Germany

KI-MIG names the Bundesnetzagentur as Germany's central market surveillance authority for the EU AI Act. The Bundesnetzagentur is also the Regulation's single point of contact under Article 70. The Bundesnetzagentur is the Regulation's central complaints office under Article 85. The Bundesanstalt für Finanzdienstleistungsaufsicht is instead the market surveillance authority for an AI system that a regulated financial undertaking it already supervises places on the market.

A competent Land authority is the market surveillance authority instead where a Land public body deploys an AI system. A competent Land authority is also the market surveillance authority where a broadcaster or media service provider deploys an AI system for a journalistic or advertising purpose. A person who fails to carry out or update the fundamental rights impact assessment that Article 27 requires commits a national administrative offense.

The operator of a high-risk AI system under point 1, 3, 4 or 5 of Annex III who fails to give an affected person the explanation Article 86 requires commits the same national administrative offense. That administrative offense is punishable by a fine of up to 50,000 euros. A violation of the Regulation under Article 99(3) to (5) is instead prosecuted in Germany through the OWiG administrative-offense procedure.

The Bundesnetzagentur separately operates at least one KI-Reallabor, an AI regulatory sandbox, under Articles 57 and 58. A provider of a high-risk AI system listed in point 2 of Annex III to the Regulation, or its authorised representative, must register itself and the system in the Bundesnetzagentur's non-public register before placing the system on the market or putting it into service. That provider duty does not apply to a public body of a Land.

A deployer that is a federal public body must register itself and such a system in the same register before putting the system into service or using it.

Section 90(1), point 3 of the Betriebsverfassungsgesetz requires the employer to inform the works council in good time, with the necessary documents, about the planning of work procedures and work flows, including the use of artificial intelligence. Under section 90(2) the employer must discuss the intended measures and their effects on the employees with the works council early enough that the works council's proposals and concerns can be taken into account in the planning.

Section 95(1) makes guidelines on personnel selection for hirings, transfers, regroupings and dismissals subject to the works council's consent. Section 95(2a) applies subsections 1 and 2 also where artificial intelligence is used in drawing up those guidelines. Section 80(3) treats calling in an expert as necessary where the works council must assess the introduction or application of artificial intelligence to carry out its tasks.

Works councils are elected in establishments that regularly have at least five permanent employees entitled to vote, of whom three are eligible for election. The Act does not apply to administrations and establishments of the federal government, the Länder, the municipalities and other public-law corporations, institutions and foundations. The Government's bill for the amending Act provided that the Act enters into force on the day after promulgation.

The Bundestag committee's report renumbered that article as Article 6. The Bundesrat records the Act's promulgation in Federal Law Gazette Part I, number 32, of 17 June 2021, so sections 80(3), 90(1) number 3 and 95(2a) came into force on 18 June 2021.

Section 18(3) of the Medienstaatsvertrag requires providers of telemedia in social networks to make clear that content or messages were created automatically by means of a computer programme, where the user account used was provided, by its outward appearance, for use by natural persons. The notice must be placed legibly before or beside the content or message and must state that it was created and sent automatically using a computer programme that controls the user account.

Creating includes not only generating content immediately before sending but also falling back on prepared content or a pre-programmed message when sending. Under section 93(4), providers of media intermediaries that offer social networks must ensure that telemedia within the meaning of section 18(3) are labelled. Failing to make the labelling that section 18(3) requires is an administrative offence under section 115.

Section 115(2) allows a fine of up to EUR 500,000, with lower ceilings only for offences numbered 1, 49 and 50 in the second sentence of section 115(1). The treaty that contains the Medienstaatsvertrag entered into force on 7 November 2020.

A controller must notify the competent supervisory authority without undue delay and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

BDSG Section 43(4) allows a notification under Article 33 or a communication under Article 34(1) to be used in administrative-offence proceedings against the person who made it, or that person's relatives, only with that person's consent.

The General Data Protection Regulation (GDPR) applies directly in Germany, and the Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017) as amended, supplies domestic derogations and procedural rules, most significantly Section 26 (employment data), Section 31 (scoring and credit reports) and Section 37 (automated decisions in insurance).

The BDSG adds rules of its own on the lawfulness of processing beside GDPR Article 6, in Section 4 (video surveillance), Section 22 (special categories), Section 24 (further use for other purposes) and Section 26 (employment). Enforcement is divided between the federal BfDI and the supervisory authorities of the Laender. The BfDI supervises federal public bodies and companies providing telecommunications services under BDSG Section 9(1).

The BfDI also supervises companies providing postal services, under Section 71(1) of the Postgesetz. The authorities designated under Land law supervise private-sector bodies under BDSG Section 40(1). The independent data protection authorities of the federation and the Laender make up the Datenschutzkonferenz.

Transferring personal data of a person in Germany outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier.

BDSG Sections 32 and 33 add exceptions to the duty to tell a person about the processing of their data, beyond those in General Data Protection Regulation (GDPR) Articles 13(4) and 14(5).

Under Section 32, a controller that collected the data from the person need not give the Article 13(3) information about a further processing of analog data where it writes to the person directly, the purpose is compatible, the contact is not digital and the person's interest is minor, and in four other cases: a public body whose tasks would be endangered, a danger to public security, harm to legal claims, and a danger to a confidential transmission of data to public bodies.

Under Section 33, where the data came from someone else, a public body need not give the Article 14 information if it would endanger its tasks or public security and the person's interest must give way.

A private body need not give it if it would impair the assertion, exercise or defense of civil-law claims, or if the data come from civil-law contracts and serve to prevent damage from crimes, unless the person's legitimate interest in being informed outweighs, or where the competent public authority has found that disclosure would endanger public security.

Where it withholds information, the controller must take suitable measures to protect the person's legitimate interests, including making the Article 13 or 14 information available to the public in plain language, and must record in writing why it withheld the information. Section 32 lifts both duties for the legal-claims and confidential-transmission cases.

A controller that withholds information only because of a temporary obstacle must give it within a reasonable time after the obstacle ends, and within two weeks at the latest. Section 36 removes the right to object under Article 21(1) against a public body where a compelling public interest in the processing outweighs the person's interests or a law obliges the processing.

General Data Protection Regulation (GDPR) Article 22 gives a person in Germany the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

BDSG Section 37 is Germany's Article 22(2)(b) law for insurance: in performing an insurance contract, a solely automated decision may be made where it grants the person's request in full, or where it applies binding fee rules for medical treatment and the insurer lets the person obtain human intervention, state their view and contest the decision. Section 31 sets conditions for using a probability score about a person's future conduct.

In SCHUFA (Case C-634/21, judgment of 7 December 2023), the CJEU held that the automated establishment of such a probability value is itself automated individual decision-making under Article 22(1) where a third party draws strongly on it to establish, implement or terminate a contractual relationship. Under Article 3 of the Act of 12 May 2026 (Federal Law Gazette 2026, Part I, number 139), section 31 of the BDSG is repealed and a new section 37a, headed Scoring, is inserted after section 37.

That Act takes effect on 20 November 2026, so section 31 binds until then and section 37a governs scoring from that date. Under section 37a, paragraph 4, a controller that creates scoring values must store for one year the information needed to answer a data subject's request about the data used, the criteria, their weighting, the score and its recipients.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Germany can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. BDSG Sections 34 and 35 narrow the rights of access and erasure for any controller.

Section 34(1) number 2 removes the access right for data kept only because a statutory or bylaw-based retention duty forbids deleting them. Section 34(1) number 2 also removes it for data kept exclusively for data backup or data-protection audit, but only where access would take disproportionate effort and processing for any other purpose is excluded by suitable technical and organisational measures.

Section 35 replaces erasure with restriction where non-automated storage makes erasure impossible or disproportionately costly and the person's interest in erasure is minor, unless the data were processed unlawfully.

The Datenschutzkonferenz consists of the independent data protection authorities of the federation and the Laender. BDSG Section 42 adds criminal offenses, punishable by imprisonment of up to three years or a fine, for knowingly passing on or making available non-public personal data of a large number of people without authorization and on a commercial basis. Article 82 gives any person who has suffered material or non-material damage a right to compensation from the controller or processor.

In Case C-300/21, the CJEU held that Article 82(1) precludes a national rule or practice that makes compensation for non-material damage subject to the damage reaching a certain degree of seriousness.

In Case C-319/20 (Verbraucherzentrale Bundesverband v Meta Platforms Ireland), the CJEU held that Article 80(2) does not preclude national legislation allowing a consumer protection association to bring proceedings without a mandate from a data subject, on the basis of a breach of consumer protection law.

Under Section 4(1) of the Verbraucherrechtedurchsetzungsgesetz (VDuG), a qualified body's representative action is admissible only if it shows that the claims of at least 50 consumers may be affected by a redress action, or that the claims or legal relationships of at least 50 consumers may depend on the declaratory aims.

General Data Protection Regulation (GDPR) Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

BDSG Section 26(3) allows special categories of data to be processed for employment purposes where that is necessary to exercise rights or meet legal duties under employment law, social security law and social protection law and nothing suggests that the person's interest in excluding the processing prevails. Under Section 26(2), the dependence of the employee and the circumstances in which consent was given are weighed in judging whether consent is voluntary.

Under Section 26(3), consent to the processing of special categories must expressly refer to those data. In Case C-34/21 (judgment of 30 March 2023), the CJEU held that national legislation cannot be a 'more specific rule' under Article 88(1) of the GDPR where it does not meet the conditions of Article 88(2). A voiceprint or faceprint captured for identification is covered identically to a fingerprint. GDPR draws no distinction by modality.

On 27 January 2021 the Hamburg Commissioner for Data Protection and Freedom of Information ordered Clearview AI to remove the biometric data of a German citizen who had made an access request.

The Act governs genetic examinations and genetic analyses of born people and of embryos and fetuses, and the handling of the samples and genetic data they yield, for medical purposes, to establish parentage, in insurance and at work, and it does not apply to research or to examinations under criminal-procedure, police or infection-control rules.

A diagnostic genetic examination may be carried out only by physicians, and a predictive one only by specialists in human genetics or physicians with a qualification for genetic examinations. An examination or analysis, and the taking of the sample it needs, requires the person's express written consent to the responsible physician, which also covers the processing of the genetic data, and the person may withdraw it at any time with effect for the future.

Before consent the physician must explain the nature, significance and scope of the examination and allow reasonable time to decide. The physician keeps the results in the examination records for ten years, and a sample may be used only for the purposes for which it was obtained and must be destroyed without delay once it is no longer needed for them or consent is withdrawn.

An insurer may not, before or after the contract, demand a genetic examination or analysis, or demand, accept or use the results of earlier ones, although the bar on results does not apply to life, occupational disability, earning-capacity and care annuity insurance where the benefit agreed exceeds EUR 300,000 or an annual pension of EUR 30,000.

An employer may not, before or after the employment begins, demand a genetic examination or analysis, or demand, accept or use the results of earlier ones, and no one may be disadvantaged because of their own genetic characteristics or those of a genetically related person.

Carrying out an examination or analysis without the required consent is punishable by imprisonment of up to one year or a fine, and listed breaches of the Act's other duties carry a fine of up to EUR 50,000, which does not apply where the General Data Protection Regulation (GDPR) applies directly.

The Act applies to the processing of health data for research, to improve health care and nursing, and for other purposes in the public interest. Where health data are processed for scientific research and the other purposes the Act names, it takes precedence over Books V and XI of the Social Code.

A data-processing health care facility may further process health data it stores lawfully under General Data Protection Regulation (GDPR) Article 9(2)(h) or (i) where necessary for quality assurance, patient safety, research or statistics, and must pseudonymize the data and anonymize it as soon as the purpose allows. Where several people work in the facility, it must create a rights and roles concept so that only authorized persons can further process the data and each further processing is logged.

Data further processed this way must be deleted no later than 30 years after the further processing began. Passing the personal data to third parties is prohibited unless the data subject has consented or another federal, state or EU law provides for it. The facility must inform the public in clear and simple language of the purposes for which it further processes data.

Users of health data made available for scientific research may use the data only for the purposes for which they were made accessible and may not pass it to third parties. The data may not be processed to establish a link to a person or to identify care providers or payers.

Where a project processes health data under the Act for research without the consent of the data subjects, those responsible must register it in a primary register for clinical trials recognized by the World Health Organization before the processing starts, where such a register allows the registration. Those responsible must publish the results in anonymized form within 24 months of the project's end and deposit them in the primary register where the project was registered.

From 15 January 2025, health insurance funds must give each insured person who has not objected within six weeks of being informed under Section 343 an electronic patient record approved by the Gesellschaft für Telematik. The record must technically allow insured persons to consent to access to specific documents and data sets as well as to groups of them. The record must by default limit the access of authorized care providers to one week.

The record must allow insured persons to object to access by individual authorized parties, either to all data or only to the data of single use cases.

Section 202a punishes, with imprisonment of up to three years or a fine, unlawfully obtaining access, for oneself or another, to data that is not intended for oneself and is specially secured against unauthorised access, by overcoming that access security.

Section 202b punishes, with imprisonment of up to two years or a fine, unlawfully obtaining such data for oneself or another using technical means from a non-public data transmission or from a data-processing installation's electromagnetic emissions, unless a more severe provision applies.

Section 202c punishes, with imprisonment of up to two years or a fine, preparing such an offence by producing, obtaining, selling, supplying, distributing or otherwise making accessible passwords or other security codes enabling access to such data, or computer programs designed to commit such an offence.

Section 202d punishes, with imprisonment of up to three years or a fine, obtaining, passing on, distributing or otherwise making accessible data that is not generally accessible and that another person obtained through an unlawful act, in order to enrich oneself or a third party or to harm another, with an exemption for acts performed exclusively in fulfilment of lawful official or professional duties.

Section 303a punishes, with imprisonment of up to two years or a fine, unlawfully deleting, suppressing, rendering unusable or altering data, and the attempt is itself punishable.

Section 303b punishes substantially disrupting a data-processing operation of essential significance to another through such conduct, with imprisonment of up to three years or a fine, rising to up to five years where the data processing is of essential significance to an outside business, undertaking or public authority, and, in especially serious cases, to imprisonment of six months to ten years, a category the statute names as including causing a loss of great magnitude, acting commercially or as a member of a gang formed for repeated computer sabotage, or impairing the population's supply of essential goods or services or the Federal Republic's security.

Sections 202b and 202c took effect on 11 August 2007, the day after the promulgation of the Forty-first Criminal Law Amendment Act. That Act was issued in the Federal Law Gazette, Part I, Number 38, on 10 August 2007. The same Act rewrote section 202a(1), a section that already existed. Section 202d took effect on 18 December 2015, the day after the promulgation of the Act introducing a data-retention duty and a maximum retention period for traffic data.

That Act was issued in the Federal Law Gazette, Part I, Number 51, on 17 December 2015. Because section 202a's offence turns on overcoming an access-security measure, a scraper reading a public, unauthenticated page without defeating any technical access control falls outside a plain reading of the provision.

A provision in standard terms is ineffective where it unreasonably disadvantages the other party to the user of the terms contrary to the requirements of good faith, and an unreasonable disadvantage can also arise from the provision not being clear and understandable.

In case of doubt an unreasonable disadvantage is presumed where a provision cannot be reconciled with essential principles of the statutory rule it departs from, or limits essential rights or duties arising from the nature of the contract so far that attaining the contract's purpose is endangered. The content control applies only to provisions that depart from legal provisions or supplement them, although other provisions can still be ineffective for lack of clarity.

Standard terms are all contract conditions pre-formulated for a multitude of contracts that one party, the user, presents to the other party when the contract is concluded. Contract conditions are not standard terms to the extent that the parties negotiated them individually. Toward a business, a legal person under public law or a special fund under public law, section 305 paragraphs 2 and 3, section 308 numbers 1 and 2 to 9 and section 309 do not apply to standard terms.

Where a provision is ineffective or did not become part of the contract, the rest of the contract stays in force and its content follows the statutory provisions. The official consolidated text of section 307 prints no day on which it took effect.

Effective technical measures protecting a work or other protected subject matter may not be circumvented without the rightholder's consent where the person knows or ought to know that the circumvention is meant to give access to it or to enable its use. A technical measure is effective where the rightholder controls use of the work through an access control, a protection mechanism such as encryption, distortion or other transformation, or a copy-control mechanism.

Manufacture, import, distribution, sale, rental and advertising for sale or rental, commercial possession of devices, products or components, and the provision of services, are forbidden where they are marketed to circumvent such measures, have only a limited commercial purpose beyond circumvention, or are mainly designed or provided to enable or facilitate it.

A rightholder that applies technical measures must give the beneficiaries of the listed copyright exceptions, which include text and data mining under section 44b, the means to use them to the extent required, where they have lawful access to the work. An agreement excluding that obligation is void.

Circumventing an effective technical measure to gain access to a protected work or its use, other than solely for the offender's own private use, is punishable by imprisonment of up to one year or a fine. Where the offender acts commercially the penalty is imprisonment of up to three years or a fine.

Selling, renting or distributing circumvention devices beyond the offender's personal circle, or possessing or advertising them for commercial purposes, is an administrative offence punishable by a fine of up to EUR 50,000.

Text and data mining is defined as the automated analysis of one or more digital or digitised works to derive information, in particular about patterns, trends and correlations. Reproducing lawfully accessible works for text and data mining is permitted, and the reproduction must be deleted once it is no longer needed for that purpose.

This use is permitted only if the rightsholder has not reserved it, and a reservation over a work accessible online is effective only if made in machine-readable form.

This is Germany's transposition of the EU text-and-data-mining exception and its opt-out mechanism, applicable to AI-model training and other automated collection of lawfully accessible text and data, including web-scraped content, and it is expressly extended to the sui generis database right by the database-right provision's own limitations clause.

Reproductions for text and data mining are permitted for purposes of scientific research, without the machine-readable opt-out that limits the general exception, for research organisations (universities, research institutes or other bodies conducting scientific research that pursue no commercial purpose, reinvest all profits into scientific research, or act under a state-recognised public-interest mandate, but excluding an organisation under a private undertaking's determining influence with preferential access to the research results), for publicly accessible libraries and museums and for archives and film- or sound-heritage institutions, and for individual researchers pursuing no commercial purpose.

Those entitled who pursue no commercial purpose may make such reproductions available to a defined circle of persons for their joint scientific research, and to individual third parties to verify the quality of scientific research, but must end that availability once the joint research or the quality check is complete.

Research organisations and publicly accessible libraries, museums, archives and film- or sound-heritage institutions may retain the reproductions, with reasonable security precautions against unauthorised use, for as long as needed for scientific-research purposes or to verify research findings. Rightsholders may take necessary measures to prevent these reproductions from endangering the security and integrity of their networks and databases.

A database is a collection of works, data or other independent elements arranged systematically or methodically and individually accessible, whose obtaining, verification or presentation required a substantial investment by type or extent; the database maker is whoever made that investment.

The maker holds the exclusive right to reproduce, distribute and publicly communicate the database as a whole or a substantial part of it by type or extent, and repeated, systematic reproduction, distribution or communication of insubstantial parts is treated the same way where it conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests.

The right does not reach reproduction of a substantial part for private use of a database whose elements are not individually electronically accessible, for scientific research, for illustrating teaching, for text and data mining under section 44b, for text and data mining for scientific research under section 60d, or for preservation, and separately permits use in court, arbitral or administrative proceedings and for public-security purposes.

The right lasts fifteen years from the database's publication, or from its making if it was not published within that period.

A contractual term obliging an owner of a lawfully marketed copy of the database, or another person lawfully entitled to use it, to refrain from reproducing, distributing or communicating an insubstantial part of the database is void to the extent that doing so conflicts neither with the database's normal exploitation nor unreasonably prejudices the maker's legitimate interests.

The Act of 18 April 2019 serves to implement Directive (EU) 2016/943. The Act took effect on 26 April 2019. A trade secret is information that is not generally known or readily accessible to the persons in the circles that normally deal with that kind of information and therefore has economic value, that is subject to reasonable secrecy measures by its lawful holder, and in whose secrecy there is a legitimate interest.

A trade secret may not be obtained by unauthorized access to, appropriation of or copying of documents, objects, materials, substances or electronic files that are under the holder's lawful control and contain the secret or from which it can be derived, or by any other conduct that does not accord with good faith and honest market practice.

A person who obtained a trade secret through an act of their own that is prohibited under paragraph 1, or who breaches an obligation to restrict its use or an obligation not to disclose it, may not use or disclose it. A person who obtained a trade secret through another person may not obtain, use or disclose it where, at the time, they know or ought to know that the other person used or disclosed it contrary to the prohibition on use and disclosure.

A trade secret may be obtained by observing, studying, dismantling or testing a product or object that has been made publicly available, or that is in the observer's lawful possession and not subject to a duty restricting its acquisition. Obtaining, using or disclosing a trade secret is also permitted where a law, a basis in law or a legal transaction allows it.

The prohibitions do not apply where obtaining, using or disclosing a trade secret protects a legitimate interest, in particular the exercise of freedom of expression and information. The holder may claim against the infringer for removal of the impairment and, where repetition is likely or an infringement threatens for the first time, for an injunction. An infringer who acts intentionally or negligently owes the holder compensation for the resulting damage.

Obtaining a trade secret contrary to section 4, paragraph 1, number 1 is punishable by imprisonment of up to three years or a fine where the offender acts to promote competition, for personal gain, for the benefit of a third party or intending to harm the owner of a business. Where an offence under section 23, paragraph 1 or 2 is committed on a commercial basis, the maximum is imprisonment of up to five years or a fine.

Unfair commercial acts are prohibited generally, and a commercial act directed at or reaching consumers is unfair where it does not conform to professional diligence and is capable of materially influencing the consumer's economic behaviour, alongside a fixed annex of acts that are always unlawful toward consumers.

Separately, a person acts unfairly toward a competitor by denigrating or disparaging that competitor's identifying marks, goods, services, activities, or personal or business circumstances; by asserting or spreading unproven facts capable of damaging a competitor's business or credit; by offering goods or services that imitate a competitor's, where that causes an avoidable deception of buyers about commercial origin, unfairly exploits or impairs the reputation of the imitated goods or services, or was achieved through dishonestly obtained knowledge or documents; or by targeted obstruction of a competitor.

A person who intentionally or negligently commits an unlawful commercial act under these provisions is liable to a competitor for the resulting damage. The Zweites Gesetz zur Änderung des Gesetzes gegen den unlauteren Wettbewerb, which set sections 3 and 4 out anew, takes effect the day after its promulgation. The Act was issued in the Federal Law Gazette on 9 December 2015.

Section 327f(1) of the Bürgerliches Gesetzbuch (BGB) requires a trader (Unternehmer) supplying a digital product to a consumer to ensure that the consumer is provided, during the relevant period, with the updates needed to keep the product in conformity with the contract, and is informed about them. The necessary updates include security updates.

The relevant period is the supply period for a contract on the continuous supply of a digital product, and otherwise the period the consumer can expect given the nature and purpose of the product and the circumstances and type of contract.

Under Section 327f(2), the trader is not liable for a defect that is due solely to the consumer's failure to install a provided update within a reasonable time, if the trader informed the consumer of the update and of the consequences of not installing it and the failure was not due to defective installation instructions.

The provision applies to consumer contracts on a digital product concluded from 1 January 2022 and, under Article 229 Section 57 of the Introductory Act to the BGB, to earlier contracts where supply takes place from that date.

Section 30 requires a besonders wichtige Einrichtung or wichtige Einrichtung, as Section 28 defines them against the Anlage 1 and Anlage 2 sector lists, to adopt appropriate, proportionate and effective technical and organisational measures to avoid disruption to the availability, integrity and confidentiality of the network and information systems it uses to provide its services, and to minimise the impact of a security incident, weighing risk exposure, size, implementation cost, and the likelihood and severity of incidents.

The measures must cover at least ten baseline categories: risk analysis and information-security policy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition and development including vulnerability management and disclosure, evaluation of measures' effectiveness, basic cyber-hygiene training, cryptography, personnel security and access control, and multi-factor or continuous authentication, transposing NIS2 Article 21.

Anlage 2 Nummer 6 names an online marketplace, an online search engine and a social-networking-platform provider among the digital-service providers this duty reaches expressly. Section 38 places implementation and oversight of these measures on the entity's management body, which is liable to the entity for culpable damage under the ordinary rules of company law and must attend regular training on recognising and assessing risk and risk-management practice.

Section 165(1) of the Telekommunikationsgesetz (TKG) requires anyone who provides telecommunications services or contributes to them to take appropriate technical precautions and other measures, taking the state of the art into account, to protect the secrecy of telecommunications and against personal-data breaches.

Section 165(2) requires an operator of a public telecommunications network or provider of a publicly available telecommunications service to take appropriate technical and organisational precautions and other measures against disruptions that significantly impair networks and services and to control the risks to their security.

Where the operator or provider is an essential or important entity under Section 28 of the BSI Act, Section 165(2a) requires the Section 165(2) measures to follow an all-hazards approach and to cover at least ten categories, among them risk analysis and security concepts, incident handling, business continuity, supply-chain security, vulnerability management, cryptography, access control and multi-factor authentication.

Under Section 165(2b) the management of such an entity must implement the measures and monitor their implementation, and under Section 165(2d) it must take part in regular training. Operators and providers with increased hazard potential must use attack-detection systems under Section 165(3), and operators of public networks with increased hazard potential may use critical components only after a recognised certification body has examined and certified them under Section 165(4).

Operators of public networks with increased hazard potential must undergo a review by a qualified independent body or competent national authority every two years under Section 165(9). The Act entered into force on 1 December 2021.

Section 80(1) of the Wertpapierhandelsgesetz (WpHG) sets organisational duties of an investment services firm (Wertpapierdienstleistungsunternehmen).

Article 4 number 12 of the Financial Market Digitalisation Act (FinmadiG, BGBl. 2024 I Nr. 438 of 27 December 2024) added to Section 80(1) sentence 2 number 1 the requirement that, to keep its services continuous and regular, the firm rely on suitable and proportionate systems, including the ICT systems set up and managed under Article 7 of Regulation (EU) 2022/2554 (DORA), and on suitable and proportionate resources and procedures.

The same Article reworded number 4 to require the firm to have sound security mechanisms to meet the requirements of DORA that secure and authenticate the channels of information transfer, minimise the risk of data corruption and unauthorised access and prevent information leaks, so that data confidentiality is always ensured. Under Article 23 of the FinmadiG, the amendments of Article 4 not listed for 28 December 2024, among them number 12, took effect on 30 December 2024.

Section 32 requires a besonders wichtige Einrichtung or wichtige Einrichtung to notify a joint reporting office run by the BSI and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe of a significant security incident on a graduated clock.

It requires an early warning within 24 hours of becoming aware of the incident, stating whether it may be unlawful or malicious or have cross-border effect, followed by a full notification within 72 hours that confirms or updates that assessment with the incident's severity, impact and any indicators of compromise, and an intermediate report on the BSI's request.

A final report is due within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report after its resolution, transposing NIS2 Article 23. A Betreiber kritischer Anlagen must additionally report the type of critical facility and critical service affected and the incident's effect on that service. Section 32(1) provides that the duty applies at the earliest from the establishment of the reporting channel.

The BSI states that the reporting duties have applied since 6 December 2025. The BSI-Portal serves as the reporting office for serious security incidents, and an entity affected from 6 December 2025 that suffers a significant incident before it has registered there reports it through an online form.

Section 6(1) requires providers of digital services, for commercial communications that are digital services or parts of digital services, to observe at least that commercial communications are clearly recognizable as such and that the person on whose behalf they are made is clearly identifiable. It also requires promotional offers such as price reductions, extras and gifts to be clearly recognizable, with the conditions for claiming them easily accessible and clearly and unambiguously stated.

Prize competitions or games with promotional character must likewise be clearly recognizable, with the participation conditions easily accessible and clearly and unambiguously stated. Section 6(2) provides that where commercial communications are sent by electronic mail, neither the sender nor the commercial character of the message may be disguised or concealed in the header and subject lines.

Disguise or concealment exists where the header or subject line is deliberately designed so that the recipient gets no or misleading information about the sender's actual identity or the commercial character of the message before reading the content. Section 6(5) leaves the provisions of the Gesetz gegen den unlauteren Wettbewerb and the Preisangabenverordnung unaffected.

Section 33(1) makes it an administrative offence to disguise or conceal, deliberately, the sender or the commercial character of the message contrary to section 6(2), first sentence. Section 33(6) number 1(a) sets a maximum fine of 300,000 euros for that offence. The Act took effect on 14 May 2024.

Section 7(2) number 2 deems an unreasonable harassment always present where a person advertises using an automatic calling machine, a fax machine, or electronic mail without the addressee's prior express consent.

Section 7(3) excuses electronic-mail advertising from that consent requirement where a business obtained the customer's electronic address in connection with selling them a good or service, uses it only to market its own similar goods or services, the customer has not objected, and the customer was clearly told at collection and at every use that they may object at any time at no cost beyond the basic transmission tariff.

Section 7(2) number 3 separately deems an unreasonable harassment always present where an advertising message disguises or conceals the identity of the sender on whose behalf it is transmitted, breaches the commercial-communication labelling duties of Digitale-Dienste-Gesetz § 6(1) (which requires a commercial communication to be clearly identifiable as such, its sender clearly identifiable, and any promotional offer or prize draw clearly identifiable with easily accessible terms) or invites the recipient to a website that itself breaches that duty, or carries no valid address the recipient can use to ask that such messages stop at no cost beyond the basic transmission tariff.

Only the automatic-calling-machine limb of number 2, when directed at a consumer, shares the administrative fine of up to 300,000 euros that UWG § 20(1) number 1 attaches to unconsented telephone advertising; the fax and electronic-mail limb of number 2 and all of number 3 carry no administrative fine of their own under the Unfair Competition Act and are enforced only through the civil injunction and damages actions of UWG §§ 8 and 9.

The Digitale-Dienste-Gesetz separately fines a deliberate disguise of an email's sender or commercial character in its header or subject line up to 300,000 euros under its own § 33(1), (6) number 1(a).

The Einwilligungsverwaltungsverordnung regulates the requirements a consent-management service must meet to be recognized, the procedure for recognition by an independent body, and the technical and organizational measures that providers of digital services and manufacturers and providers of software for retrieving and presenting information from the internet should take so that end users' settings can be followed.

Section 1(2) leaves the provider of digital services responsible for meeting the information duties and the requirements for the validity of consent under the General Data Protection Regulation (GDPR). Section 8 makes the Federal Commissioner for Data Protection and Freedom of Information the independent body competent to recognize consent-management services. Section 10 provides that a consent-management service is recognized on application if it meets the requirements of Part 2 and has submitted a security concept.

Section 3(1) requires a recognized consent-management service to store the settings an end user made on first use of a digital service, and likewise where a provider asks for a consent it does not yet manage, and to transmit them to the provider of the digital service on each further use.

Under section 3(2), a recognized service manages only consents for which the provider of the digital service told the end user before consent at least who can store or access information, which information, for which purposes and for which periods, and that the consent can be withdrawn at any time. Under section 18(1), integrating a recognized consent-management service is voluntary for providers of digital services.

Section 19(1) requires a provider that integrates a recognized service to take the end users' settings into account, and, where it has no consent from an end user through the integration, to point to the end user's settings with the recognized service when it asks for consent.

Section 18(2) says that a provider that integrates a recognized service and asks for end users' settings through it should, by technical and organizational measures reflecting the state of the art, take care that the end user's use of the recognized service is taken into account when the digital service is called up and that it is checked whether settings are managed at the recognized service.

Section 18(3) says that such providers should make it possible for the consents they request to be stored by the recognized service, point end users to the integration at a visible and suitable place, cooperate with the recognized service on the requirements of section 7, and give it the information required under Articles 7 and 12 to 14 of the GDPR in a machine-readable format.

Section 17 says that, within the technical possibilities, manufacturers and providers of software for retrieving and presenting information from the internet should take care that the software takes the integration of recognized services into account and does not suppress, delay, decrypt or otherwise alter a signal or the end users' settings deposited through the recognized service or the provider of digital services.

Section 20 says that providers of digital services and manufacturers and providers of software that integrate a recognized service should not, without an objective reason, work toward end users using or excluding particular recognized services. The Ordinance was issued as Article 1 of the Ordinance of 6 February 2025. It took effect on 1 April 2025.

Section 25(1) permits storing information in an end user's terminal equipment, or accessing information already stored there, only where the end user has consented on the basis of clear and comprehensive information, with the information and the consent given in the manner Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR)) requires.

Section 25(2) excepts storage or access whose sole purpose is carrying a message over a public telecommunications network, and storage or access strictly necessary for a provider of a digital service to supply a digital service the user explicitly requested. The Act was enacted on 23 June 2021 as the Telekommunikation-Telemedien-Datenschutzgesetz (TTDSG) and took effect on 1 December 2021.

The Gesetz zur Durchführung der Verordnung (EU) 2022/2065 (the German Digital Services Act implementation act) of 6 May 2024 renamed it, with effect from 14 May 2024, to the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG).

Section 201(1) makes it a criminal offence, punishable by up to three years' imprisonment or a fine, to record another person's non-public spoken word on a sound-recording device without authorization, or to use or share such a recording.

Section 201(2) equally punishes listening in on another person's non-public spoken word with a listening device where the words were not meant for the listener, and publicly disclosing the wording or substance of words recorded or overheard this way, but only where the disclosure is capable of harming another person's legitimate interests, and not where the disclosure serves an overriding public interest.

Section 201(3) raises the maximum to five years' imprisonment where a public official or a person specially bound to public service commits the offence, and section 201(4) makes an attempt punishable. Unlike the listening-in offence, the recording offence does not require that the words were not meant for the person recording them, so a participant who records the other side of a call or meeting without authorization commits it.

Section 3(1) of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) places the content of telecommunication and its circumstances, in particular whether anyone takes or took part in a telecommunication process, under the secrecy of telecommunications (Fernmeldegeheimnis). Section 3(1) extends that secrecy to the circumstances of unsuccessful connection attempts.

Section 3(2) obliges to keep the secrecy providers of publicly available telecommunications services and the persons who help provide them, providers of telecommunications services offered wholly or partly on a commercial basis and the persons who help provide them, operators of public telecommunications networks, and operators of telecommunications installations used to provide telecommunications services commercially.

The duty of secrecy continues after the activity that gave rise to it has ended. Section 3(3) bars a person bound by section 3(2) from obtaining knowledge of the content or circumstances of telecommunication beyond what providing the services, operating the networks or installations and protecting their technical systems requires.

Section 3(3) allows such knowledge to be used for another purpose, in particular passed on, only where the TDDDG or another statute provides for it and expressly refers to telecommunications processes. Section 29(1) makes the Federal Commissioner for Data Protection and Freedom of Information the competent supervisory authority where data are processed in the commercial provision of telecommunications services.

The Act, enacted as Article 1 of the Act of 23 June 2021, took effect on 1 December 2021. An amending Act of 6 May 2024 renamed the Telekommunikation-Telemedien-Datenschutzgesetz (TTDSG) as the TDDDG with effect from 14 May 2024.

A business that advertises to a consumer by telephone call must document that consumer's prior express consent to telephone advertising, in an appropriate form, at the time the consent is given, and keep that record for five years from the date of giving and after every later use of it. The business must produce that record to the competent administrative authority on request without delay.

Inserted by the Gesetz für faire Verbraucherverträge of 10 August 2021, in force since 1 October 2021; unlike a violation of § 7, a failure to document or retain consent under this section is not one of the grounds UWG §§ 8 and 9 give a competitor or association its own civil claim for.

Section 7(1) makes any unreasonably harassing commercial act unlawful, naming advertising the recipient recognizably does not want as an example. Section 7(2) number 1 deems an unreasonable harassment always present where a person advertises by telephone call to a consumer without that consumer's prior express consent, or to another market participant without at least that participant's presumed consent.

Section 15(2) provides that, when calling for the purpose of advertising, the calling user may neither suppress the display of their telephone number nor have the telecommunications provider suppress it. The calling user must ensure that the number assigned to them is transmitted to the person called. Section 15(5) extends paragraphs 1 to 4 to calls to and from abroad as far as they concern callers or people called in Germany.

Section 28(1) makes the offences it lists administrative offences when committed intentionally or negligently. Number 9 covers suppressing the display of the caller's number contrary to section 15(2), first half-sentence, or causing it to be suppressed. Section 28(2) sets a maximum fine of 300,000 euros for that offence. Under section 28(3) number 1, the Bundesnetzagentur is the administrative authority for this offence. The Act took effect on 1 December 2021.

Section 7(1) applies Articles 4 to 8 of the Digital Services Act to all providers of digital services, including public bodies, whether or not a fee is charged for use. Under section 7(2), an authority may not require a provider that gives users internet access over a wireless local network to register users, to demand a password before granting access, or to stop offering the service permanently.

Such providers may nevertheless identify users, require a password or take other voluntary measures. Under section 7(3), a provider that is not liable under Article 4 of the Digital Services Act also cannot be held liable for damages, removal or an injunction because of a user's unlawful act, or for the costs of asserting those claims. That protection does not apply where the provider deliberately collaborates with a user of its service to commit unlawful acts.

Section 8(1) gives the holder of an intellectual property right a claim against a provider whose digital service transmits information provided by a user in a communications network, or gives access to a communications network, to demand that the use of information be blocked to prevent repetition, where a user used the service to infringe the right and the holder has no other way to remedy the infringement. The blocking must be reasonable and proportionate.

Section 8(3) excludes a claim against the provider for pre-court and court costs of asserting the blocking claim unless the provider deliberately collaborates with a user of its service to infringe another's intellectual property. Section 8(4) leaves untouched, even where the provider has limited responsibility under Articles 4 to 6 of the Digital Services Act and section 7, obligations under the general laws to remove information or block its use that rest on court or authority orders. Article 37(2) of the enacting act repealed the Telemediengesetz of 26 February 2007 when the Act took effect.

Section 1(1) provides that a service provider communicates works to the public when it gives the public access to copyright-protected works that users of the service have uploaded. Under section 1(2), a provider that meets its duties under section 4 and sections 7 to 11 according to high industry standards, observing proportionality, is not responsible under copyright law for that public communication.

Section 1(3) provides that the provider cannot rely on Article 6(1) of the Digital Services Act. A provider whose main purpose is to take part in copyright infringements or to facilitate them cannot rely on section 1(2).

Section 2(1) defines a service provider as a provider of an information society service whose main purpose, exclusively or at least also, is to store and make publicly available a large amount of copyright-protected content uploaded by third parties, which it organizes and promotes for profit and with which it competes for the same audiences as online content services.

Section 2(2) treats as a start-up provider one with annual revenue within the European Union of up to 10 million euros whose services have been available to the public in the European Union for less than three years. Section 2(3) treats as a small provider one with annual revenue within the European Union of up to 1 million euros.

Section 3 excludes among others non-profit online encyclopedias, non-profit educational or scientific repositories, development and sharing platforms for open-source software, providers of electronic communications services, online marketplaces, business-to-business cloud services and cloud services that let users upload content for their own use. Section 4(1) obliges the provider to make best efforts to acquire the contractual rights for the public communication of copyright-protected works.

The provider meets that duty if it acquires rights that are offered to it, that are available through representative right holders it knows, or that it can acquire through collecting societies or dependent exploitation bodies established in Germany.

Section 4(3) requires the provider, where the author has granted the right of public communication to a third party, still to pay the author appropriate remuneration for contractual uses, unless the third party is a collecting society or the author engaged the third party as a digital distributor.

Section 5(1) permits users to communicate works and parts of works to the public for quotations, for caricatures, parodies and pastiches, and for the other cases of public communication that the Urheberrechtsgesetz permits. Section 5(2) requires the provider to pay the author appropriate remuneration for a public communication for caricature, parody or pastiche, a claim that only a collecting society can assert.

Section 5(3) requires the provider to point users to the statutory permissions in its general terms and conditions. Section 7(1) obliges the provider, within the limits of section 1(2), to ensure as far as possible by blocking or removal that a work is not communicated to the public and stays unavailable, once the right holder demands this and supplies the information needed.

Section 7(2) provides that those measures may not make unavailable user-uploaded content whose use is legally permitted or that infringes no copyright. Section 7(3) requires the provider to inform the user immediately of the blocking of their upload and of the right to complain under section 14. Section 7(4) exempts start-up providers from section 7(1) while the average monthly number of different visitors to the service's websites does not exceed 5 million.

Section 7(5) presumes rebuttably that small providers are not obliged under section 7(1) in view of the principle of proportionality. Section 8(1) obliges the provider, within the limits of section 1(2), to end the public communication of a work by blocking once the right holder demands this and gives a sufficiently substantiated notice of the unauthorized public communication.

Section 9(1) requires presumably permitted uses to remain publicly communicated until a complaint procedure under section 14 ends. Under section 9(2), user-generated content that contains less than half of a third party's work or works, combines them with other content and uses third-party works only to a minor extent or marks them as legally permitted is rebuttably presumed to be legally permitted.

Section 10 treats as minor, if they are not commercial or serve only insignificant income, uses of up to 15 seconds of a film or moving-image work, up to 15 seconds of a soundtrack, up to 160 characters of a text and up to 125 kilobytes of a photographic work, photograph or graphic.

Section 11(1) requires the provider, where a user-generated upload is to be blocked automatically at the time of upload and is not a minor use, to inform the user of the blocking demand, to point out the need for a statutory permission, and to let the user mark the use as legally permitted. Where content is to be blocked automatically only after upload, section 11(2) treats it as presumably permitted for 48 hours even without a marking.

Section 12(1) requires the provider to pay the author appropriate remuneration for the public communication of presumably permitted uses. Section 14(1) requires the provider to give users and right holders an effective, free and speedy complaint procedure about blocking and about the public communication of protected works.

Section 14(3) requires the provider without delay to notify the complaint to all parties, give all parties the opportunity to comment and decide on the complaint within one week of its filing at the latest.

Where a trusted right holder declares, after review by a natural person, that the presumption in section 9(2) is to be rebutted and that continued public communication significantly impairs the economic exploitation of the work, section 14(4) requires the provider to block immediately until the complaint procedure ends. Section 14(5) requires decisions on complaints to be taken by impartial natural persons.

Section 18(1) requires the provider to exclude from the procedures under sections 7 and 8, for an appropriate period, a purported right holder who repeatedly demands the blocking of another's work as their own or of a work in the public domain. Under section 18(6), a registered association that promotes the interests of users on a non-commercial and lasting basis may sue a provider that repeatedly blocks permitted uses by mistake for an injunction.

Section 19 gives the right holder claims against the provider for information on the contractually permitted use of the right holder's repertoire and for appropriate information on how the procedures for blocking unauthorized uses work.

Section 20 applies section 5 of the Netzwerkdurchsetzungsgesetz accordingly to the duty of a provider that is not established in another Member State under section 2 of the Digitale-Dienste-Gesetz to appoint an authorized recipient in Germany for court proceedings. Section 22 provides that the provisions of the Act cannot be departed from by contract. The Act was enacted as Article 3 of the Act of 31 May 2021. It took effect on 1 August 2021.

Section 1(1) designates the Bundeskriminalamt as the competent authority under Article 12(1), points (a) and (b), of Regulation (EU) 2021/784 for issuing and reviewing removal orders under Articles 3 and 4. Section 1(2) designates the Bundesnetzagentur as the competent authority under Article 12(1), points (c) and (d), for monitoring the implementation of hosting service providers' specific measures under Article 5 and for imposing penalties under Article 18.

Section 1(3) has the Bundeskriminalamt set up the contact point under Article 12(2) of the Regulation and publish how to reach it on its website. Section 3(2) requires hosting service providers to send the Bundesnetzagentur each calendar year, by 1 March of the year after the reporting year, the information under Article 21(1), second sentence, point (c), of the Regulation.

Section 5 allows a coercive penalty (Zwangsgeld) of up to 5 million euros under the Verwaltungsvollstreckungsgesetz to enforce orders under Article 3(1) and Article 5(6) of the Regulation. Section 6(1) makes it an administrative offence to breach, intentionally or negligently, the articles of the Regulation it lists, the first being to fail to remove terrorist content and block access to it within one hour after receiving an enforceable removal order under Article 3(3).

Section 6(2) also makes it an administrative offence, intentionally or negligently, not to ensure when using a technical means under Article 5(3), second sentence, that material that is not terrorist content is not removed, and not to supplement the terms and conditions with the specific measures within twelve months of the authority's finding that the provider is exposed to terrorist content.

Section 6(3) sets a maximum fine of 5 million euros for the offences in paragraph 1 numbers 1, 2(b), 3, 4, 11, 15 and 16, of 500,000 euros for numbers 2(a), 5 to 10, 13, 14 and 17 to 19, and of 50,000 euros for the other offences. For a legal person or association with an annual total turnover above 125 million euros, section 6(4) allows an intentional offence under paragraph 1 number 1 to be fined up to 4 percent of the worldwide annual turnover of the preceding financial year.

Section 6(5) names the Bundesnetzagentur as the administrative authority for these offences. The Act was enacted as Article 1 of the Act of 21 July 2022. It took effect on 27 July 2022.

Section 14(1) sets up a Coordination Office for Digital Services (Koordinierungsstelle für digitale Dienste) in the Bundesnetzagentur, seated in Bonn, to enforce and monitor the Digital Services Act. Section 1(4) defines the Coordination Office as the national coordinator for digital services within the meaning of Article 49(2) of the Digital Services Act.

Section 12(1) makes the Bundesnetzagentur the competent authority under Article 49(1) of the Digital Services Act, subject to paragraphs 2 and 3.

Section 12(2) makes the Bundeszentrale für Kinder- und Jugendmedienschutz the competent authority for enforcing Article 14(3) and structural precautionary measures under Article 28(1) of the Digital Services Act, so far as these do not concern measures under the Jugendmedienschutz-Staatsvertrag, for which the bodies the media laws of the Länder designate are competent.

Section 12(3) makes the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit) the competent authority for enforcing Articles 26(3) and 28(2) and (3) of the Digital Services Act. Section 13 designates the Bundeskriminalamt as the central office that receives information under Article 18(1) and (2) of the Digital Services Act and passes it to the competent prosecuting authority.

Section 20(1) makes the Coordination Office the complainant's point of contact throughout a complaint procedure about an infringement of the Digital Services Act.

Section 25(1) obliges the persons named in Article 51(1)(a) and (c) of the Digital Services Act to provide the information the Coordination Office or the authorities named in section 12(2) and (3) request, and the persons named in Article 51(1)(b) to tolerate the inspection of business records and entry to premises during normal business hours.

Section 27(2) requires an authority that finds a provider of intermediary services in breach of its obligations to ask the provider to comment within a reasonable time and to remedy the breach within a reasonable time or without delay. Under section 27(3) the authority may order the measures needed to ensure compliance where the provider does not meet the request to remedy within the time set.

Section 27(4) allows a coercive penalty (Zwangsgeld) under the Verwaltungsvollstreckungsgesetz of up to 5 percent of the provider's average worldwide daily turnover or daily income in the preceding financial year, calculated from the date named in the warning, to enforce such orders.

Section 29(1) makes the Amtsgericht in whose district the Coordination Office has its seat the competent judicial authority for measures under Article 51(3), first subparagraph, point (b) of the Digital Services Act. Section 33(5) makes it an administrative offence to breach, intentionally or negligently, the articles of the Digital Services Act that it lists.

Section 33(4) makes it an administrative offence to repeatedly fail, contrary to the first sentence of Article 16(6) of the Digital Services Act, to take a decision free of arbitrariness and objectively. Section 33(6) number 1(b) sets a maximum fine of 300,000 euros for the offences in paragraph 4 and in paragraph 5 numbers 8, 10 to 12, 14, 16, 18, 20 to 30 and 32.

Section 33(6) number 2(b) sets a maximum fine of 100,000 euros for the offences in paragraph 5 numbers 1 to 7, 9, 13, 15, 17, 19, 31 and 33. Section 33(7) lets the fine for the 300,000 euro group reach 6 percent of total turnover where the offender is a legal person or association with total turnover above 5 million euros.

Section 33(8) lets the fine for the 100,000 euro group reach 1 percent of total turnover where the offender is a legal person or association with total turnover above 10 million euros. Section 33(9) defines total turnover as the sum of all revenue the legal person or association earned worldwide in the financial year before the authority's decision, and allows it to be estimated.

Section 33(2) numbers 3 and 4 make it an administrative offence, intentionally or negligently, to fail to provide the information, or to tolerate the inspection, that section 25(1) requires. Section 33(6) number 3 sets a maximum fine of 50,000 euros for the remaining offences in paragraph 2.

Section 33(10) names the Coordination Office as the administrative authority for the offences in paragraph 4 and in most of paragraph 5, the Bundeszentrale für Kinder- und Jugendmedienschutz for paragraph 5 number 6, and the Federal Commissioner for Data Protection and Freedom of Information for paragraph 5 numbers 23 and 26. Article 37(2) of the enacting act repealed the Telemediengesetz of 26 February 2007 when it took effect. The Act took effect on 14 May 2024.

Section 1(4) number 8 defines video-sharing platform services as digital services whose main purpose or an essential function is to make programs or user-generated videos, for which the provider bears no editorial responsibility, available to the general public, with the provider determining their organization, including by automatic means.

Section 6(3) requires video-sharing platform providers to provide a function with which users who upload user-generated videos can declare whether those videos contain audiovisual commercial communication. Section 6(4) requires them to label as such audiovisual commercial communication that users have uploaded, where they know of it through that declaration or otherwise.

Section 10(1) requires providers of audiovisual media services and video-sharing platform providers to give the authority competent under Land law, on request, information on the criteria in section 2(2) to (7), so far as necessary for that authority's tasks under section 9. Section 11(1) requires video-sharing platform providers to agree effectively with their users that the users may not distribute unlawful audiovisual commercial communication on the platform.

Section 11(2) defines that as audiovisual commercial communication that breaches section 20 of the Tabakerzeugnisgesetz or section 10 of the Heilmittelwerbegesetz. Section 33(2) number 2 makes it an administrative offence, intentionally or negligently, to fail to give the information, or to give it incorrectly, incompletely or late, that section 10(1) requires. Section 33(6) number 3 sets a maximum fine of 50,000 euros for that offence. Article 37(2) of the enacting act repealed the Telemediengesetz of 26 February 2007 when the Act took effect.

Section 2(2) number 16 defines a media intermediary as any telemedium that also aggregates, selects and presents third parties' journalistic and editorial offerings in a generally accessible way without combining them into an overall offering.

Section 91(2) excludes from the provisions on media intermediaries, except section 95, intermediaries that reach in Germany on average over six months fewer than one million users a month or are forecast to, intermediaries specialized in aggregating, selecting and presenting content relating to goods or services, and intermediaries that serve exclusively private or family purposes.

Section 92 requires providers of media intermediaries to designate an authorized recipient in Germany, to be made known in the offering in an easily recognizable and directly accessible manner, on whom documents in fine proceedings under section 115 can be served.

Section 93(1) requires providers of media intermediaries, to safeguard diversity of opinion, to keep easily perceptible, directly accessible and permanently available the criteria that decide whether content gains access to the intermediary and whether it stays, and the central criteria of aggregation, selection and presentation of content and their weighting, including information on how the algorithms used work, in understandable language.

Under section 93(2) and (3), a provider with a thematic specialization must make it perceptible through the design of its offering, and changes to the published criteria or to that orientation must be made perceptible without delay in the same way. Section 93(4) requires providers of media intermediaries that offer social networks to ensure that telemedia are labelled as section 18(3) requires.

Section 18(3) requires providers of telemedia in social networks to make the fact of automation recognizable for content or messages created automatically by a computer program, where the user account used for it appears from its outward form to be meant for use by natural persons. Section 94(1) forbids media intermediaries to discriminate against journalistic and editorial offerings on whose perceptibility they have a particularly high influence.

Section 94(2) defines discrimination as a systematic departure, without objectively justified reason, from the criteria published under section 93(1) to (3) in favor of or to the detriment of a specific offering, or criteria that directly or indirectly unfairly and systematically hinder offerings.

Under section 94(3), only the affected provider of journalistic and editorial content can assert a violation of section 94 with the competent Landesmedienanstalt, which in obvious cases can also pursue it of its own motion. Section 95 requires providers of media intermediaries to produce the necessary documents to the competent Landesmedienanstalt on request.

Section 115(1), second sentence, numbers 41 to 43 make it an administrative offence to fail to designate an authorized recipient in Germany, to fail to keep the information required by section 93(1) available, and to fail to make a thematic specialization perceptible. Numbers 44 to 47 do the same for failing to make changes perceptible without delay, failing to ensure the labelling under section 93(4), discriminating contrary to section 94(1) and failing to produce documents under section 95.

Section 115(2) sets a maximum fine of 500,000 euros for these offences. Section 115(3) names the Landesmedienanstalt competent under section 106 as the administrative authority. Under Article 9, paragraph 2 of the Staatsvertrag zur Modernisierung der Medienordnung in Deutschland, which contains the Medienstaatsvertrag, the treaty takes effect on the day after the last ratification instrument is deposited.

All ratification instruments were deposited on 6 November 2020, and the treaty took effect on 7 November 2020. The text described here is the version in force since 1 December 2025 under the Seventh Medienänderungsstaatsvertrag.

Section 1(1) applies the Act to providers of digital services that operate platforms on the internet for profit and that are designed to let users share any content with other users or make it available to the public (social networks). Platforms with journalistic and editorial offerings that the provider itself is responsible for are not social networks, and neither are platforms intended for individual communication or for the dissemination of specific content.

Section 5 requires providers of social networks for which no other Member State is the country of establishment under section 2 of the Digitale-Dienste-Gesetz to designate an authorized recipient in Germany and to draw attention to him on the platform in an easily recognizable and directly accessible manner.

Service of documents in court proceedings before German courts about the dissemination of unlawful content, or the unfounded assumption of such dissemination, especially where restoration of removed or blocked content is sought, can be effected on that recipient. Section 1(3) defines unlawful content as content that fulfils the elements of listed offences in the Strafgesetzbuch and is not justified.

Section 4(1) makes it an administrative offence to fail, intentionally or negligently, to designate an authorized recipient contrary to section 5, first sentence. Section 4(2) sets a maximum fine of 500,000 euros and makes section 30(2), third sentence, of the Ordnungswidrigkeitengesetz applicable. Under that sentence of the Ordnungswidrigkeitengesetz, where a statute refers to it, the maximum fine for the offences the statute names is multiplied by ten.

Section 4(4) names the Bundesamt für Justiz as the administrative authority for these offences. Section 4a(1) has the authority named in section 4 monitor compliance with the Act.

Section 4a(3) requires the provider of a social network, in an administrative procedure under section 4a(2), to give the authority on request information about the measures taken to implement the Act, the number of registered users in Germany and the complaints about unlawful content received in the previous calendar year. Article 29 of the Act of 6 May 2024 repealed sections 2 to 3f of the Netzwerkdurchsetzungsgesetz. The Act was enacted as Article 1 of the Act of 1 September 2017. It took effect on 1 October 2017.

Section 1(1) makes the manufacturer of a product liable to compensate the person who is killed, injured in body or health, or whose thing is damaged by a defect in the product. For damage to a thing, liability applies only where a thing other than the defective product is damaged and that thing is of a kind ordinarily intended for private use or consumption and was mainly so used by the injured person.

Section 2 defines a product as any movable thing, including a part of another movable thing or of an immovable thing, and electricity. The Bundestag's report on the 2026 government bill states that software will in future be treated as a product regardless of how it is supplied. Section 4(1) treats as manufacturer whoever made the end product, a basic material or a component, and whoever presents themselves as manufacturer by affixing a name, trademark or other distinctive mark.

Section 4(2) treats as manufacturer a person who imports a product into the European Economic Area for sale, rental or another form of distribution with an economic purpose in the course of business. Under section 4(3), where the manufacturer cannot be identified, each supplier counts as the manufacturer unless it names the manufacturer or its own supplier within one month of the injured person's request.

A product is defective if it does not offer the safety that may legitimately be expected in all the circumstances, in particular its presentation, the use that can reasonably be expected and the time it was put into circulation.

Section 1(2) excludes the manufacturer's liability where it did not put the product into circulation, where the circumstances indicate the defect did not yet exist then, where it made the product neither for sale or other distribution with an economic purpose nor in the course of its profession, where the defect results from compliance with mandatory legal rules, or where the defect could not be recognized according to the state of science and technology when the product was put into circulation.

The injured person bears the burden of proof for the defect, the damage and the causal link, and the manufacturer bears it where it is disputed whether an exclusion applies. Section 10(1) caps liability for personal injury caused by a product or identical products with the same defect at EUR 85 million. Section 11 makes the injured person bear the first EUR 500 of damage to a thing.

A claim under the Act is time-barred three years after the person entitled to compensation learned, or should have learned, of the damage, the defect and the person liable. A claim expires ten years after the manufacturer put the product that caused the damage into circulation, unless a lawsuit or a payment-order procedure on the claim is pending. Section 14 bars excluding or limiting the manufacturer's liability in advance and makes contrary agreements void.

Section 15(2) leaves liability under other provisions untouched. The Act has been in force since 1 January 1990. Article 2 of the 2026 government bill would replace section 19 of the Act so that it ceases to have effect on 9 December 2026. Section 23 of the bill's new Act keeps the 1989 Act in application for products put into circulation or into operation up to and including 8 December 2026.

Section 2 provides that an importer is a natural or legal person, or a partnership with legal capacity, established in the Union that places a product from a third country on the Union market. Section 2 provides that a distributor is a natural or legal person, or a partnership with legal capacity, in the supply chain that makes a product available on the market, other than the manufacturer or the importer.

Section 9(1) allows an importer to place on the market only products that meet the accessibility requirements of the ordinance under section 3(2). Section 9(2) allows an importer to place a product on the market only when the manufacturer has carried out the conformity assessment and prepared the technical documentation, the product bears the CE marking and carries instructions and safety information, and the manufacturer has met its marking duties.

Section 9(3) bars an importer that knows or has reason to believe that a product does not conform from placing it on the market until conformity is restored, and requires it to inform the manufacturer and the market surveillance authorities. Section 10(1) requires the importer to state its name, trade name or brand and its postal address on the product when placing it on the market.

Section 10(2) requires the importer to ensure that instructions for use and safety information in German, meeting the requirements of the ordinance, accompany the product. Section 10(3) requires the importer to keep a copy of the EU declaration of conformity for the market surveillance authorities for five years from placing the product on the market.

Section 11(1) allows a distributor to make a product available on the market only when it bears the CE marking, the documents under section 7(3) accompany it, and the manufacturer and the importer have met their marking duties. Section 11(2) bars a distributor that knows or has reason to believe that a product does not conform from making it available until conformity is restored, and requires it to inform the manufacturer or importer and the market surveillance authorities without delay.

Section 11(4) requires a distributor to ensure that corrective measures are taken for a product it has made available that does not conform, and that the product is withdrawn if conformity cannot be restored. Section 13(1) requires an economic operator to tell the market surveillance authority, on request, from whom it obtained a product and to whom it supplied it.

Section 13(2) requires the operator to be able to produce that information for at least five years from obtaining or supplying the product. Section 37(1), item 7 makes it an administrative offence for a distributor to make a product available in breach of section 11(1), item 1 or section 11(2), first sentence. Section 37(1), item 1 makes it an administrative offence for an importer to place a product on the market in breach of section 9(1).

Section 37(2) sets a fine of up to EUR 100,000 for items 1, 7, 8, 9 and 10 of section 37(1), and up to EUR 10,000 for the others. Because section 37(1) covers intentional and negligent conduct alike without a separate maximum, section 17(2) of the Act on Administrative Offences caps the fine for a negligent offence at half of those amounts.

Section 17(4) of that Act provides that the fine should exceed the economic benefit the offender drew from the offence, and lets it exceed the statutory maximum where that is needed. Article 9 of Directive (EU) 2019/882 is the source of the importers' obligations. Article 10 of Directive (EU) 2019/882 is the source of the distributors' obligations.

Section 3(1) requires products that an economic operator makes available on the market to be accessible.

Section 1(2) applies the Act to the products it lists that are placed on the market after 28 June 2025, namely consumer general-purpose computer hardware systems with their operating systems, payment terminals with their hardware and software, cash machines, ticketing machines, check-in machines and interactive information terminals (other than terminals installed as integrated parts of vehicles, aircraft, ships or rail vehicles), consumer terminal equipment with interactive computing capability used for telecommunications services or for access to audiovisual media services, and e-book readers.

Section 2 provides that a manufacturer is a natural or legal person, or a partnership with legal capacity, that manufactures a product or has it developed or manufactured and markets it under its own name or brand.

Section 6(1) lets a manufacturer place a product on the market only if it was designed and manufactured to the requirements of the ordinance under section 3(2), the technical documentation was prepared and the conformity assessment carried out, an EU declaration of conformity was issued and the CE marking was affixed. Section 6(2) requires the manufacturer to keep the technical documentation and the EU declaration of conformity for five years after the product is placed on the market.

Section 6(3) requires the manufacturer to ensure by suitable procedures that series production stays in conformity. Section 6(4) requires a manufacturer that knows or has reason to believe that a product it placed on the market does not conform to take the corrective measures needed, to withdraw or recall the product if conformity cannot be restored, and to inform the market surveillance authority and the authorities of the Member States where it placed the product without delay.

Section 6(5) requires the manufacturer to keep a register of the products whose non-conformity it reported to the authorities and of the complaints about them. Section 7(1) requires the manufacturer to ensure that the product bears a type, batch or serial number or another identifier. Section 7(2) requires the manufacturer to state its name, trade name or brand and its postal address on the product when placing it on the market.

Section 7(3) requires the manufacturer to ensure that instructions for use and safety information in German accompany the product. Section 7(5) requires the manufacturer to give the market surveillance authority, on its reasoned request, all information and documents needed to demonstrate conformity, in German or in a language the authority easily understands.

Section 8(4) bars a manufacturer from transferring to an authorized representative the duties of section 6(1), item 1 and the preparation of the technical documentation. Section 12 makes sections 6 and 7 apply to an importer or distributor that places a product on the market under its own name or brand, or modifies a product already placed on the market so that its conformity may be affected.

Section 18(1) requires the manufacturer to issue an EU declaration of conformity before a product whose conformity was shown under Annex 2 is placed on the market. Section 19(1) requires the manufacturer or its authorized representative to affix the CE marking before such a product is placed on the market. Section 18(3) provides that the requirements for the technical documentation may not impose excessive burdens on microenterprises and on small and medium-sized enterprises.

Annex 2 provides that the conformity assessment procedure is an internal production control. Section 16(1) applies the accessibility requirements only to the extent that compliance does not require a significant change that fundamentally alters the basic characteristics of the product or service. Section 17(1) applies them only to the extent that compliance would not impose a disproportionate burden, assessed against Annex 4, on the economic operator.

Sections 16(4) and 17(2) relieve microenterprises dealing with products of the documentation and notification duties, but they must give the authority on request the facts relevant to the assessment. Section 37(1), item 1 makes it an administrative offence to place a product on the market in breach of section 6(1), item 1. Section 37(1), item 9 makes it an administrative offence to omit the CE marking or to affix it incorrectly.

Section 37(2) sets a fine of up to EUR 100,000 for items 1, 7, 8, 9 and 10 of section 37(1), and up to EUR 10,000 for the others. Because section 37(1) covers intentional and negligent conduct alike without a separate maximum, section 17(2) of the Act on Administrative Offences caps the fine for a negligent offence at half of those amounts.

Section 17(4) of that Act provides that the fine should exceed the economic benefit the offender drew from the offence, and lets it exceed the statutory maximum where that is needed. Article 7 of Directive (EU) 2019/882 is the source of the manufacturers' obligations.

Section 14(1) lets a service provider offer or provide a service only if it meets the accessibility requirements of the ordinance under section 3(2) and has prepared the information required by Annex 3, item 1 and made it available to the public in accessible form. Section 3(1) requires services that an economic operator offers or provides to be accessible.

Section 3(1) treats a service as accessible when persons with disabilities can find, reach and use it in the generally customary way, without particular difficulty and in principle without outside help. Section 2 provides that a service provider is a natural or legal person, or a partnership with legal capacity, that provides a service to consumers on the Union market or offers to do so.

Section 2 provides that a consumer is a natural person who buys or receives a product or service covered by the Act for purposes that cannot predominantly be attributed to a commercial or self-employed activity.

Section 1(3) applies the Act to the services provided to consumers after 28 June 2025 that it lists, namely telecommunications services other than machine-to-machine transmission services, and the websites, mobile services including mobile applications, electronic tickets, transport information and interactive self-service terminals of air, bus, rail and waterborne passenger transport services, where for urban, suburban and regional transport only the self-service terminals are covered.

Section 1(3) also applies the Act to consumer banking services, to e-books and dedicated software, and to e-commerce services. Section 2 treats as consumer banking services the consumer credit and housing credit agreements, investment services, payment services, services linked to a payment account and e-money that it lists.

Section 2 treats e-commerce services as digital services offered through websites and applications on mobile devices and provided electronically at a consumer's individual request with a view to concluding a consumer contract.

Section 1(4) excludes from the Act pre-recorded time-based media and office file formats published before 28 June 2025, online maps and map services where the essential navigation information is provided in accessible digital form, third-party content that the operator neither finances, develops nor controls, and content that counts as an archive. Section 1(5) leaves sections 45a to 45d and 95a to 96 of the Copyright Act and Regulation (EU) 2017/1563 unaffected.

Section 3(3) exempts microenterprises that offer or provide services from the duty in section 3(1). Section 2 defines a microenterprise by the number of persons it employs and by its annual turnover or balance sheet total. Section 3(3) requires the Federal Ministry of Labour and Social Affairs, in agreement with the Federal Ministry for Economic Affairs, to draw up guidelines that help microenterprises apply the Act. Article 4(5) of Directive (EU) 2019/882 is the source of the exemption.

Section 14(2) requires the provider to keep the information under Annex 3 for as long as it offers or provides the service.

Annex 3 requires the provider to state in its general terms and conditions, or in another clearly perceivable way, how the service meets the requirements, and the information must include a general description of the service in an accessible format, explanations needed to understand how it is carried out, a description of how it meets the requirements and the competent market surveillance authority.

Section 14(3) requires the provider to ensure that the requirements are always met while it offers or provides the service. Section 14(4) requires the provider, where a service is not conformant, to take the corrective measures needed and to inform the market surveillance authority and those of the Member States where it provides the service without delay, with details of the non-conformity and the corrective measures taken.

Section 14(5) requires the provider to give the market surveillance authority, on its reasoned request, the information needed to demonstrate conformity and to cooperate with it. Section 16(3) requires an operator that relies on the fundamental-alteration exception for a service to inform the market surveillance authorities without delay.

Section 17(3) requires a service provider that relies on the disproportionate-burden exception to repeat its assessment for each category or type of service at least every five years, and whenever the service changes or the competent authority asks. Section 17(4) bars an economic operator that receives public or private funds, other than its own, to improve accessibility from relying on the disproportionate-burden exception.

Section 37(1), item 8 makes it an administrative offence to offer or provide a service in breach of section 14(1). Section 37(1), item 2 makes it an administrative offence to fail to give the information that section 14(4), second sentence requires, or to give it incorrectly, incompletely or late. Section 37(1), item 6 makes it an administrative offence to fail to give the information or documents that section 14(5), first sentence requires, or to give them incorrectly, incompletely or late.

Section 37(1) makes these offences administrative offences when committed intentionally or negligently. Section 37(2) sets a fine of up to EUR 100,000 for items 1, 7, 8, 9 and 10 of section 37(1), and up to EUR 10,000 for the others. Because section 37(1) covers intentional and negligent conduct alike without a separate maximum, section 17(2) of the Act on Administrative Offences caps the fine for a negligent offence at half of those amounts.

Section 17(4) of that Act provides that the fine should exceed the economic benefit the offender drew from the offence, and lets it exceed the statutory maximum where that is needed. Section 38(1) lets service providers go on providing their services until 27 June 2030 with products they lawfully used for that or similar services before 28 June 2025. Section 38(1) lets contracts for services concluded before 28 June 2025 continue unchanged until they expire, but no longer than 27 June 2030.

Section 38(2) lets self-service terminals that providers lawfully used before 28 June 2025 stay in use for comparable services until the end of their economic useful life, but no longer than fifteen years after they were put into use. Article 32 of Directive (EU) 2019/882 is the source of these transitional rules; its Article 32(2) would have allowed such terminals to stay in use for up to 20 years. Article 13 of Directive (EU) 2019/882 is the source of the service providers' obligations.

Section 2 provides that a market surveillance authority is any authority responsible for market surveillance under the law of a Land. Section 20(1) requires the Länder to ensure that their market surveillance authorities can perform their tasks properly and to equip them with the necessary resources.

The Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF), a public-law institution, supervises compliance with the Act as the joint monitoring body of all 16 Länder. The MLBF lists the imposition of fines under section 37 among the measures it takes against infringements. Section 22(1) requires economic operators to cooperate fully with the market surveillance authority in its check of a product.

Section 22(2) requires the authority, where a product does not meet the requirements, to call on the economic operator without delay to take suitable measures within a reasonable period, and the hearing period may not be less than ten days. Section 22(4) lets the authority, where the operator takes no suitable measures within that period, restrict or prohibit making the product available on the German market, or have it withdrawn or recalled.

Section 23(2) treats as formal non-conformity a missing or incorrect CE marking or EU declaration of conformity, unavailable or incomplete technical documentation, missing or incorrect manufacturer or importer details, and any other unmet formal obligation under sections 6, 7, 9 or 10. Section 23(3) lets the authority, where the operator does not correct a formal non-conformity in the period set, restrict or prohibit making the product available until conformity is established.

Section 28(2) requires the authority to check services on a sample basis without a specific occasion, and for websites and mobile applications to apply the requirements of Annex 1, item 1. Section 29(2) requires the authority, where a provider takes no suitable corrective measures within the period set, to call on it again under threat of prohibiting the offer or provision of the service.

Section 29(3) lets the authority, where the provider takes no suitable corrective measures within the period set under section 29(2), take the measures needed, in particular order the provider to stop offering or providing the service within a period it sets. Section 30(2) treats as formal non-conformity of a service that the information under Annex 3 was not prepared, or not completely prepared, or was not made available to the public, or not completely, in accessible form.

Section 32(1) requires the authority to open a procedure against an economic operator on a consumer's application where the consumer claims that the operator breaches the Act or the ordinance and the consumer therefore cannot use the product or service, or can use it only in a restricted way.

Section 32(1) lets the consumer instruct an association recognized under section 15(3) of the Behindertengleichstellungsgesetz, or a body under section 3(1), first sentence, item 1 of the Unterlassungsklagengesetz, to apply in the consumer's name or in their place. Section 32(2) requires the same procedure to be opened when such an association or body applies and the alleged breach affects its statutory field of tasks, without any violation of the applicant's own rights.

Section 32(3) provides that the authority decides on such an application by an administrative decision (Bescheid). Section 33(2) lets such associations and bodies bring remedies under the Code of Administrative Court Procedure against a decision addressed to them or against the authority's failure to act, without a violation of their own rights, where a provision of the Act or the ordinance is violated and their statutory field of tasks is affected.

Section 34(1) lets a consumer who claims that an economic operator breaches the Act or the ordinance apply to the conciliation body under section 16(1) of the Behindertengleichstellungsgesetz for conciliation proceedings. Section 35 requires economic operators to give the market surveillance authority, on its reasoned request, the information it needs for its tasks under the Act.

Section 35 lets a person obliged to give information refuse to answer questions whose answer would expose them or a relative to criminal prosecution or to proceedings for an administrative offence. Article 29 of Directive (EU) 2019/882 is the source of the consumer and association routes in sections 32 to 34. Article 30(2) of Directive (EU) 2019/882 requires penalties to be effective, proportionate and dissuasive.

Section 99a(1) of the Medienstaatsvertrag requires providers of services that give access to audiovisual media services to ensure accessible access, to design the selection of offers accessibly and to support accessible use, unless that would burden them disproportionately under Annex VI of Directive (EU) 2019/882. Section 99a(1) also releases them where compliance would require a significant change to the service that fundamentally alters its basic nature.

Section 99a(1) provides that ensuring accessibility covers the requirements of Annex I, Section III and Section IV, point (b), of the Directive. Section 99a(1) bars a provider that receives public or private funds, other than its own, to improve accessibility from relying on a disproportionate burden.

Section 2(2), item 31 defines such a service as a telemedium used to identify, select, receive information on and view television programmes and television-like telemedia, and the functions provided to make them accessible, including electronic programme guides. Section 99a(2) requires the provider to assess whether compliance would bring a fundamental alteration or a disproportionate burden.

Section 99a(3) requires the provider to document that assessment, to keep all relevant results for five years after it last provided the service, and to send the competent Landesmedienanstalt a copy on request. Section 99a(4) requires a provider that relies on a disproportionate burden to repeat the assessment when the service changes or the Landesmedienanstalt asks, and at least every five years.

Section 99a(5) disapplies subsections (1) to (4) to microenterprises within the meaning of Article 3(23) of the Directive. Section 99b(1) presumes that a service meets the requirements where it conforms to harmonized standards whose references are published in the Official Journal of the European Union, or to technical specifications under Article 15(3) of the Directive.

Section 99b(2) requires a provider whose service does not conform to take the corrective measures needed and to inform the competent Landesmedienanstalt and the authorities of the Member States where the service is provided without delay. Section 99b(3) requires a provider that relies on a disproportionate burden or a fundamental alteration to send information on it to the authorities of the Member State where the service is provided.

Section 99b(4) requires the provider to give the competent Landesmedienanstalt, on request, all the information needed to show that the service conforms. Section 99c(1) requires the provider to state, in accessible form for the public, in its general terms and conditions or in another clearly perceivable way, how it meets the requirements.

Section 99c(2) requires that statement to include a general description of the service, the explanations needed to use it and the competent Landesmedienanstalt, and requires the provider to keep the information for as long as it offers the service. Section 99d(1) lets a consumer who cannot use such a service, or can use it only in a restricted way, because of a breach of section 99a or 99c apply to the competent Landesmedienanstalt for measures, which it decides by administrative decision.

Section 99d(2) lets the person concerned challenge that decision, or a failure to act, in the administrative courts. Section 99d(3) lets that person instruct a disability association recognized by the Behindertengleichstellungsgesetz, or a qualified entity within the meaning of the Unterlassungsklagengesetz, to act in their name or in their place.

Section 104(1) makes the Landesmedienanstalten the authorities responsible for services within sections 99a to 99e, in the sense of Article 23(2) of the Directive. Section 105(1), item 11a gives the Commission on Licensing and Supervision (ZAK) of the Landesmedienanstalten the supervision of nationwide services of this kind. Section 104(1) leaves the services of the ARD broadcasters, ZDF and Deutschlandradio outside that supervision.

Section 30(8) applies to such services of the ARD broadcasters, ZDF and Deutschlandradio only section 99a(1) sentences 1 and 2, (2) and (3) sentence 1 and section 99c(1). Section 115(1), second sentence, items 47a to 47d make it an administrative offence to fail to ensure accessible access, selection or use where no disproportionate burden or fundamental alteration applies, to fail to carry out or document the assessment or keep its results, or to fail to state how the requirements are met.

Section 115(2) sets a fine of up to EUR 500,000 for those offences. Section 115(3) makes the competent Landesmedienanstalt the authority that imposes the fine. Section 121a(1) applies sections 99a to 99d to services offered or provided to consumers after 27 June 2025.

Section 121a(2) lets providers go on providing these services until 27 June 2030 with products they lawfully used for them before 28 June 2025, and lets contracts concluded before 28 June 2025 continue unchanged until they expire, but no longer than five years from that date. The Länder inserted sections 99a to 99e into the Medienstaatsvertrag by the Zweiter Medienänderungsstaatsvertrag, which they concluded also to implement Directive (EU) 2019/882.

Article 2(2)(b) of Directive (EU) 2019/882 is the source: it covers services providing access to audiovisual media services, which the Barrierefreiheitsstärkungsgesetz does not list.

The Verordnung zum Barrierefreiheitsstärkungsgesetz implements Annex I of Directive (EU) 2019/882. Section 3(2) of the BFSG authorizes the Federal Ministry of Labour and Social Affairs to set the concrete accessibility requirements for the products in section 1(2) and the services in section 1(3) by ordinance, in line with Annex I of the Directive.

Section 3(1) of the Ordinance requires the state of the art to be observed in meeting its requirements, and allows a departure from it where the requirements are met to the same degree in another way. Section 3(2) of the Ordinance requires the Bundesfachstelle für Barrierefreiheit to publish regularly on its website a list of the most important standards from which the requirements arise, conformity tables and current information on the standards to observe.

Section 4 of the BFSG presumes that products and services that conform to harmonized standards, or parts of them, whose references are published in the Official Journal of the European Union meet the requirements of the ordinance, to the extent those standards cover them. Section 5 of the BFSG gives the same presumption to conformity with the technical specifications under Article 15(3) of the Directive.

Section 5a of the BFSG presumes that features, components or functions of products or services outside the Act that meet the requirements of the ordinance, other than those for support services, meet the accessibility obligations of other Union acts, unless those acts provide otherwise.

Section 4(1) of the Ordinance requires information on the product itself, such as labels, instructions and warnings, to be available through more than one sensory channel, understandable, perceivable and set in a suitably sized and shaped font with sufficient contrast and spacing. Section 6(1) of the Ordinance requires a product, including its user interface, to contain components, functions and features that let persons with disabilities access, perceive, operate, understand and control it.

Section 6(2) of the Ordinance lists thirteen further requirements for a product, among them alternatives to speech, colour, audible signals and biometric identification, flexible size, brightness and contrast, volume and speed control, avoiding photosensitive seizures, protecting privacy when accessibility features are used, and interfaces for assistive technologies.

Section 7(1) of the Ordinance requires self-service terminals to have speech output, to allow individual headphones to be used, to warn through more than one sensory channel when the time to respond is limited, to allow that time to be extended, to have buttons with sufficient contrast and tactile recognizability, and to use audio signals compatible with hearing aids and other assistive technologies.

Section 7(2) of the Ordinance bars self-service terminals from requiring the activation of accessibility features before people who rely on them can switch the terminal on. Section 8 of the Ordinance requires e-book readers to have speech output.

Section 9 of the Ordinance requires consumer terminal equipment with interactive computing capability used for telecommunications services to support real-time text, high audio quality, total conversation services where video is used, an effective wireless connection to hearing technology, and operation without interference with assistive devices.

Section 10 of the Ordinance requires consumer terminal equipment used to access audiovisual media services to provide the accessibility components that the audiovisual media service provider makes available for access, selection, control, personalization and transmission to assistive devices.

Section 11 of the Ordinance requires support services such as help desks, call centres, technical support and relay services, where available, to give information on accessibility and compatibility with assistive technologies through accessible means of communication.

Section 12 of the Ordinance requires, for a service to meet the accessibility duty, that the products used to provide it meet sections 4 and 6 to 11, that information on how it works be provided in accessible ways, that websites and mobile apps be perceivable, operable, understandable and robust, and that support services give accessible information.

Section 14(1) of the Ordinance requires telecommunications services that enable voice communication to provide real-time text in addition to voice, and a total conversation service where they provide video. Section 14(2) of the Ordinance requires emergency communications to be synchronized across voice and text, and across total conversation where video is provided, and to be transmitted without delay to the local emergency answering point.

Section 15 of the Ordinance requires air, bus, rail and waterborne passenger transport services, other than urban, suburban and regional services, to provide information on the accessibility of vehicles, surrounding infrastructure and buildings and on assistance, information on smart ticketing, real-time travel information and additional service information.

Section 16 of the Ordinance requires self-service terminals used for urban, suburban and regional transport services to meet sections 4, 6, 7 and 11. Section 17 of the Ordinance requires the identification methods, authentication methods, electronic signatures, security functions and payment services of consumer banking services to be perceivable, operable, understandable and robust.

Section 17(2) of the Ordinance requires information on how a consumer banking service works to be understandable at a language level no higher than B2 of the Common European Framework of Reference for Languages. Section 18 of the Ordinance lists ten requirements for e-books, among them synchronized text and audio, files that do not prevent assistive technologies from working, navigation and structure, flexible presentation, and accessibility metadata.

Section 19 of the Ordinance requires e-commerce services to provide information on the accessibility of the products and services offered, and their identification, authentication, security and payment functions to be perceivable, operable, understandable and robust. Section 20 of the Ordinance treats functions for which sections 4 to 19 set no requirement as accessible if they meet the functional performance criteria of section 21. The Ordinance applies from 28 June 2025.

An ordinance of 10 July 2026 replaced section 7(2) and section 14 of the Ordinance. That ordinance was promulgated on 15 July 2026 and took effect on 16 July 2026, the day after its promulgation.

Section 121(2) of the Act against Restraints of Competition requires that, in procuring performance intended for use by natural persons, the accessibility criteria for persons with disabilities or design for all users be taken into account when the description of the performance is drawn up, except in duly justified cases. Section 121(3) attaches the description of the performance to the procurement documents.

Section 31(5) of the Vergabeverordnung requires the description of the performance, where the accessibility criteria are concerned, to refer to mandatory accessibility requirements within the meaning of section 121(2) that a legal act of the European Union adopts.

Article 24(1) of Directive (EU) 2019/882 makes the accessibility requirements of its Annex I mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU for the products and services the Directive covers.

Prohibits offering pornographic content in telemedia unless the provider ensures the content is accessible only to adults through a closed user group (geschlossene Benutzergruppe), typically verified by an age verification system (Altersverifikationssystem) assessed against KJM criteria.

A provider of broadcasting or telemedia that distributes or makes available an offer suited to impair the development of children or adolescents must ensure that children or adolescents of the age groups concerned do not usually perceive it. The age groups are without restriction, from 6, from 12, from 16 and from 18 years. The provider can meet the duty by technical or other means that make it impossible or substantially harder for the age group concerned to perceive the offer.

The provider can also meet it by labeling the offer with an age rating that suitable youth protection programs can read. Or the provider can choose a time of distribution at which the age group concerned does not usually perceive the offer. A provider that fails to ensure this commits an administrative offence. The fine can reach 500,000 euros.

Providers of video-sharing services must take appropriate measures to protect children and adolescents from offers that impair their development. The measures that come into consideration include the operation of systems for age verification and of systems through which parents can control access to such offers. Providers must also set up systems with which users can rate the offers they upload and which the age verification and parental control systems can read.

The treaty applies to providers of video-sharing services established in Germany under the Digitale-Dienste-Gesetz. A provider that takes no appropriate measures commits an administrative offence. The fine for that offence can reach 500,000 euros. Article 3 of the Staatsvertrag zur Modernisierung der Medienordnung in Deutschland inserted Section 5a into the Jugendmedienschutz-Staatsvertrag. That treaty entered into force on 7 November 2020.

Section 24a names the Bundeszentrale für Kinder- und Jugendmedienschutz (BzKJ, Federal Agency for Child and Youth Protection in the Media) as the competent authority for enforcing Article 28(1) of Regulation (EU) 2022/2065 (the Digital Services Act), under which providers of online platforms that are accessible to minors must take appropriate and proportionate measures to ensure a high level of privacy, safety and protection of children and teenagers within their service.

Paragraph 2 lists the precautionary measures that come into consideration: a reporting and remedy procedure suited to children, a rating system for user-generated audiovisual content, technical means of age verification for content a user rates as suitable only for adults, easily findable references to independent counseling and help services, technical tools for parental control, and default settings that limit usage risk with regard to age.

The Digitale-Dienste-Gesetz of 6 May 2024 rewrote paragraph 1 to name the BzKJ as the enforcer of that Article. The same act removed two of the earlier measures from paragraph 2. Promulgated in the Federal Law Gazette on 13 May 2024, it took effect on the day after promulgation, 14 May 2024.

Requires providers of operating systems commonly used by children and adolescents, as determined by the KJM, to equip their systems with a youth protection device (Jugendschutzvorrichtung) that can be activated, deactivated and adjusted in a simple, easily accessible and secured way and in which a child's age can be set.

Once an age is set, the operating system must restrict browsing to search engines with a secured search function, allow app installation only from distribution platforms whose apps carry a machine readable age label from a KJM recognized automated rating system, and make only age appropriate apps usable unless individually unlocked by the parent.

Under Section 25 these duties apply one year after the KJM publishes its determination of the covered operating systems, which is itself due within one year of the treaty's 1 December 2025 entry into force, so at the latest from 1 December 2027, extended to at most three years for operating systems in a current or completed production cycle, with non updatable systems on devices already sold exempt. No KJM determination of the covered operating systems, from which Section 25 counts the year, has been located.

A person acts unfairly under section 4, number 4 of the Gesetz gegen den unlauteren Wettbewerb (UWG) who targets a competitor for obstruction. Under section 4a(1), a person acts unfairly who commits an aggressive commercial practice that is capable of leading a consumer or other market participant to a commercial decision that the consumer or market participant would not otherwise have taken.

A commercial practice is aggressive where, in the concrete case and taking all circumstances into account, it is capable of significantly impairing the freedom of decision of the consumer or other market participant through harassment, coercion including the use of physical force, or undue influence.

Undue influence exists where the trader exploits a position of power over the consumer or other market participant to exert pressure, even without using or threatening physical force, in a way that substantially restricts the ability of that person to make an informed decision.

Among the circumstances that decide whether a practice is aggressive, section 4a(2) names burdensome or disproportionate non-contractual obstacles by which the trader tries to prevent the consumer or other market participant from exercising contractual rights, including the right to terminate the contract or to switch to another product, service or trader.

A person who intentionally or negligently commits a commercial act made unlawful by section 3 or section 7 is liable to competitors for the resulting damage. A person who intentionally or negligently commits a commercial act made unlawful by section 3 and thereby induces consumers to take a commercial decision they would not otherwise have taken is liable to them for the resulting damage, but this does not apply to unfair acts under sections 3a, 4 and 6 or under number 32 of the Annex.

The version of the Second Act amending the Act against Unfair Competition that the Bundestag legal affairs committee recommended inserted section 4a after section 4. That version provided that the amending Act enters into force on the day after promulgation. The Bundesrat records the amending Act's promulgation in Federal Law Gazette Part I, number 49, of 9 December 2015, so sections 4 number 4 and 4a applied from 10 December 2015.

Section 19a of the Urheberrechtsgesetz (UrhG) defines the right of making a work available to the public as the right to make the work accessible to the public, by wire or wirelessly, in such a way that it is accessible to members of the public from places and at times of their choosing. Section 15(2) UrhG gives the author the exclusive right to communicate the work to the public in non-material form.

That paragraph lists the right of making available to the public among the parts of the right of public communication. A communication is public where it is intended for a plurality of members of the public. Anyone who is not linked by personal relationships to the person exploiting the work, or to the other persons to whom the work is made perceptible or accessible in non-material form, belongs to the public.

Section 19a was inserted into the Act by Article 1, number 5 of the Gesetz zur Regelung des Urheberrechts in der Informationsgesellschaft of 10 September 2003.

A press publisher is whoever produces a press publication, meaning a collection consisting mainly of journalistic writings, published under a single title on a periodic or regularly updated basis, to inform the public about news or other topics, under the publisher's own editorial responsibility, excluding scientific or academic periodicals.

A press publisher holds the exclusive right to make its press publication, in whole or in part, publicly available and to reproduce it for online use by providers of information society services. The right does not reach the use of facts contained in a press publication, private or non-commercial use by individual users, hyperlinking to a press publication, or the use of single words or very short extracts from one.

The right may not be invoked to the detriment of an author or holder of a related right whose work is contained in the publication, nor to stop a third party's use of works validly licensed to the publication under a simple licence or of works that are already in the public domain. It lasts two years from a press publication's first appearance. The currently consolidated text does not apply to publications first published before 6 June 2019.

Authors and holders of related rights are entitled to an appropriate share, at least one third, of the publisher's revenue from exercising this right, an entitlement that can be reduced against their interest only by an agreement resting on a common remuneration rule or a collective bargaining agreement. That entitlement can be asserted only through a collecting society.

The general limitations of German copyright law, including the text-and-data-mining exception and the quotation right, apply correspondingly to the press-publisher right.

Reproducing, distributing, and publicly communicating a published work for the purpose of quotation is permitted, provided the extent of the use is justified by the specific quotation purpose.

The statute names three illustrative cases: individual works incorporated after publication into an independent scientific work to explain its content, passages of a work cited after publication in an independent work of language, and individual passages of a published musical work cited in an independent musical work.

The quotation privilege covers use of an illustration or other reproduction of the quoted work even where that reproduction is itself separately protected by a copyright or related right.

The Federal Court of Justice held in its thumbnail judgment of 29 April 2010 (case I ZR 69/08) that a search engine's display of preview images in its results list is not covered by this provision, because the display does no more than point to the images found; the ruling concerned images, not headlines or snippets.