A Webflow website is quick to build. But to ensure it’s legally compliant, you need more than just a legal notice in the footer. Privacy policies, cookie consent, fonts, embedded videos, forms, accessibility, and—as of August 2026—disclosures for AI chatbots: The list of requirements has grown significantly in recent years.
On top of that, there are some unique aspects of Webflow itself. Webflow is a U.S.-based provider; it does not include its own cookie banner and, by default, loads Google Fonts from Google’s servers. If you’re not aware of this, you could quickly end up with a website that causes problems during an audit or if you receive a cease-and-desist letter.
This article provides an overview of the topics that Webflow website owners should be familiar with and the specific technical aspects that Webflow allows you to examine. It outlines what options are available, not what applies in individual cases.
Note: This post is intended solely for general informational purposes and does not constitute legal advice. We are a web design agency, not a law firm. The content reflects our understanding as of October 2026. Laws and case law are constantly changing. Only an attorney can determine, on a case-by-case basis, whether any obligations apply to your website and, if so, which ones.
Key Points at a Glance
- Since May 2024, the legal basis for the legal notice has been Section 5 of the DDG. References to the old TMG are no longer valid.
- Webflow does not have its own cookie banner. A separate consent tool is required for tracking, marketing tools, and external content.
- Webflow loads Google Fonts from Google's servers. If you want to avoid that, upload the fonts as separate files.
- The link to the EU dispute resolution platform has not been necessary since July 2025 because the platform has been shut down. Any old references should be removed.
- As of June 28, 2025, the Accessibility Enhancement Act applies to many websites through which consumers enter into contracts.
- As of August 2, 2026, AI chatbots must disclose that users are speaking with an AI.
Legal Notice pursuant to Section 5 of the German Data Protection Act (DDG)
On May 14, 2024, the Digital Services Act (DDG) replaced the Telemedia Act. Since then, the legal notice requirement has been set forth in Section 5 of the DDG. Little has changed in terms of content, but many websites still refer to Section 5 of the TMG.
The law requires that this information be easily identifiable, readily accessible, and always available. In practice, this means including a clearly labeled link in the footer of every page. Typical required information includes:
- Name and address; for companies, also legal form and authorized representative
- Email address and another quick way to get in touch
- Commercial Register and registration number, if applicable
- Sales Tax ID Number, if applicable
- For certain professions, information regarding the professional association, professional title, and professional regulations
- for activities requiring a permit, the competent regulatory authority
The specific information required depends on the legal form and industry. For multilingual websites, the legal notice should be accessible in every language version.
Privacy Policy and GDPR
Every website that processes personal data needs a privacy policy. Even an IP address—which is transmitted every time a page is viewed—is considered personal data. The privacy policy describes what data is processed, for what purpose, and on what legal basis; to whom it is disclosed; and what rights visitors have.
A Webflow website typically includes at least the following:
- Hosting via Webflow and the Content Delivery Network
- Forms and What Happens to the Data You Enter
- Web analytics, such as Webflow Analyze or Google Analytics
- Embedded services such as videos, maps, booking tools, or chat widgets
- Fonts, if they are loaded from external servers
- Newsletter Sign-Up and Mailing Service Used
Important for practice: Following a ruling by the European Court of Justice in October 2024 and a decision by the Federal Court of Justice in March 2025, it has been clarified that competitors can issue cease-and-desist letters regarding data protection violations under competition law. An incorrect privacy policy is therefore not just a matter for the supervisory authority.
Order Processing with Webflow
As a hosting provider, Webflow processes personal data on behalf of the website operator. The GDPR requires a data processing agreement for this purpose. With Webflow, the Data Processing Addendum is part of the terms of service and does not need to be signed separately. It is recommended that you download the document and keep it on file for your own records. The same applies to any other service that processes data on your behalf, such as a newsletter tool or a consent management provider.
Data Transfer to the United States
The contracting party is Webflow, Inc., headquartered in the United States. According to the list of subcontractors, the service is hosted by Amazon Web Services, and Cloudflare serves as the CDN. Data is therefore transferred to the United States.
The current basis for this is the EU-U.S. Data Privacy Framework. Webflow states that it is certified under this framework. The EU Court of Justice dismissed a lawsuit challenging the agreement in September 2025. An appeal against that decision is pending before the European Court of Justice. Following a U.S. Supreme Court ruling in June 2026 regarding the independence of U.S. government agencies, the European Data Protection Board asked the European Commission to assess the implications for the agreement.
In short: The agreement is in effect but is under pressure. Webflow’s Data Processing Addendum provides for standard contractual clauses as a fallback. How this point should be described in your own privacy policy should be reviewed by legal counsel. You can find our earlier post on whether Webflow can be used in compliance with data protection regulations here.
Cookies and Consent Pursuant to Section 25 of the TDDDG
Anyone who stores or retrieves information on a visitor’s device must obtain consent under Section 25 of the TDDDG. The only exception is information that is strictly necessary for the service requested by the user. Until May 2024, the law was known as the TTDSG. It applies to cookies as well as to LocalStorage, pixels, and similar technologies.
What Courts and Government Agencies Say About Cookie Banners
- In January 2024, the Cologne Higher Regional Court ruled that consent is invalid if there is no equivalent option to refuse.
- In March 2025, the Hanover Administrative Court confirmed that, in addition to “Accept All,” there must be an equivalent option to “Reject All.”
- The Bavarian State Office for Data Protection Supervision requires that the option to opt out be provided at the same level as the option to consent.
Webflow does not have its own cookie banner
Unlike Shopify, Webflow does not include its own consent banner. Webflow’s developer documentation explicitly states that website operators must set up their own solution. Common tools include Finsweet Consent Pro, Cookiebot, and Usercentrics. These are listed as examples only and do not constitute a recommendation.
What matters is not just that a banner appears, but that scripts actually load only after consent is given. This applies to Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, Hotjar, and similar services. A banner that starts tracking before the user clicks is of no help.
Webflow Analyze and Optimize
According to Webflow, Webflow Analyze operates without cookies but uses LocalStorage. This also falls under Section 25 of the TDDDG. By default, tracking is permanently enabled. In the settings, Webflow offers a mode in which tracking only begins after consent is given, as well as an interface to connect it to the consent tool.
Google Consent Mode
Since March 2024, Google has required the use of Consent Mode, Version 2, for advertising and analytics features within the European Economic Area. This is a Google requirement, not a law, and does not replace a cookie banner. The so-called Advanced Mode sends data to Google even before consent is given and is controversial. By the way, we tested the impact of a cookie banner on conversion rates in our own experiment.
Google Fonts, YouTube, and Google Maps
In January 2022, the Munich Regional Court ruled that embedding Google Fonts via Google servers without consent unlawfully transmits the IP address to Google. This was followed by a wave of demand letters.
This is relevant for Webflow: Webflow downloads fonts from Google's servers when they are integrated via the Google Fonts integration in Site Settings. There is no toggle to change this. The usual solution is to download the font files and upload them to Webflow as custom fonts. Afterward, you should check the source code to make sure there are no longer any requests to fonts.googleapis.com.
The same applies to embedded YouTube videos and Google Maps. Even YouTube’s enhanced privacy mode sends data to Google when the video is played. It is standard practice to load such content only after consent has been given, either through the consent tool or by clicking on a preview image to enable it.
Forms in Webflow
Form submissions are processed through Webflow's infrastructure and stored there. This should be included in the privacy policy. Other important points to consider regarding forms:
- Ask only for what is necessary. Keep required fields to a minimum.
- A note regarding data protection directly on the form, with a link to the privacy policy.
- Spam protection: Google reCAPTCHA transmits data to Google. Alternatives include Cloudflare Turnstile or an invisible honeypot field.
- Sensitive Data: If, for example, health information or job application documents are being collected, it may be advisable to use a specialized form service with servers located in the EU.
Newsletter
The double opt-in procedure has become the standard practice for newsletters: After signing up, the person receives an email containing a confirmation link. This ensures that the consent truly comes from the owner of the email address. In April 2026, the Munich Higher Regional Court ruled that consent to receive a newsletter may not be tied to another service, such as registration.
Accessibility under the BFSG
The Act to Strengthen Accessibility has been in effect since June 28, 2025. Among other things, it applies to services in e-commerce—that is, websites and apps through which consumers enter into contracts. These can include online stores, as well as booking platforms, appointment scheduling that results in a contract, or subscription sign-ups. According to widespread interpretation, a corporate website that does not involve the conclusion of a contract is not covered by the Act. However, the distinction is not always clear-cut in individual cases.
Excluded are microenterprises that provide services: those with fewer than ten employees and an annual revenue or total annual assets of no more than two million euros.
In practice, the technical standard is EN 301 549, which is based on WCAG 2.1 Level AA. This includes an accessibility statement. The Joint Market Surveillance Agency of the German States in Magdeburg is responsible for enforcement. Since the end of 2025, warnings have also been issued. Whether violations of the BFSG are subject to warnings under competition law has not yet been clarified by the courts.
The Audit Panel in Webflow highlights common issues such as missing alt text or insufficient contrast. Webflow itself points out that it does not guarantee compliance. Overlay tools that promise accessibility through scripting are no substitute for a genuine audit. For more information on the requirements, see our in-depth article on the Accessibility Enhancement Act.
AI Chatbots and AI Content
The transparency requirements set forth in Article 50 of the European AI Regulation have been in effect since August 2, 2026. The postponement of other parts of the regulation in the summer of 2026 does not affect these requirements. For websites, this means, above all:
- An AI chatbot on a website must make it clear to users that they are interacting with an AI, unless this is already obvious.
- AI-generated images or videos that look deceptively real—known as "deepfakes"—must be labeled as such.
In Germany, the Federal Network Agency has been the central supervisory authority for the AI Regulation since July 2026.
Dispute Resolution: Remove the ODR link; Check the VSBG notice
The EU's online dispute resolution platform was shut down on July 20, 2025. The requirement to provide a link to it has therefore been lifted. A link to a platform that no longer exists may be misleading. It should be removed from legal notices, terms and conditions, email signatures, and social media profiles.
The provision under Section 36 of the Consumer Dispute Resolution Act remains in effect. Anyone who operates a website or uses terms and conditions and enters into contracts with consumers must indicate whether they participate in arbitration proceedings. Companies with ten or fewer employees are exempt from this requirement.
Multilingual Websites with Webflow Localization
With Webflow Localization, you can customize pages, CMS content, and URLs for each language. For legal texts, this means that the legal notice, privacy policy, and cookie banner should be accessible in every language version. Anyone using translated legal texts should clarify which version is authoritative.
Embedding Legal Texts in Webflow
Webflow does not have its own interface for legal texts. It is common practice to import texts from a specialized provider via copy and paste or as an embedded element. Some providers offer sample texts tailored to Webflow. It is important that someone updates the texts when laws change or new tools are added to the website. Many providers notify their customers of any changes.
Checklist for Your Webflow Website
These points are a starting point for a discussion with an attorney or legal document provider; they are not a final review.
- Legal notice with reference to § 5 DDG, accessible from every page
- Privacy Policy describing all services actually used
- Data Processing Agreements with Webflow and other service providers have been filed
- Consent tool set up; "Decline" is equivalent to "Accept"
- Tracking, pixels, and external content are loaded only after consent is given
- Webflow Analyze and Optimize have been switched to consent-based mode, if used
- Fonts uploaded locally; no requests to Google Fonts servers
- YouTube, Vimeo, and Google Maps are loaded only after consent is given
- Forms with a privacy notice and spam protection that minimizes data collection
- Newsletter with double opt-in and no linking
- Determining whether the BFSG applies, and if so: accessibility statement and implementation in accordance with WCAG
- AI chatbot with a clear notice, if available
- OS-Link removed, VSBG notice reviewed
- Legal texts are available in all language versions
- a set date to check everything on a regular basis
What we support and what we don't
As a Webflow agency, we handle the technical side: setting up the consent tool and connecting it to all scripts, embedding fonts locally, loading external content only after consent is given, designing forms with data minimization in mind, ensuring accessibility in both design and development, and properly integrating legal text. As part of our Webflow support services, we regularly check whether new tools are loading without consent.
What we don’t do: draft legal documents, conduct legal reviews, or provide binding assessments of the obligations that apply to your company. For these services, it’s best to work with a law firm specializing in IT law or a provider that specializes in legal documents. If you’d like to outsource the technical implementation, you can reach us via the project inquiry form.
Frequently Asked Questions
Is Webflow GDPR-compliant?
Webflow provides the tools necessary for data protection-compliant operations, such as a data processing agreement and certification under the Data Privacy Framework. Whether a specific website is GDPR-compliant depends on how it is set up and which services are integrated.
Does Webflow have its own cookie banner?
No. In its developer documentation, Webflow refers users to custom solutions or third-party providers. Common options include Finsweet Consent Pro, Cookiebot, and Usercentrics.
Do I need to embed Google Fonts locally in Webflow?
If you use Google Fonts via the Webflow integration, they are loaded from Google’s servers. According to a 2022 ruling by the Munich Regional Court, it is considered less risky to upload the fonts as separate files.
Does my Webflow website need an accessibility statement?
That depends on whether contracts with consumers are concluded through the website and whether the exemption for micro-enterprises applies. According to widely held opinion, a website intended purely for informational purposes is not subject to the BFSG. If in doubt, this should be reviewed by a legal professional.
Does the OS link still need to be included in the legal notice?
No. The EU platform was shut down in July 2025. The link should be removed. The notice required under § 36 VSBG may still be necessary.
Does a chatbot on my website need a disclosure?
Yes, if it is AI-based and it is not already obvious that it is an AI. This requirement has been in effect since August 2, 2026.
Sources
- § 5 Digital Services Act
- § 25 TDDDG
- § 2 Act to Strengthen Accessibility
- § 36 of the Consumer Dispute Resolution Act
- Webflow: Data Processing Addendum
- Webflow: Subcontracted Processors
- Webflow: Privacy FAQs
- Webflow Developer: Consent Management
- Bavarian State Office for Data Protection Supervision: Information Sheet on Consent Banners
- NRW Consumer Protection Agency: Cologne Higher Regional Court on the Cookie Banner
- IHK: Google Fonts and the Munich Regional Court's Ruling
- MLBF: State Market Surveillance Agency for Accessibility
- Bonn Chamber of Industry and Commerce: Shutdown of the EU Dispute Resolution Platform
Disclaimer: The information in this article has been carefully researched and reflects the legal situation in Germany and the EU as of October 2026. It is not a substitute for individual legal advice. We do not guarantee the accuracy, completeness, or timeliness of this information. Whether and which obligations apply to your website can only be assessed on a case-by-case basis by an attorney. We provide support with the technical implementation but do not draft or review legal texts. The tools and providers mentioned are examples and do not constitute a recommendation.
