GMX Mail vs web.de

Compare GMX Mail and web.de on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Outlook.com

GMX Mail

Germany· Email Services

Needs review

Shortlist GMX Mail for consumer or light-professional freemail when you want a German United Internet operator, claimed German mailbox data centers, large free storage, and standard IMAP/POP—with optional OpenPGP. Skip when you need zero-access encryption by default, enterprise DPA/audit packs, or an ad-free architecture as the baseline; consider Proton Mail instead.

German operatorMailbox in DE (claimed)IMAP / POP3 / SMTPOptional OpenPGPFree ad-supportedSaaS only

View listing Visit Website

web.de

Germany· Email Services

Needs review

Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.

DE-operated freemailE-Mail made in GermanyGermany data centers (claimed)Optional PGPFreeMail + paid upgradesSaaS only

View listing Visit Website

Highlighted rows differ between the two products.

GMX Mail vs web.de: Snapshot
Feature	GMX Mail	web.de
Country of origin	Germany	Germany
Category	Email Services	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	1&1 Mail & Media GmbH (Zweigniederlassung Karlsruhe; Hauptsitz Montabaur)	1&1 Mail & Media GmbH (United Internet AG group)
Governing law	German law (international T&Cs); GDPR applies as EU controller	Germany / EU GDPR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Vendor privacy (EN): FreeMail emails, address book, and calendar processed in secure data centers in Germany. Product security pages: European data centers for stored mail. Group United Internet AG (DE). Named non-mail paths: Google Analytics/GTM on portal; Google/Yahoo search partnership; international ad partners under consent; DE privacy allows third-country transfers with Chapter V safeguards when used. No public exhaustive mail-infra subprocessor list found.	Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found.
Summary	German FreeMail from 1&1 Mail & Media GmbH (United Internet): large free storage, IMAP/POP/SMTP, optional OpenPGP and 2FA, ad-supported consumer webmail.	German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail.
Tags	freemail germany consumer webmail imap openpgp united-internet ad-supported	freemail germany consumer email cloud-storage gdpr saas

At a glance: GMX Mail vs web.de
At a glance	GMX Mail	web.de
HQ / entity	1&1 Mail & Media GmbH, Montabaur (DE)	Not listed
Parent group	United Internet AG (DE)	United Internet AG (Germany)
Product type	Consumer FreeMail + optional paid tiers	Consumer freemail + portal + cloud (SaaS)
Hosting (claimed)	Mailbox/calendar data in German data centers	Not listed
Protocols	Webmail; POP3/IMAP/SMTP (opt-in)	Not listed
Open source	No	No
Self-hosted	No	Not listed
HQ / operator	Not listed	1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany
Hosting (vendor claim)	Not listed	Company-owned data centers in Germany
Self-host	Not listed	No
Commercial model	Not listed	Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay

Key capabilities: GMX Mail vs web.de
Key capabilities	GMX Mail	web.de
German operator	Yes	Not listed
Mailbox in DE (claimed)	Yes	Not listed
IMAP / POP3 / SMTP	Yes	Not listed
Optional OpenPGP	Yes	Not listed
Free ad-supported	Yes	Not listed
SaaS only	Yes	Yes
DE-operated freemail	Not listed	Yes
E-Mail made in Germany	Not listed	Yes
Germany data centers (claimed)	Not listed	Yes
Optional PGP	Not listed	Yes
FreeMail + paid upgrades	Not listed	Yes

GMX Mail

Large free mailbox storage with open protocols
gmx.com free accounts advertise up to 65 GB email storage and 50 MB attachments. POP3, IMAP, and SMTP are supported after you enable them in settings (TLS 1.2+; imap.gmx.com / mail.gmx.com). Suits users who want client choice (Thunderbird, Outlook, mobile) without Google or Microsoft as the mailbox host.
Optional OpenPGP end-to-end encryption (Mailvelope)
GMX offers free OpenPGP messaging via the Mailvelope browser extension: key generation, local key storage, key directory, and mobile recovery. Encryption is opt-in per message after setup—not whole-mailbox zero-access by default. Best for occasional sensitive threads when both parties can use OpenPGP.
Aliases, Mail Collector, and multi-account inbox
Create up to 10 alias addresses (including other GMX domains) managed in one inbox, and pull up to 10 external accounts via Mail Collector. Useful for freelancers and project mail without juggling multiple passwords or providers day-to-day.
Spam filtering, antivirus, and optional TOTP 2FA
Free accounts include automated spam filtering (user blacklist and optional improved detection) and antivirus scanning of mail and cloud files. Optional two-factor authentication uses an authenticator app (TOTP); third-party clients use app-specific passwords when 2FA is on.
Bundled Cloud, calendar, contacts, and Online Office
Accounts include contacts, calendar/organizer, about 2 GB GMX Cloud with share links, and Online Office for common document formats—enough for light personal productivity without a separate suite subscription.

web.de

E-Mail made in Germany alliance transport
Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.
FreeMail + paid upgrades with intelligent inbox
Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.
Optional PGP and free 2FA
Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.
Cloud made in Germany Online-Speicher
Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.
German consumer portal on the same identity
News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.

Assurance & compliance: GMX Mail vs web.de
Assurance & compliance	GMX Mail	web.de
Independent security / no-logs audit	Not found OpenPGP/Mailvelope path described as externally reviewed; no public independent no-logs audit for FreeMail mailbox access found on product pages.	Not found No public independent no-logs or full security audit package found for FreeMail; alliance pages claim oversight by data-protection function and independent Prüfstellen at a high level only.
ISO 27001	Not found No GMX FreeMail-branded ISO 27001 certificate located on security/privacy pages in this research pass (group companies may hold certs under other brands).	Not found No public ISO 27001 certificate page located for the web.de freemail product during research.
SOC 2 / SOC 3	Not found No SOC 2/3 report found on GMX public security pages.	Not found No public SOC 2/3 report found for web.de FreeMail.
GDPR / EU data protection	Vendor claimed EU/German controller; public privacy notices under GDPR; DPO published; supervisory authorities named (BfDI / LfDI RLP).	Vendor claimed German controller (1&1 Mail & Media GmbH); detailed GDPR privacy notice; DE storage claims for mail/cloud. Not a legal certification.
US CLOUD Act exposure (indicative)	Partial German entity and parent (United Internet AG); mailbox data claimed in German DCs. Partial/medium because portal analytics include Google LLC tools, freemail ads involve international partners, and no full public mail-infra subprocessor list. Not legal advice.	Partial EU/German entity and parent; no known US parent; mail/cloud claimed on company-owned DE data centers. Partial because privacy notice allows third-country transfers with safeguards, FreeMail uses ad/TCF partners, and no exhaustive public subprocessor inventory. Not legal advice.
Data processing agreement (B2B)	Not found Product is primarily consumer FreeMail under GTCs/privacy policy; no public self-serve B2B DPA flow found for FreeMail shortlisting.	Not found Consumer freemail focus; no clear self-serve public B2B DPA for FreeMail found. Request under contract if treating as processor for an organization.
EU AI Act	Not applicable Not an AI-centric product; optional assistive features may appear in product privacy text but FreeMail is not marketed as an AI system.	Not applicable Consumer mail/portal with limited in-product assistants; not an AI-centric product for this checklist.

Considerations & known limitations: GMX Mail vs web.de
Considerations & known limitations	GMX Mail	web.de
Advertising-funded free tier	Medium FreeMail depends on ads and (with consent) interest-based targeting and partner sharing. Privacy posture differs from paid privacy mail. Practical impact: expect consent UX, ad surfaces, and partner lists—not a zero-ads default.	Not listed
E2E encryption is optional, not default	Medium Without OpenPGP setup, mailbox content is accessible to the provider like conventional hosted mail. Practical impact: do not treat GMX FreeMail as zero-access encryption architecture.	Not listed
Incomplete public infrastructure subprocessors	Medium Residency for mail is claimed (Germany/EU), but there is no enterprise-style published subprocessor inventory for core mail infrastructure. Portal paths name Google Analytics and global ad partners. Practical impact: extra questionnaire work for high-assurance buyers.	Not listed
Inactivity and freemail operational policies	Low Terms/privacy allow deletion of free mailbox content after prolonged inactivity (about 180 days without login on FreeMail privacy text). Practical impact: inactive project addresses can disappear if not maintained.	Low Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export.
No public ISO/SOC package for FreeMail	Low Security pages emphasize product features (spam, AV, 2FA, PGP) rather than downloadable ISO/SOC evidence for FreeMail. Practical impact: may fail enterprise vendor security questionnaires without further vendor dialogue.	Not listed
Ad-financed FreeMail and consent surface	Not listed	Medium FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned.
No default end-to-end encryption	Not listed	Medium TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis.
Limited public audit/cert artifacts	Not listed	Medium ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy.
Third-country transfers and portal partners	Not listed	Low Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use.

Fit

GMX Mail

Best fit when

Individuals and freelancers who want a European freemail address with large free storage and IMAP client freedom
Users consolidating multiple addresses via aliases (up to 10) and Mail Collector
Buyers who prefer a German legal controller (1&1 Mail & Media GmbH / United Internet) over US Big Tech freemail
Teams that only need optional OpenPGP for specific sensitive threads, not zero-access by default
Users already familiar with GMX/WEB.DE in German-speaking markets who need international domains (e.g. gmx.com)

Poor fit when

Organizations that require default end-to-end / zero-access encryption for all mail
Procurement that needs a published independent security audit pack, ISO/SOC evidence, and a B2B DPA as standard shortlist inputs
Teams that cannot accept advertising-funded freemail economics or interest-based ad consent UX
Custom-domain corporate mail and admin controls at Microsoft 365 / Google Workspace depth
Self-hosted or open-source mail stack requirements

Consider instead when

When: You need zero-access encryption by default and a privacy-first paid model without ad-funded freemail as the core product
Consider: Proton Mail
Proton is the stronger shortlist peer in this catalog for E2E-first evaluation.
When: You need Google Workspace-class collaboration and are willing to accept US Big Tech jurisdiction
Consider: Gmail / Google Workspace
Richer suite integration; different sovereignty and ad/ecosystem tradeoffs.
When: You need Microsoft ecosystem mail, calendar, and compliance tooling
Consider: Outlook.com / Microsoft 365
Strong enterprise admin story; US parent and CLOUD Act path differ from GMX.

web.de

Best fit when

German consumers who want a familiar .de freemail address with portal news and everyday cloud storage
Secondary personal or family mail where DE operator and DE storage matter more than default E2EE
Users who value intelligent inbox sorting, package tracking, and mobile/desktop access over privacy-maximalist design
Teams comparing Gmail/Outlook.com alternatives on jurisdiction while accepting consumer freemail trade-offs
Buyers already in the United Internet ecosystem (WEB.DE / GMX) who need a consistent DACH brand

Poor fit when

Organizations needing primary business mail with admin console, SSO, and signed B2B DPA as standard
Hard requirements for default end-to-end encryption or zero advertising/tracking surface
Self-hosted or open-source mail stacks you operate yourself
Long-term cold archives on FreeMail (inactivity deletion policy)
Procurement policies that forbid ad-tech partners or third-country transfer language without contract exhibits

Consider instead when

When: You need default E2EE and a privacy-first paid mailbox
Consider: Tuta or Proton Mail
web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.
When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only
Consider: Posteo or mailbox.org
Less portal monetization; clearer privacy-first product framing than mass freemail.
When: You prefer the same United Internet Mail & Media stack under another brand
Consider: GMX Mail
Nearly aligned trust and capability story; brand and portal mix differ.
When: You need Google/Microsoft-class workspace collab and enterprise compliance packs
Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365
Trade DE freemail residency story for US-group platforms and deeper admin tooling.

Open questions for due diligence

GMX Mail

Will 1&1 Mail & Media sign a B2B DPA and publish a current mail-infrastructure subprocessor list for our use case?
Are FreeMail mailbox systems solely on United Internet / 1&1 operated German DCs, or are any US-group cloud providers used for primary storage, backup, or DR?
What independent audits or certifications (if any) cover the FreeMail platform beyond the Mailvelope/OpenPGP path?
For paid/premium mailboxes: which advertising and tracking paths remain, and what contractual residency language is available?

web.de

Will 1&1 Mail & Media sign a B2B DPA and provide a current subprocessor list for mailbox and cloud processing?
Are there ISO 27001, C5, or independent penetration-test summaries available under NDA for Mail & Media freemail infrastructure?
For your use case, is FreeMail with ads acceptable, or must you force paid TrackFree/premium paths and refuse intelligent-inbox/ad consents?
Confirm whether any non-DE backup, support, or analytics processors touch mailbox content beyond the public privacy notice.