Legal requirements - German portfolio site

This is the highest-risk finding, and it’s specific to Veronika rather than to the tech.

"Architekt/Architektin" is protected in Germany. Only people entered in the Architektenliste of a Architektenkammer may use it - which requires a qualifying degree plus at least two years of practical experience. A B.Sc. mid-Master qualifies for neither.

Protection is broader than the noun. It reaches "Architekturbüro", compounds containing "Architektur", the English "Architect"/"Architecture", and even directory listings under the category "Architektur". OLG Hamm (2019) held advertising with "Architektur" misleading where no registered architect works there. An older Hamburg ruling held even "Dipl.-Ing. Architektur" required chamber registration - and the AKNW states that reasoning applies directly to the new Bachelor/Master degrees.

What this means for our markup:

The current subtitle is defensible as simply the name of the awarded degree - that’s the strongest reading. But the Hamburg/AKNW line on "Dipl.-Ing. Architektur" means it isn’t risk-free, and reordering to "Bachelor of Science, Fachrichtung Architektur" costs nothing and lands inside the chambers' own approved pattern.

Applied 2026-07-16 on her instruction: the subtitle now reads "Bachelor of Science, Fachrichtung Architektur" in the header, the hero and the footer. <title> and the OG title were already kept clear of "Architektur". Still worth confirming the exact wording with her Kammer.

Honest scale: enforcement against a non-commercial student portfolio is unlikely; the chambers care about people competing for building commissions. But the rules are drafted broadly, the fix is a five-word edit, and she’ll want chamber registration later.

LG München I, 20.01.2022, Az. 3 O 17493/20 - rechtskräftig since 10.03.2022.

Embedding Google Fonts from Google’s CDN without consent violates the DSGVO: the visitor’s IP is transmitted to Google and an IP is personal data. €100 damages + injunction.

The load-bearing part: the court rejected legitimate interest (Art. 6(1)(f)) because Google Fonts can be self-hosted. The external call was therefore not necessary.

Two nuances usually left out:

Nothing about this reasoning is Google-specific. cdnjs is Cloudflare - a US company - so Font Awesome from cdnjs raised exactly the same issue. Font Awesome’s own blog concedes self-hosting is the right call for GDPR.

What we did: fonts downloaded, subset to latin + latin-ext, only the weights actually referenced, font-display: swap, the two above-the-fold faces preloaded (mockup/fonts.css). Icons inlined as an SVG sprite from the Font Awesome Free package - 4.5 KB for eight icons, vs ~275 KB for the icon font (mockup/assets/icons.svg; icons are CC BY 4.0, attribution is in the file).

Verified, not assumed: a CDP network audit of a full page load plus interaction records zero requests off-origin. Re-run it whenever a dependency is added - this is the property that silently breaks the first time someone pastes in a CDN snippet.

The "it’s private, the household exemption applies" argument does not work for a public website. ECJ Lindqvist (C-101/01): publishing personal data on a site accessible to an indefinite number of persons falls outside Art. 2(2)(c) - reaffirmed in Buivids (C-345/17).

The site processes personal data regardless of intent: server logs record IPs, and IPs are personal data. Add a contact form and it’s beyond argument.

Art. 13 content required: controller identity + contact; purposes and legal basis; recipients; third-country transfers; storage duration; the Art. 15-21 rights; right to complain to a supervisory authority; whether providing data is required and the consequences.

She needs no Datenschutzbeauftragter - that threshold is 20+ persons (§ 38 BDSG).

Skeleton is in the mockup (#datenschutz). Note the "Keine Drittdienste" paragraph is only true because §1 keeps it true - if anyone adds a CDN, that paragraph becomes a false statement in a legal document, which is worse than not having written it.

Still needed from her: hoster name, an AVV per Art. 28 with the hoster, storage durations, the competent supervisory authority.

I built this wrong first, and the research corrected it. A mandatory "I consent to the privacy policy" tick-box is a widespread myth and actively worse for her.

Also applied: data minimisation (Art. 5(1)(c)) - only Name/E-Mail/Nachricht, all genuinely needed. Honeypot instead of reCAPTCHA, because reCAPTCHA is a Google call and would reintroduce §1. No third-party form service (Formspree/Google Forms/Typeform) without an AVV - the Axum handler on the same origin is the clean answer. TLS is effectively mandatory (Art. 32).

⚠️ Test that the form actually delivers, and doesn’t land in spam. A silently failing contact form on a job-seeking portfolio is the worst possible bug: it fails invisibly and costs her exactly the opportunities the site exists to create.

§ 25 TDDDG requires consent to store/read on a device unless strictly necessary. With no analytics, no tracking, no embeds and no external fonts, no banner is required. If the site sets zero cookies and uses no localStorage, § 25 isn’t triggered at all.

It becomes mandatory the moment anyone adds Google Analytics, Meta Pixel, Hotjar, a YouTube or Maps embed, or external Google Fonts.

The Barrierefreiheitsstärkungsgesetz (from 28.06.2025) binds businesses offering products or services to consumers, aimed at concluding a Verbrauchervertrag electronically. A private, non-commercial portfolio is not covered.

⚠️ You will meet agency blogs claiming "as soon as there’s a contact form, the law applies". That is fear-selling. The statutory hook is the consumer contract, not the form element.

But: for an architecture portfolio the entire product is images, so accessibility is load-bearing regardless.

Already found and fixed - her palette genuinely fails. Measured against WCAG AA (4.5:1 for normal text):

Brand orange #D04D12 passes only as large display text. So: brand orange stays for big type, and --orange-text: #B2420F carries small type - same hue (18.6°) and saturation (84%), lightness 44%→38%. Measured 5.00 / 5.67 / 4.73. Revert by pointing both tokens at --orange.

Still outstanding:

The law changed and almost every template online is stale. The TMG was repealed 14.05.2024; the duty now lives in § 5 DDG. Content is unchanged in substance.

Three tiers: § 18 Abs. 1 MStV exempts purely personal/family sites; requires name + ladungsfähige Anschrift for non-commercial public sites; § 5 DDG requires the full set if geschäftsmäßig.

Why this is uncertain: the private exemption is real but read very narrowly - the Medienanstalten guides describe it as essentially "Vernetzung mit Freunden bzw. der Familie", and it evaporates once content addresses a "breite Öffentlichkeit". The commentary explicitly calls this line hard to draw for personal brands and freelancers - i.e. exactly this case.

Assessment (assessment, not settled law): a portfolio published to attract employers is self-promotional and career-oriented, not "personal or family". "Geschäftsmäßig" does not require profit. So the exemption probably fails. Include an Impressum.

⚠️ Raise with her, don’t decide silently: § 5 DDG wants a ladungsfähige Anschrift - a real address where a summons can be served; a P.O. box does not qualify. For a young woman publishing under her own name, her home address on the open web is a genuine safety question. Options: a c/o address, or accepting the residual risk of omitting it. Her decision.

Do not fill in the "Berufsbezeichnung / Kammer" fields those templates all carry - see §0. That’s a trap here.

Both turn on her circumstances rather than on statute text, and a free enquiry to her Architektenkammer would settle both at once:

Much German-language material on this is law-firm and agency marketing, which has a structural incentive to overstate risk - the "a contact form triggers BFSG" claim is a clear example. The above leans on the statutes, the Medienanstalten guides, the BfDI, a Bundestag Wissenschaftliche Dienste briefing (WD 10 - 3000 - 038/22), and the chambers themselves.