Inside the envelope: several pages of legal German, an invoice for a four-figure sum, a form to sign, and a deadline of “by Friday”. It reads as though everything is settled and all that remains is to pay. It is not. Here is what to do in the first forty-eight hours, and which facts are worth knowing before you talk to a lawyer.
If you have never met one: an *Abmahnung* is a formal cease-and-desist letter under German law. It is not a court document and not a fine — it is a private demand, usually from a competitor or a consumer association, and it can be answered.
First moves
Record the date of receipt. Keep the postmarked envelope, photograph the letter in full including annexes. The deadline in the letter runs from receipt, and you may need to prove that date.
Do not pay immediately. Paying the invoice does not close the matter. The demands normally come in two parts: money and an undertaking. Paying the first does not remove the second, but it can be read as an admission.
Do not sign the enclosed form. More on that below — it is the heaviest part of the letter.
Do not ignore it. Silence does not end the story: the usual next step is an injunction, and the costs grow.
Take a snapshot of your site as it stands. Save whole pages, not screenshots: you may need to show exactly what was on the site when the letter arrived. It is also worth saving what you fixed afterwards, with dates.
Find a lawyer specialising in IT and competition law. Not a generalist — this is a narrow field.
About the undertaking form
Almost every such letter encloses a *strafbewehrte Unterlassungserklärung* — an undertaking to stop and not repeat the conduct, backed by a contractual penalty.
Technically it is a unilateral offer. Once the other side accepts it, a separate contract comes into existence — and it is open-ended. It does not expire after a year and does not end with the dispute. On any repeat breach the penalty is enforced under that contract, regardless of whether the original claim was well founded.
The undertaking runs indefinitely. It is the open-ended term and the penalty, not the breach itself, that create the long-term risk.
The text supplied by the sender is usually drafted more broadly than the actual breach — in their favour. Lawyers normally work with an amended version (*modifizierte Unterlassungserklärung*) limited to the specific conduct. That is a job for a lawyer, not for the site owner.
What is worth knowing about the costs
German unfair competition law contains provisions that limit what can be recovered from small businesses. Knowing they exist is useful; whether they apply to your case is for your lawyer to judge.
Section 13(4) UWG rules out reimbursement of the costs of an Abmahnung in two situations: breaches of information and labelling duties in e-commerce and digital services, and data protection breaches by undertakings that normally employ fewer than 250 people.
Section 13a UWG caps the penalty. The ceiling is €1,000 where the breach affects the interests of consumers, competitors and the market only marginally and the recipient normally employs fewer than 100 people. And on a first Abmahnung for the breaches listed in subsection 4, a contractual penalty is excluded altogether where there are fewer than a hundred employees.
Section 13(2) UWG sets requirements for the letter itself: it must clearly identify the sender, the basis of their standing, the cost claim with its calculation, and the breach with the underlying facts. If those requirements are not met, the recipient acquires a counterclaim for their own costs.
None of this means “you can ignore it”. It means the recipient’s position is usually stronger than it feels in the first hour.
Deadlines
The law sets no time limit for a reply. Senders set their own, often a few days and often deliberately short. A short deadline in the letter is a tactic, not a legal rule. That is no reason to drag your feet, but also no reason to decide anything in one evening.
The usual technical triggers
From correspondence with clients, these letters most often concern one of a handful of places on a site.
- Fonts and other assets from external servers. The classic is Google Fonts loaded by link. When the page loads, the visitor’s IP address goes to someone else’s server. The Munich Regional Court awarded €100 in damages on exactly that basis on 20 January 2022 in case 3 O 17493/20.
- Maps, analytics and pixels before consent. Scripts that fire before the visitor has clicked “accept”.
- A cookie banner with no equally easy refusal. German supervisory authorities stated in guidance of November 2024 that the user must have options of equal effort — accept and refuse. A refusal buried on a second screen or in a wall of text does not meet the test.
- An incomplete Impressum. An important detail here: § 5 TMG no longer exists. The Telemediengesetz was repealed and replaced by the Digitale-Dienste-Gesetz on 14 May 2024. The mandatory details now sit in § 5 DDG. If your Impressum says “Angaben gemäß § 5 TMG”, it cites a law that is gone.
- A missing or outdated privacy policy. The duty to inform follows from Articles 13 and 14 GDPR. Texts citing TMG and TTDSG need updating: since May 2024 the TTDSG is called the TDDDG.
Each of these is worked through, with checks and fixes, in “Seven small things on your site that really do get you a letter in Germany”.
What has changed in practice
Two things worth knowing.
The mass wave of Google Fonts letters in 2022 has stopped: courts began treating such campaigns as an abuse of rights. In August 2025 the Federal Court of Justice stayed proceedings in case VI ZR 258/24 and referred questions to the Court of Justice of the EU — including where abuse begins. No ruling had been issued at the time of writing.
At the same time, in March 2025 the same court confirmed that data protection breaches can be pursued in civil proceedings not only by consumer associations but also by competitors. The circle of people entitled to send you a letter has, if anything, widened.
The whole procedure as one list
- Keep the envelope, record the date of receipt.
- Take a full copy of the site as it currently stands.
- Sign nothing and pay nothing.
- Find a specialist lawyer and hand over the letter in full.
- Fix the technical breaches where they are obvious — and record what you fixed and when.
- Conduct all further correspondence through your lawyer.
This is technical preparation of a website, not legal advice. For how the rules apply to your particular case, talk to a lawyer.
Sources
- § 5 DDG — mandatory provider details (Impressum)
- § 25 TDDDG — consent for access to information on a device
- § 13 UWG — requirements for an Abmahnung and exclusion of costs
- § 13a UWG — contractual penalties and their limits
- LG München I, 20 January 2022, case 3 O 17493/20 — Google Fonts
- Federal Court of Justice, press release of 27 March 2025 — who may pursue GDPR breaches
- German data protection authorities: guidance on digital services, November 2024 (PDF)
Checked on 26 July 2026.