On 7 October 2026 Germany's federal cabinet adopted Justice Minister Stefanie Hubig's Gesetz gegen digitale Gewalt, about six months after she presented the first draft in April, according to netzpolitik.org. The bill is a serious attempt to fix a real problem. Parts of it are well designed. One structural choice, the link to data retention, is not.
The strongest case for the bill
Victims of sexualised deepfakes, doxing and coordinated harassment currently face a practical wall. Even where content is plainly unlawful, they often cannot identify the person behind an account, and without a name they cannot sue. A system where a court can compel a platform to act, rather than leaving the victim to plead with a trust-and-safety queue, is arguably more rule-of-law than informal moderation. It puts a judge in the loop.
The bill is built on that logic. According to the federal government's summary, victims could obtain a court order requiring platforms and internet access providers to disclose data such as name, date of birth, address and email where needed to pursue damages. A court could also order an account blocked for an appropriate period if the user seriously violates others' rights and further violations are expected. The government's own description says the bar for that is high.
What changed between April and October
The cabinet version is broader than the April draft, per netzpolitik.org's reporting:
- Takedown claim decoupled. Victims get a court-orderable claim to have individual unlawful content removed, even when the account holder is unknown. In the earlier draft, removal was tied to blocking a high-reach account.
- Messengers included. The rules now explicitly cover messengers such as WhatsApp, Telegram and Signal where they enable group chats. The original draft covered only social media platforms.
- Identity disclosure. On a court order, platforms and access providers must disclose the real name and address behind an anonymous or pseudonymous account, where available. Victims apply to the Landgericht and must make the violation plausible.
- New offences. Operating a fake account in someone else's name becomes criminal if it is suited to significantly damaging that person's reputation. Possessing or knowingly retrieving rape videos carries up to three years' imprisonment or a fine. Sexualised deepfakes are covered.
The judicial-order design is the right instinct. Procedurally, it is much closer to proportionate regulation than the deadline-driven, fine-backed removal duties that earlier German platform law relied on. Content stays up until a court weighs in, and the victim must show plausibility first.
Where the bill overreaches
First, messengers. Extending removal and disclosure claims to group chats is defensible for large, public-facing groups. But the term covers everything from a 400,000-member Telegram channel to a family chat. Hubig herself rejected indiscriminate chat scanning in the EU debate, as beck-aktuell reported in October 2025. A court-ordered takedown claim is not scanning, but it creates pressure on end-to-end encrypted services to know what is in their groups. Parliament should state expressly that no provider may be required to weaken encryption or monitor content to comply.
Second, anonymity. Hubig has rejected a real-name requirement online, and the court-supervised unmasking model is better than that. But disclosure must stay tied to a plausible, specific violation. The Federal Bar Association, per ZDF, has warned of risks to freedom of expression and argued the threshold for account blocks is too low. Account blocks against a speaker, as opposed to takedown of specific content, are the provision most likely to chill lawful speech if courts apply them loosely.
Third, and most important, IP retention. Alongside the bill, the government plans to store IP addresses for about three months. The justification for the disclosure claim says providers could use IP addresses stored in advance, netzpolitik.org reports. That practice has been suspended in Germany since 2017. Hubig argues the narrow form, covering IP addresses and port numbers only, is lawful. Large network operators and associations disagree.
The government has a real legal argument. In C-470/21 (30 April 2024), the Court of Justice held that EU law does not preclude national rules giving an authority access to civil-identity data tied to IP addresses to identify suspects of copyright infringement. That was conditional on a genuinely watertight separation of data categories, retention no longer than strictly necessary, and a bar on using the addresses for any other purpose. The ruling shows narrow IP retention is not automatically unlawful. It does not give blanket cover for a design where retained data becomes the default plumbing for civil claims.
Civil society is making the same point from different angles. The GFF welcomes the fast-removal approach but wants the disclosure claim cleanly separated from data retention. eco calls three months of suspicionless retention disproportionately long. The Deutscher Juristinnenbund welcomes the messenger coverage and removal claim but says the law will change little about the structural problem and lacks a power to delete entire chat groups planning sexual violence. Meanwhile the SPD's Carmen Wegge says the parliamentary process will sharpen the bill so all cases of image-based sexualised violence are covered.
What parliament should do
The pro-innovation, pro-speech reading is not that Germany should do nothing. It is that the bill's good parts can stand on their own:
- Decouple. Keep the disclosure and takedown claims, and move IP retention into its own debate with its own proportionality review. Bundling them lets a popular victim-protection law carry a contested surveillance measure through.
- Protect encryption. Write in that messenger coverage creates no duty to monitor or weaken private communications.
- Fund victims, not just courts. Court-ordered relief only helps if procedures are affordable. HateAid has noted the cost exemption is rarely used and wants flat court-fee rules.
- Tighten the account-block test. Require a high-reach, repeat-violation showing, as the government's own summary describes.
The cabinet has taken the harder, more defensible route of putting judges between victims and platforms. Parliament should resist the temptation, in the SPD's phrase, to "sharpen" it into something broader before it has resolved the retention question.