Received an Abmahnung? The first 5 steps
Whether it's a Google Fonts letter, a cookie-banner demand or some other Abmahnung (a formal German cease-and-desist letter) over a trivial matter: the basic way to respond calmly and correctly is almost always the same.
Step 1: Stay calm
Abmahnungen are deliberately worded to create a sense of urgency: short deadlines, threats of high follow-up costs, complicated legal language. That is part of the strategy, not necessarily a sign of how strong the claim really is in law. Sleeping on it for a night changes nothing about the legal position, but a great deal about your ability to make good decisions.
Step 2: Examine the letter closely
Who is the sender: a well-known law firm or a name you've never heard of? Does the letter describe a concrete, verifiable violation, or does the demand remain vague? Does a quick online search show the same pattern among many other recipients? All of these are important clues.
Step 3: Don't sign or pay anything in a hurry
Neither a quick payment nor a signed cease-and-desist declaration (Unterlassungserklärung) can easily be undone. A cease-and-desist declaration in particular can bind you to a contractual penalty for years, regardless of whether the original Abmahnung was justified.
Step 4: Check the underlying issue and fix it
Whatever the legal outcome, it is usually worth taking a look at your own website: is something genuinely not set up cleanly from a technical point of view (e.g. externally loaded fonts, faulty cookie consent)? Fixing that makes sense regardless of the specific demand.
Step 5: Get expert advice
Especially in actual court proceedings, with repeated letters or whenever you're unsure, a brief expert assessment is worthwhile, and often cheaper and quicker than you feared.
Special case: extortion emails and sextortion
A related but different threat comes from emails in which the senders claim to have access to your computer, your camera or your contacts, and threaten to publish supposedly compromising recordings unless you pay an amount in Bitcoin ("sextortion"). These messages are sent automatically to a huge number of addresses at once, often quoting an old password leaked somewhere to appear credible.
What you should do
- Don't pay. Paying merely confirms to the sender that the address is being read, and as a rule leads to further demands.
- Don't reply. Any response confirms that the address is active.
- Keep the email as evidence. Don't delete it straight away; if possible, save it with its full headers.
- Report it to the police (in Germany: extortion under Section 253 of the German Criminal Code, StGB). Even if individual prosecution of mass emails is unlikely, every report helps investigators spot patterns.
- If the password mentioned is still in use anywhere: change it immediately and enable two-factor authentication wherever possible.
Read more
Specific situations: Google Fonts Abmahnung · Cookie-banner Abmahnung. If you'd like to take structural precautions, you'll find more in our common-sense protection section.