Operates an app store, in Germany

Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).
• Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).
• If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).
• If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).
• If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).
• Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).
• You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).
• Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17).

JMStV Secs. 12, 12a and 12b, inserted by the Sechster Medienaenderungsstaatsvertrag (Sixth Interstate Treaty Amending Media Law Treaties), treaty in force 1 December 2025; transition rules in JMStV Sec. 25 · Read the law's page

• This treaty is in force but these duties are not yet: they apply one year after the KJM publishes its determination of the covered operating systems (due within one year of 1 December 2025), so by 1 December 2027 at the latest, or up to three years for systems in a current or completed production cycle.
• Applies to providers of operating systems commonly used by children and adolescents in Germany, as the KJM determines (smartphones, consoles, smart TVs and other devices enabling access to telemedia); non-updatable systems on devices already sold are exempt.
• Equip the operating system with a youth protection device (Jugendschutzvorrichtung) that can be activated, deactivated and adjusted in a simple, easily accessible and secured way and in which a child's age can be set.
• Once an age is set, restrict browsing to search engines with a secured search function, allow app installation only from distribution platforms whose apps carry a machine readable age label from a KJM recognized automated rating system, and make only age appropriate apps usable unless the parent individually unlocks them.
• If you run an app distribution platform, make sure the apps you carry have a machine readable age label from a KJM recognized automated rating system, because the operating system will allow installation only from platforms whose apps do; apps must read and respect the device age setting.