Does the BFSG apply to my online shop?

The three-part test in § 2 no. 26 BFSG

§ 1 (3) BFSG lists five categories of service exhaustively. Shops fall under number 5: services in electronic commerce. What that covers is defined in § 2 no. 26 BFSG — through three features that must all be present.

“Services in electronic commerce” means digital services within the meaning of § 1 (4) no. 1 of the Digital Services Act that are offered via websites and via mobile device applications and are provided electronically and at the individual request of a consumer with a view to concluding a consumer contract.

1. 01

   Offered via a website or app

   True of every shop reachable in a browser or as an app. Whether you built it yourself, rent a hosted platform or have an agency run it makes no difference to the classification.

2. 02

   At the individual request of a consumer

   The customer triggers the process: adding to the basket, configuring a product, starting the order. That feature is precisely what a purely presentational site lacks, where products are only shown but cannot be ordered.

3. 03

   With a view to concluding a consumer contract

   The sales contract is the whole point. That makes the ordering flow the clearest case there is — clearer than contact or enquiry forms, where this very feature can be disputed.

A shop satisfies all three features. That is why, unlike for many other websites, the coverage question in e-commerce is not a grey area but the standard case. It only gets interesting at the two exemptions below.

What you sell is irrelevant

This is where many shop operators let themselves off the hook too early: § 1 (2) BFSG contains an exhaustive list of products — computer hardware, self-service and payment terminals, consumer terminal equipment for telecommunications and audiovisual media services, e-book readers. Anyone selling coffee, clothing or candles does not find themselves on that list and concludes they are not covered.

The Bundesfachstelle Barrierefreiheit (the federal accessibility agency) states expressly in its FAQ on electronic commerce that a service in electronic commerce also exists where the shop offers products that are not themselves covered by the BFSG. Unlike much else in those FAQ, this statement is phrased in the indicative, which makes it one of the most robust official positions on the subject. What is regulated is the sales transaction, not the goods.

The micro-enterprise exemption — in its statutory wording

§ 3 (3) sentence 1 BFSG exempts micro-enterprises that offer or provide services. Under § 2 no. 17 BFSG, a micro-enterprise („Kleinstunternehmen“) is one that employs fewer than ten people and either has an annual turnover of no more than 2 million euros or a balance sheet total of no more than 2 million euros.

The structure matters: fewer than ten employees, and then an alternative. Nine employees, 3 million euros turnover, but 1.5 million euros balance sheet total — micro-enterprise. Nine employees, 3 million euros turnover and 3 million euros balance sheet total — not a micro-enterprise. The balance sheet alternative is regularly dropped in guides; it is in the statute and can be decisive in an individual case.

Two limits on this. First, the exemption applies to services only: anyone who also manufactures, imports or distributes products under § 1 (2) BFSG is fully covered in that respect — for a retailer adding e-book readers to the range, that is not an academic question. Second, the exemption attaches to the state of the business, not the state of the shop: if the business grows past the threshold, the exemption falls away without anything about the shop having changed.

§ 19 BFSGV: the extra requirement that only retail faces

For all covered services, § 12 no. 3 BFSGV requires that websites and apps be made „perceivable, operable, understandable and robust in a consistent and adequate manner“. For electronic commerce, § 19 BFSGV adds a layer: identification, authentication, security and payment functions must meet the same four requirements. This provision is almost never cited in guides, even though it covers exactly the places where a shop makes its money.

• Identification

  Registration, login, customer account, guest checkout with an email prompt. In practice: every field permanently labelled rather than by placeholder alone, errors in plain text and tied to the field, every step reachable from the keyboard.

• Authentication

  Passwords, one-time codes by SMS or app, two-factor prompts. The critical points are tight time limits, codes that cannot be pasted, and image puzzles with no alternative — anyone who cannot see, or cannot type fast, stops here.

• Security functions

  Bot checks, session expiry, warnings before a binding submission. A check that only works visually does not work for everyone. Warnings need text, not just colour.

• Payment functions

  Choosing the payment method, card entry, 3-D Secure redirects, wallet buttons. Much of this is delivered by the payment provider as an embedded form — you do not control the implementation there, but you do control which provider you pick. Put it on the list of questions for them.

None of these requirements is tied to a particular standard. § 3 BFSGV requires the state of the art to be observed; according to the Bundesfachstelle, the authoritative orientation is EN 301 549 with WCAG 2.1 at conformance levels A and AA. A formal presumption of conformity under § 4 BFSG only arises once the harmonised standards have been published in the Official Journal of the European Union — which has not yet happened. WCAG 2.1 AA is therefore the practical yardstick for assessment, not a statutory presumption.

Not just the checkout — the whole shop

“Let’s do the ordering process first” is a common plan. The best counter-argument is not in a guidance note but in the statute: Anlage 1 no. 2 BFSG (Annex 1) tells the market surveillance authority which sample to assess. That sample includes at least:

• home page, login, sitemap, contact, help pages and help functions, and pages carrying legal information
• at least one relevant page per type of service
• the page carrying the accessibility information under § 14 (1) no. 2 BFSG — which is therefore itself assessed for accessibility
• pages with a markedly different appearance
• at least one relevant downloadable document per type of service
• further randomly selected pages and documents amounting to at least 10 per cent

Translated to a shop: home page, category and product pages, search, basket, checkout, customer account, contact, terms and conditions, right of withdrawal, privacy notice — and, through the 10 per cent random selection, potentially every other page too. Downloadable documents count as well, such as size charts, spec sheets or assembly instructions in PDF. Fixing only the ordering process does not pass this sample.

The Bundesfachstelle infers from § 12 no. 3 BFSGV and Anlage 1 no. 2 BFSG that the entire website or app has to meet the requirements; it expressly frames that as an inference, not a finding. The statutory assessment scope points the same way.

• Product filters with no feedback

  Ticking “size M” swaps out the results list without announcing it. A screen reader user is still in the filter and never learns that anything below has changed. What is needed is a status message with the new result count.

• Variants as clickable tiles

  Colour and size pickers are often built as plain boxes with a click handler: not reachable by tab, no discernible state, no name. Implemented as a radio group, all three problems disappear at once.

• Prices in light grey

  Struck-through reference prices, unit price statements and discount badges are the classic contrast failures — especially where light grey on white or yellow on white is used. It hits precisely the information that drives the purchase.

• Checkout errors shown only in red

  A field with a red outline and no error text is not an error message. You need the text, the programmatic association with the field, and focus that moves there — otherwise the customer is hunting blind.

• Silent basket updates

  Increase the quantity, remove a line, redeem a voucher: the total changes and the page says nothing. The same status message that rescues the filter fixes this too.

• Alt text taken from the file name

  “IMG_4821.jpg” as alternative text is worse than none at all. Product images need a description of what you are buying; purely decorative images should carry an empty alt attribute so they are skipped.

• Layers that lose focus

  Cookie banner, newsletter pop-up, basket overlay: if keyboard focus carries on behind them or the Escape key does nothing, the shop is locked for keyboard users — before they ever reach a product.

Contrast cannot be judged reliably by eye; that is what our contrast checker is for. Everything else on this list surfaces fastest if you complete a full order using the keyboard alone.

The second duty shops overlook

§ 14 (1) BFSG permits a service to be offered only on two conditions: the service meets the accessibility requirements (number 1), and the provider has produced the information required by Anlage 3 no. 1 BFSG (Annex 3) and made it publicly available in an accessible form (number 2). Number 2 is regularly forgotten — and it carries the same penalty range as number 1.

Four elements are required: a general description of the service in an accessible format, descriptions and explanations needed to understand how it operates, a description of how the requirements are met, and identification of the competent market surveillance authority. As the location, the statute names the terms and conditions „or another clearly perceivable manner“; the Bundesfachstelle recommends an “Accessibility” link in the header or footer. Unlike public bodies, you do not have to state and justify non-conformity — the Bundesfachstelle reasons that full accessibility is owed in any case. So this is not a relief.

What happens if nothing happens

§ 37 BFSG requires intent or negligence; ordinary negligence is enough, gross negligence is not required. Up to 100,000 euros is provided for by § 37 (1) no. 8 in conjunction with subsection 2 where a service is offered or provided without meeting § 14 (1) BFSG. Number 8 refers to the whole of subsection 1, not only to its number 1 — so an inaccessible shop and missing Anlage 3 information fall within the same range. That is a reading of the wording; the question has not been settled by any court.

Up to 10,000 euros applies to duties owed to the authority: failure to report a recognised non-conformity under § 14 (4) sentence 2 BFSG, and information that is not provided, or not provided correctly, completely or in time, under § 14 (5) sentence 1 BFSG.

The competent authority is the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF) in Magdeburg, responsible nationwide with no split by federal state. According to reports, its board adopted the market surveillance strategies in January 2026, and the authority has been carrying out checks since. There are no publicly documented BFSG penalty notices to date — anyone arguing with case numbers is not getting them from an official source. The sequence also differs from the way the threat is usually presented: first the demand to establish conformity, then sanctions up to prohibiting the offering.

More relevant to a shop than the authority’s own sampling is § 32 (1) BFSG: on a consumer’s application, the market surveillance authority must open proceedings where the consumer asserts that, because of a breach, they cannot use the service or can use it only in a limited way. “Must open” is a bound decision, not a discretionary one. Any customer who fails at your checkout can trigger it; recognised associations and qualified entities can even apply in their own right under § 32 (2) BFSG, without being affected themselves.

1. 01

   Record whether you are covered

   Three-part test, the micro-enterprise threshold under § 2 no. 17 BFSG, and the B2B separation where relevant. Write the result down with a date. A reasoned no is also a result you will need later.

2. 02

   Measure the core journey

   Home page, category page, product detail page, basket, checkout, customer account. An automated scan reliably finds the common failures there: missing alternative text, insufficient contrast, unlabelled fields, broken heading structure.

3. 03

   Place one order by keyboard

   The test no tool replaces: a complete order without a mouse, from the filter to the order confirmation. Wherever you get stuck, others get stuck permanently.

4. 04

   Sort out payment and login

   § 19 BFSGV covers exactly these functions. Ask your payment provider and your login or two-factor vendor where they stand — in writing, so it goes into your documentation.

5. 05

   Publish the Anlage 3 information

   The four elements, linked in a clearly perceivable place, accessible themselves, naming the competent market surveillance authority. That page is a mandatory part of the authority’s sample.

6. 06

   Re-measure after every release

   § 14 (3) BFSG is a continuing duty. A new theme, a plugin update or a campaign page can break accessibility again — measuring regularly beats tidying up once.

Questions shop operators ask

Primary sources

• § 1 BFSG — Anwendungsbereich
• § 2 BFSG — Begriffsbestimmungen
• § 3 BFSG — Allgemeine Anforderungen
• § 4 BFSG — Konformitätsvermutung
• § 14 BFSG — Pflichten der Dienstleistungserbringer
• § 32 BFSG — Antrag auf Einleitung eines Verfahrens
• § 37 BFSG — Bußgeldvorschriften
• Anlage 1 BFSG — Überwachung von Dienstleistungen
• Anlage 3 BFSG — Informationen zur Barrierefreiheit
• § 12 BFSGV — Anforderungen an Dienstleistungen
• § 19 BFSGV — Elektronischer Geschäftsverkehr

This page reproduces the statutory wording and publicly available statements of the Bundesfachstelle Barrierefreiheit, as reviewed in August 2026. Where a question is unsettled, we say so. It is not legal advice — for an assessment of your specific shop, talk to a qualified lawyer.