate to the risks facing the network and information systems you use to provide your services, and to minimise the impact of a security incident on your services and on others.
• Cover at least: risk analysis and information-security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluation of your measures' effectiveness; basic cyber-hygiene training; cryptography; personnel security and access control; and multi-factor or continuous authentication.
• Document your compliance with this duty.
• Have your management body implement and oversee these measures and attend regular risk-management training; expect it to be liable to your organisation for culpable damage from a breach of that duty under the ordinary rules of company law.
• This binds a besonders wichtige Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider (Anlage 2 Nummer 6) among the digital-service providers it reaches expressly, at the wichtige Einrichtung threshold of at least 50 employees or an annual turnover and balance-sheet total each over EUR 10 million; the wider sector classes Section 28 also reaches (critical-facility operators, large telecommunications and digital-infrastructure providers including cloud computing, and public administration) are reached too, by declaring that you are an essential or important entity.

Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).
• Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).
• If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).
• If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).
• If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).
• Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).
• You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).
• Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17).