← Back to Directory
Logo: web.de

web.de

German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail.

freemailgermanyemailcloud-storagegdprconsumersaas
Visit WebsiteAsk an EU migration specialistFeedback & corrections

web.de is a German consumer internet portal and freemail brand operated by 1&1 Mail & Media GmbH, part of United Internet AG. The email product is FreeMail and its paid upgrades: a browser- and app-based mailbox with address book, calendar, and Online-Speicher cloud storage.

It exists as mass-market German mail under the E-Mail made in Germany TLS alliance, not as default end-to-end encrypted privacy mail. FreeMail is financed by advertising under a Consent or Pay model.

The concrete differentiator is that DE-sited mail and cloud at consumer scale, with optional PGP, on the same identity as a large German-language portal.

DE-operated freemailE-Mail made in GermanyGermany data centers (claimed)Optional PGPFreeMail + paid upgradesSaaS only

Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.

Key capabilities

Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.

Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.

Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.

Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.

News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.

At a glance

HQ / operator
1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany
Parent group
United Internet AG (Germany)
Product type
Consumer freemail + portal + cloud (SaaS)
Hosting (vendor claim)
Company-owned data centers in Germany
Open source
No
Self-host
No
Commercial model
Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay

Best fit when

  • German consumers who want a familiar .de freemail address with portal news and everyday cloud storage
  • Secondary personal or family mail where DE operator and DE storage matter more than default E2EE
  • Users who value intelligent inbox sorting, package tracking, and mobile/desktop access over privacy-maximalist design
  • Teams comparing Gmail/Outlook.com alternatives on jurisdiction while accepting consumer freemail trade-offs
  • Buyers already in the United Internet ecosystem (WEB.DE / GMX) who need a consistent DACH brand

Poor fit when

  • Organizations needing primary business mail with admin console, SSO, and signed B2B DPA as standard
  • Hard requirements for default end-to-end encryption or zero advertising/tracking surface
  • Self-hosted or open-source mail stacks you operate yourself
  • Long-term cold archives on FreeMail (inactivity deletion policy)
  • Procurement policies that forbid ad-tech partners or third-country transfer language without contract exhibits

Consider instead when

  • When: You need default E2EE and a privacy-first paid mailbox

    Consider: Tuta or Proton Mail

    web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.

  • When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only

    Consider: Posteo or mailbox.org

    Less portal monetization; clearer privacy-first product framing than mass freemail.

  • When: You prefer the same United Internet Mail & Media stack under another brand

    Consider: GMX Mail

    Nearly aligned trust and capability story; brand and portal mix differ.

  • When: You need Google/Microsoft-class workspace collab and enterprise compliance packs

    Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365

    Trade DE freemail residency story for US-group platforms and deeper admin tooling.

Jurisdiction & ownership

Legal entity
1&1 Mail & Media GmbH (United Internet AG group)
Governing law
Germany / EU GDPR
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found.

No known US corporate parent. CLOUD Act residual risk for primary mailbox hosting is low relative to US freemail, but ad-tech partners and third-country transfer language prevent a blanket 'no non-EU parties' claim. Indicative only — not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumAd-financed FreeMail and consent surface

    FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned.

  • MediumNo default end-to-end encryption

    TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis.

  • MediumLimited public audit/cert artifacts

    ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy.

  • LowThird-country transfers and portal partners

    Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use.

  • LowFreeMail inactivity content deletion

    Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export.

Open questions for due diligence

  • Will 1&1 Mail & Media sign a B2B DPA and provide a current subprocessor list for mailbox and cloud processing?
  • Are there ISO 27001, C5, or independent penetration-test summaries available under NDA for Mail & Media freemail infrastructure?
  • For your use case, is FreeMail with ads acceptable, or must you force paid TrackFree/premium paths and refuse intelligent-inbox/ad consents?
  • Confirm whether any non-DE backup, support, or analytics processors touch mailbox content beyond the public privacy notice.
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Usually only after a careful legal review, and often no for regulated primary mail. web.de FreeMail is a consumer freemail/portal product from 1&1 Mail & Media GmbH: ad-financed free tier, Consent or Pay, optional PGP rather than default E2EE, and no self-host or enterprise admin console comparable to Google Workspace or Microsoft 365. Prefer dedicated EU business mail (e.g. mailbox.org, Posteo for paid private mail, Tuta/Proton for stronger default crypto) when you need org controls, clear B2B DPAs, and minimal advertising data paths.

The controller is 1&1 Mail & Media GmbH (Germany; United Internet group). Product and group pages state that WEB.DE/GMX emails and cloud data are stored exclusively in Germany in company-operated data centers under E-Mail/Cloud made in Germany. Confirm current residency and any subprocessors against the live privacy notice and any contract exhibits before procurement—not from secondary blogs.

FreeMail is monetized with ads. The privacy notice describes a Consent or Pay choice: consent to personalized advertising/tracking, or use a paid path that reduces third-party ads and tracking. With consent, intelligent-inbox and ad features may analyze commercial mail content for interest profiles; FreeMail users also receive WEB.DE informiert as a fixed component. Paid tiers can change newsletter opt-out options. Review the consent layer partner list if ad-tech processors are out of policy.

No. Transport security uses TLS (including alliance paths under E-Mail made in Germany). Optional PGP provides content E2EE when both sides support it. Without PGP, web.de (like most freemail) can process message content for spam filtering, intelligent inbox, and—where consented—advertising-related analysis. Choose Tuta or Proton Mail if default E2EE is a hard requirement.

Per the privacy notice, FreeMail mailbox content may be deleted after more than 180 days without login (web, app, or IMAP/POP), without prior notice. Do not rely on FreeMail as a cold archive. Export important mail and keep activity or move long-term archives elsewhere.