Accessibility and legal warnings: what small businesses in Germany need to know about their website

Most legal warnings against small businesses have nothing to do with bad intent. They arise from things you cannot see on your own website: a font loaded in the background from a third-party server, a photo from an image search, a video that transfers data as soon as the page opens. Here are the most important pitfalls, and how to avoid them from the start.

Accessibility: what the BFSG requires

Since 28 June 2025 the German Accessibility Strengthening Act (Barrierefreiheitsstärkungsgesetz, BFSG) has been in force. It requires many digital services for consumers to be usable without barriers, for example online shops, bookings and appointment scheduling through the website.

Micro-enterprises that provide services are exempt. A micro-enterprise employs fewer than 10 people and has an annual turnover or balance sheet total of at most 2 million euros. A purely informational site without an ordering or booking function is usually not covered either.

But even if the law does not oblige you: accessibility pays off. Weak contrast, buttons that cannot be operated by keyboard or forms without labels also slow down people without disabilities, say on a phone in the sun or without their reading glasses at hand. Whoever cannot use the site does not enquire.

• Text has enough contrast to its background (at least 4.5 : 1 under WCAG 2.2 level AA).
• Everything can be operated by keyboard.
• Headings are cleanly structured, images have alternative text.
• Form fields are labelled, error messages are understandable.

Google Fonts: the font that became a legal warning

Many websites load their fonts directly from Google’s servers. In doing so, every visitor’s IP address is transmitted to Google without their consent. The Regional Court of Munich I saw this as a data protection violation and awarded a visitor damages (judgment of 20 January 2022, case 3 O 17493/20). A wave of warning letters to website operators followed.

The fix is simple: fonts are hosted on your own server. The same applies to embedded maps and videos. They should load only after the visitor clicks, not as soon as the page opens.

Images: not everything on the web may be used

A photo from an image search is almost always protected by copyright. Using it without a licence risks a warning with a claim for damages, even if the image is small on a subpage. Safe options are your own photos, licensed images with proof or graphics you created yourself. Keep the proof so you can present it if needed.

AI content: what the AI Act requires

Since 2 August 2026 the transparency obligations of Article 50 of the EU AI Act apply. If you use an AI chat on your website, visitors must be able to recognise that they are talking to an AI. Images, video or audio generated or altered with AI that show real people, places or events deceptively realistically (deepfakes) must be labelled as artificial. The same applies to AI texts on matters of public interest, unless a person has reviewed them and bears editorial responsibility. An AI image that deceives nobody, such as an illustration, is not covered by this obligation; we label it anyway because it builds trust.

The classics: legal notice, privacy policy, consent

• Legal notice (Impressum): business websites in Germany need provider identification that is easy to find and one click away (§ 5 Digital Services Act, DDG).
• Privacy policy: it must describe which data the website processes and for what purpose (Art. 13 GDPR).
• Consent: visitor statistics, advertising tracking and embedded services often need consent before they load.

Prevent instead of repair

All these points can be fixed later, but rebuilding a finished site piece by piece is tedious and expensive. It is easier to build it right from the start. At Catinity these points are standard, not an extra:

• Accessibility under WCAG 2.2 level AA, every page automatically checked with axe before it goes live.
• Fonts on our server instead of Google’s, maps and videos only after a click.
• Own or licensed images with proof, AI images labelled.
• Legal notice and privacy policy as a prerequisite: without them the site technically cannot go live.
• Visitor statistics only with consent, without cookies and without third parties.

How this fits into the eleven stages of our website development is shown on the page Website development . And why a custom site avoids such pitfalls more easily than a CMS with many plugins is explained in Built, not clicked together .