A law with two different speeds
Germany's Federal Ministry of Justice published its Referentenentwurf for a Gesetz gegen digitale Gewalt (Law Against Digital Violence) on April 17, 2026, under Justice Minister Stefanie Hubig, and sent it out for stakeholder consultation (BMJV press release). Four months later, Netzpolitik.org's Chris Köver published an assessment on August 10, 2026 comparing the draft against the EU's binding minimum standard — and found the bill moving at two different speeds. On platform obligations, it goes further than Brussels requires. On two specific criminal offenses Brussels does require, it does nothing at all (Netzpolitik.org).
The backstop is Directive (EU) 2024/1385 on combating violence against women and domestic violence, which obliges every member state to criminalize "non-consensual sharing of intimate images, cyber stalking, cyber harassment and incitement to hatred and violence on the ground of gender" by June 14, 2027 (European Commission). As of the Netzpolitik.org report, Germany had roughly ten months left to close the gaps.
The case for the directive is genuinely strong
Before picking at Berlin's drafting, the EU's underlying rationale deserves to be stated plainly. Cyberstalking and coordinated harassment campaigns are not abstract harms — victims describe them as precursors to offline violence, and law enforcement across the bloc has struggled for a decade with prosecutors who can charge insult or defamation but not the sustained, technology-enabled pattern of intimidation itself. Gender-based incitement online — the pile-ons and "go back to the kitchen" mob campaigns aimed at women in public life — has a documented chilling effect on political participation. A harmonized EU floor prevents the worst offenders from simply operating from whichever member state has the weakest statute. That is a legitimate regulatory objective, not moral panic.
Where the German draft actually delivers
The bill is not toothless. Its criminal-law pillar adds three new offenses: a revised §184k criminalizing the creation — not merely the distribution — of sexualized deepfakes, up to two years' imprisonment; §201b, covering non-sexual deepfakes capable of causing serious reputational harm; and §202e, a dedicated cyberstalking offense for covert location and activity tracking via technology, also carrying up to two years (Netzpolitik.org). Criminalizing deepfake creation actually exceeds what the EU directive requires, which targets distribution. On its civil-law side, the draft adds four new tools for victims: a court-supervised identity-disclosure procedure to unmask anonymous harassers, evidence-preservation orders compelling platforms to retain data before it's deleted, court-ordered account suspension for serious repeat violations, and a mandatory domestic legal representative requirement for non-EU platforms serving German users.
Where it stops short
Here is the asymmetry Köver's reporting surfaces. The directive requires member states to criminalize cyberharassment as such — sustained, repeated online abuse falling short of stalking or a single defamatory post. Germany's government has told stakeholders that unsolicited explicit images and comparable harassment are "not its own criminal offense" and that existing obscenity and insult provisions already cover the ground. That is a defensible legal-technical argument, but it is also precisely the patchwork approach the directive was written to end. Second, and more starkly: the directive requires criminalizing public incitement to violence or hatred on grounds of sex. Germany's hate-speech statute, §130 of the Criminal Code (Volksverhetzung), lists protected grounds — national origin, religion, ethnicity — that do not include gender, and the current draft proposes no fix. Köver's reporting is blunt on this point: "nothing is provided for."
The proportionality question runs both directions
Our usual objection to speech-adjacent platform mandates is that they invite over-removal and expose intermediaries to liability for judgment calls that should sit with courts. On that front, this draft is actually reasonably well-calibrated: account suspension and evidence preservation both require a court order rather than a platform's own discretion, and the identity-disclosure procedure runs through a judge, not a takedown portal. That is closer to the DSA's model of judicial gatekeeping than to NetzDG's original private-enforcement design, and it deserves credit for that.
The risk here is not overreach — it is under-delivery risking a rushed second pass. A gender-based incitement offense, if drafted broadly and fast against a 2027 deadline, could sweep in political commentary and satire the way earlier hate-speech expansions have drawn criticism for chilling legitimate debate. The better sequence is the one Germany is not currently on: legislate the missing offenses now, with the same care given to defining the four platform duties, rather than bolt on a rushed criminal provision in early 2027 to beat the transposition clock. Ten months is not a long runway for statutory language this consequential.
The deadline for implementing this directive ends on June 14, 2027 — the federal government has approximately ten months remaining.
Germany has shown it can write careful, judicially-gated platform obligations. It should apply the same care to the two offenses it still hasn't drafted, rather than leaving them for a late scramble.