Legally compliant online store in Germany: 2026 checklist

In short

A legally compliant online store in Germany needs, as of November 2026, an Impressum under § 5 DDG, a withdrawal notice with the model form, an electronic withdrawal button under § 356a BGB (required since 19 June 2026), an order button labelled "zahlungspflichtig bestellen", prices under the Preisangabenverordnung, a privacy policy and cookie consent under § 25 TDDDG. On top of that come packaging registration in LUCID, accessibility under the BFSG for stores that are not micro-enterprises, and, since 27 September 2026, the harmonised notice on the statutory warranty. In Shopify most of this lives in Settings > Policies, Settings > Customer privacy and the checkout texts, while the withdrawal button and the 30-day lowest price need an app.

Every law below was read in its current version on gesetze-im-internet.de, in the Federal Law Gazette and on the Austrian legal information system RIS on 3 November 2026; Shopify settings come from Shopify's help centre on the same day. This guide is not legal advice: it shows where the obligations are and where they go in Shopify, and the texts themselves should come from a lawyer or a legal-text provider.

What changed from 2024 to 2026

Many checklists that rank on Google are older than these changes. Some still cite the TMG or the TTDSG, and several do not mention the withdrawal button.

Not relevant for a store that sells only its own goods: DAC7. Under § 3 PStTG, the reporting duties concern operators who make a platform available to other sellers, such as marketplaces.

Impressum under § 5 DDG

Since 14 May 2024, the provider identification for websites is set out in § 5 of the Digitale-Dienste-Gesetz, which replaced the TMG on that day. The information must be easy to recognise, directly reachable and permanently available, in practice a link labelled "Impressum" in the footer of every page. The store must show:

• the name and the address where the business is established; for companies also the legal form and the authorised representative (for a GmbH, the managing director);
• details for fast electronic contact, including an email address;
• the register and the registration number, for example the commercial register;
• the VAT identification number or the business identification number, if the business has one;
• the supervisory authority, if the activity needs an official licence, and the chamber and professional title for regulated professions;
• for companies in liquidation, a note saying so.

A store that still cites "§ 5 TMG" shows a law that is no longer in force. The Impressum does not replace the trader details that also belong in the customer information (address, telephone number and email under Art. 246a EGBGB).

Terms (AGB) and customer information

No law says a store must have terms (AGB). The law requires information: what the customer must be told before and after ordering. Terms are the usual place to collect it. Under § 312i(1) BGB, the store must:

• let the customer spot and correct input errors before ordering;
• confirm receipt of the order electronically without delay;
• let the customer retrieve and save the contract terms, including the terms and conditions, when the contract is concluded.

Under § 312j(1) BGB, any delivery restrictions and the accepted payment methods must be stated clearly at the latest when the order process begins. Art. 246a § 1 EGBGB lists the customer information for distance contracts: the main features of the goods, the trader's identity and address, the total price including taxes, delivery costs, payment and delivery terms with the delivery date, and the statutory warranty.

Withdrawal notice, model form and withdrawal button

Consumers can withdraw from a distance contract within 14 days without giving a reason (§ 355(2) BGB). The store must tell them the conditions, deadlines and procedure, and provide the model withdrawal form from Annex 2 to the EGBGB. Using the official model notice from Annex 1, correctly filled in and in text form, satisfies the information duty.

The model withdrawal form contains: the trader's name, address and email address; "Hiermit widerrufe(n) ich/wir…" (I/we hereby withdraw from…) with the goods; the order or delivery date; the consumer's name and address; a signature (only on paper); and the date.

Withdrawal button since 19 June 2026: § 356a BGB was introduced by the law published in the Federal Law Gazette BGBl. 2026 I Nr. 28 on 5 February 2026; the law itself sets 19 June 2026 as the date it comes into force. For contracts concluded through an online interface, the store must provide a withdrawal function:

1. labelled clearly with "Vertrag widerrufen" (withdraw from contract) or equally unambiguous wording;
2. permanently available during the withdrawal period, placed prominently and easy to reach;
3. asking only for the consumer's name, details identifying the contract (or the part being withdrawn) and the electronic channel for the confirmation;
4. followed by a confirmation button labelled "Widerruf bestätigen" (confirm withdrawal) or equivalent;
5. after which the store sends, without delay and on a durable medium such as email, a confirmation of receipt with the content, date and time.

A withdrawal sent through the function before the deadline counts as on time. The model notice in Annex 1 now has an optional paragraph saying the right can also be exercised online at a given address, so the withdrawal notice should be updated together with the button. A built-in withdrawal function could not be found in Shopify's help centre on 3 November 2026, so apps provide it, with prices listed in the article What an online store costs in 2026.

Order button: "zahlungspflichtig bestellen"

Under § 312j(3) BGB, the button that places the order must be clearly legible and labelled with nothing other than "zahlungspflichtig bestellen" (order with obligation to pay) or equally unambiguous wording. Under § 312j(4), a contract is only formed if the store meets this duty. Directly before the button, the store must also show the key information prominently: the main features of the goods, the total price, delivery costs and, for subscriptions, the term and cancellation conditions (§ 312j(2) BGB).

In Shopify, checkout texts are edited in the admin under Online Store > Themes, the menu next to the theme, Edit default theme content, category "Checkout & system". Shopify notes that some Shop Pay wording cannot be changed. The label of the final button should be checked in every store language and in every checkout variant, including express checkouts, before launch.

Prices under the PAngV: gross price, unit price, shipping, 30-day price

• Total price (§ 3 PAngV): consumers see the final price including VAT and all price components. If a price is broken down, the total must stand out.
• VAT and shipping (§ 6 PAngV): for distance sales, the store states that prices include VAT and whether delivery or shipping costs are added, with the amount where it can be calculated in advance. A note such as "incl. VAT, plus shipping" with a link to the shipping costs is the usual form.
• Unit price (§ 4 PAngV): goods sold by weight, volume, length or area also need a unit price (Grundpreis) next to the total price, unmistakable, clearly visible and legible. § 5 sets the unit at 1 kg, 1 l, 1 m³, 1 m or 1 m²; 100 g or 100 ml is only for loose goods. Exceptions include goods under 10 g or 10 ml, sets of different unmixed products, decorative cosmetics and certain perfumes.
• Price reductions (§ 11 PAngV): every announced price reduction for goods must state the lowest total price the store charged consumers in the 30 days before the reduction. Individual discounts and perishable goods are exempt.

Shopify's compare-at price is a field the merchant fills in by hand; Shopify's help centre does not mention the 30-day rule and the field does not track price history. Stores that run sales use an app that stores the lowest price, for example Complimus Omnibus & Withdrawal, which also covers the withdrawal button: a free plan for up to 100 products, Business at $14.99 a month on Basic and Grow or $29.99 on Advanced, and Plus at $99.99, according to the Shopify App Store on 3 November 2026.

Statutory warranty (Gewährleistung) versus guarantee (Garantie)

The statutory warranty is the legal right to remedies for defects, for goods at least two years. A guarantee is a voluntary extra promise by the seller or manufacturer. The two must not be mixed up in product texts or terms.

Since 27 September 2026: Art. 246a § 1(1) no. 11 EGBGB requires the store to point out the statutory warranty, its main elements and its minimum duration of two years prominently, using the harmonised notice from Annex I of Implementing Regulation (EU) 2025/1960. If a manufacturer gives a free durability guarantee of more than two years for the whole product and passes this information to the store, the harmonised label from Annex II is also required (no. 11a). The date comes from Article 3 of the law in BGBl. 2026 I Nr. 28. According to the Chamber of Commerce IHK Aschaffenburg, the notice belongs prominently and in colour in the product presentation, for example on the product page or before the order; a hover text, a collapsed text or the terms alone are not enough, and the guarantee label goes next to the product image.

Guarantee statement (§ 479 BGB): a store that advertises a guarantee must word it simply and clearly and include a note on the statutory rights, that using them is free and that the guarantee does not restrict them; the guarantor's name and address; the claim procedure; the goods covered; and the terms, especially duration and territory. The consumer gets it on a durable medium at the latest on delivery.

Privacy policy (GDPR Art. 13) and cookie consent (§ 25 TDDDG)

A store collects personal data at the latest at checkout, so Art. 13 GDPR applies. According to the German data protection authorities' short paper no. 10, the privacy policy names:

• the controller with contact details and, where appointed, the data protection officer;
• the purposes and the legal basis of each processing, including legitimate interests where they are the basis;
• recipients or categories of recipients, such as payment, shipping and email providers, and any transfer to third countries with the safeguard used;
• the storage period or the criteria for it;
• the data subject's rights, the right to withdraw consent and the right to complain to a supervisory authority;
• whether providing the data is required and what happens if it is not, and any automated decision-making.

Cookie consent: § 25 TDDDG (until 13 May 2024 called TTDSG) allows storing or reading information on the user's device only with consent based on clear and complete information. Without consent it is allowed only where it is strictly necessary for a service the user explicitly requested, such as the cart. Analytics, advertising pixels and most marketing tools therefore wait for consent.

Shopify's built-in banner is under Settings > Customer privacy > Cookie banner. In the regions where it is active, Shopify collects non-essential data, including Shopify Pixels, only after consent; with automated settings, Shopify sets it up for visitors from the UK and the EEA where the store has active markets. The banner covers only Shopify's own tools. Pixels or scripts added by hand need a third-party consent app connected through Shopify's Customer Privacy API, set to the same regions, otherwise data can be processed before consent. Shopify's help page does not mention Google Consent Mode.

Accessibility: BFSG since 28 June 2025

The Barrierefreiheitsstärkungsgesetz has applied since 28 June 2025 to e-commerce services offered to consumers, meaning websites and mobile apps through which consumer contracts are concluded (§ 1(3) no. 5 and § 2 no. 26 BFSG). B2B-only stores are not consumer services in this sense.

Micro-enterprise exemption: under § 3(3) BFSG, the requirements do not apply to micro-enterprises that provide services. Under § 2 no. 17 BFSG, a micro-enterprise employs fewer than 10 people and has either an annual turnover of at most €2 million or a balance sheet total of at most €2 million. Both conditions apply together: a two-person business with €3 million turnover and a €2.5 million balance sheet is not exempt.

Stores that are covered must meet the accessibility requirements and publish information on how the service meets them, itself in accessible form (§ 14(1) BFSG and Annex 3). In practice this concerns the theme (contrast, keyboard use, alt texts, form labels), the checkout and an accessibility page in the store.

Packaging (LUCID), electrical goods and batteries

Packaging: since 12 August 2026, the EU Packaging Regulation (PPWR) and the German Verpackungsrecht-Durchführungsgesetz have replaced the Verpackungsgesetz. According to the Zentrale Stelle Verpackungsregister, the core duties remain: register in the LUCID packaging register before first making packaging available (§ 6 VerpackDG), join a dual system for packaging that ends up with households (§ 7) and report the quantities. Shipping packaging, including filling material such as plastic film, flakes or tissue paper, is always subject to system participation. A seller without an establishment in Germany that delivers directly to end users, for example a store run from Slovakia or Czechia, has had to appoint an authorised representative since 12 August 2026; the LUCID registration itself cannot be delegated.

Electrical and electronic equipment (ElektroG): producers register with the competent authority, stiftung ear, before placing devices on the market, and state their registration number in offers and on invoices (§ 6). Stores may not offer devices of unregistered producers. Distance sellers with storage and shipping areas for electrical equipment of at least 400 m² must take back old devices and publish the take-back information in their store or include it in the parcel (§§ 17, 18 ElektroG).

Batteries (BattDG, since 7 October 2025): every retailer takes back portable and LMT waste batteries of the types it sells free of charge. Distance sellers provide suitable return options at a reasonable distance and give the battery information in their store and on their website or in the parcel (§§ 14, 24 BattDG). Producers register with stiftung ear (§ 5).

ODR link and consumer arbitration (§ 36 VSBG)

The European Commission discontinued the EU online dispute resolution (ODR) platform as of 20 July 2025. According to the European Parliament's summary, Regulation (EU) 2024/3228 repealed the ODR Regulation (EU) No 524/2013 with effect from that date. A link to the platform now points to a closed site; law firm CMS also states that businesses no longer need to show it. The link and the sentence about it should be removed from the Impressum, terms and emails.

What remains is § 36 VSBG: a business with a website or terms states whether it is willing or obliged to take part in proceedings before a consumer arbitration body, and if so names the body with address and website. The first part does not apply to businesses that employed 10 or fewer people on 31 December of the previous year, but the second does if the business has committed to arbitration. After a dispute that could not be settled, the store names the competent body in text form (§ 37 VSBG).

Notes for Austria

• Impressum (§ 5 ECG): name or company, geographical address, contact details including email, company register number and court, supervisory authority, chamber or professional association with the professional title, and the VAT ID if there is one. Prices must be easy to read and show whether they include VAT and shipping (§ 5(2) ECG).
• Disclosure (§ 25 MedienG): websites also publish a disclosure (Offenlegung). For a site that only presents the owner, name or company, the business purpose where applicable, and the registered office are enough (§ 25(5)); stores with a blog or magazine content can need more.
• Distance selling (FAGG): 14 days to withdraw (§ 11). The order button is labelled "zahlungspflichtig bestellen" or equivalent (§ 8(2)), and delivery restrictions and payment methods are shown at the start of the order (§ 8(3)).
• Withdrawal button: § 13a FAGG, introduced by the VerbRÄG 2026 (BGBl. I Nr. 59/2026), applies from 1 October 2026; according to the Austrian Economic Chamber (WKO), it covers contracts concluded after 30 September 2026. The wording matches Germany: "Vertrag widerrufen" and "Widerruf bestätigen".
• Warranty notice: the version of § 4 FAGG valid from 1 October 2026 includes the information on the statutory warranty and its two-year minimum.
• Cookies: § 165(3) TKG 2021 makes consent the condition for storing or reading data on the device.
• Dispute resolution: § 19 AStG requires naming the arbitration body (with its website) only if the business has committed to it or is obliged to use it.
• Accessibility: the Barrierefreiheitsgesetz (BaFG) has applied since 28 June 2025, with the same micro-enterprise exemption for services (§ 6 BaFG).

A store selling into both countries does not need two shops, but the legal texts must cover both: German texts alone cite the wrong laws for Austrian customers. Legal-text packages state which countries they include.

Shopify legal texts and GDPR settings: where each item goes

Policies: under Settings > Policies, Shopify has fields for Return policy, Privacy policy, Terms of service, Shipping policy, Legal notice (used for the Impressum), Contact information and Subscription policy. Shopify links them in the checkout footer, shows the return policy on the order review page and the shipping policy on product pages and in the cart. Shopify says its automated policy templates are for information only, are not legal advice and do not guarantee compliance. The texts therefore come from a provider, and the policies are also added to the footer menu under Content > Menus.

Prices: gross prices are set under Settings > Taxes and duties with "Include sales tax in product price and shipping rate"; for selling abroad, tax-inclusive pricing can be set per market. Unit prices are entered per product or variant under Pricing > Unit price, in bulk in the bulk editor or by CSV; all Online Store 2.0 themes support them.

Legal-text providers with prices from their own pages on 3 November 2026:

A provider with an update service adjusts the texts when the law changes, which in 2026 happened with the withdrawal button and the warranty notice. Cookie and withdrawal apps with their prices are compared in What an online store costs in 2026.

Setting all this up is part of building a store. At Alpinefy, a Shopify store starts from €4,000, and the build includes the legal pages set up with the texts from the client's chosen legal-text provider. Alpinefy is not a VAT payer, so the quoted price is final.

Checklist 2026: law, task and place in Shopify

For a live store, an e-shop audit checks these points and sorts what to fix first, from €690. Monthly costs for legal texts, cookie and withdrawal apps are in What an online store costs in 2026, the platform choice in Shopify or WooCommerce, and selling from Slovakia or Czechia in the guide to Shopify in Slovakia and Czechia.

Sources, checked on 3 November 2026: § 5 DDG, DDG, entry into force, BGBl. 2024 I Nr. 149 (end of the TMG), § 25 TDDDG, § 312i BGB, § 312j BGB, § 355 BGB, § 356a BGB, § 479 BGB, Art. 246a § 1 EGBGB, model withdrawal notice, model withdrawal form, BGBl. 2026 I Nr. 28, IHK Aschaffenburg on the warranty notice, § 3 PAngV, § 4 PAngV, § 5 PAngV, § 6 PAngV, § 11 PAngV, DSK short paper no. 10, § 2 BFSG, § 3 BFSG, § 14 BFSG, VerpackDG, Zentrale Stelle Verpackungsregister, LUCID for online retail, § 6 ElektroG, § 17 ElektroG, BattDG, stiftung ear, European Commission on the ODR platform, European Parliament summary of Regulation 2024/3228, CMS on the ODR link, § 36 VSBG, § 37 VSBG, § 3 PStTG, § 5 ECG, § 25 MedienG, § 8 FAGG, § 13a FAGG, WKO on the withdrawal button, § 165 TKG 2021, § 19 AStG, § 6 BaFG, Shopify store policies, Shopify checkout texts, Shopify cookie banner, Shopify prices including tax, Shopify unit prices, Shopify compare-at price, Complimus Omnibus & Withdrawal, IT-Recht Kanzlei, Händlerbund, Händlerbund legal texts for Shopify, eRecht24, Trusted Shops Rechtstexter.