JMich: So if it is a service targeted at adults, does the rating matter? One could say that they are not properly checking their users' age, but not sure if the rating would matter.
Hm, time to go poke Simon it seems.
That doesn't satisfy German law, which requires websites to enforce effective age check measures for games rated 18 (unrated games are a bit of a sticky point, as most indie games are unrated). There's also a prohibition on the open, unrestricted sale of blacklisted titles, some of which are here (Blood, Cannon Fodder and a few others).
Of course, in the case of GOG, it can be argued that the site isn't even targeted at German users, as its transactions are largely denominated in dollars and the site is in English, so it's unlikely that the government will take aim.
For what it's worth, Steam also does a pretty sloppy job of enforcing German law. On the one hand, they seem to take a pretty heavy-handed approach regarding the sale of blacklisted games, but at the same time, they completely ignore the requirement of effective technical measures surrounding 18-rated games (although, as I understand it, the implementation of the family options does now satisfy the requirements, as useless as they are).
The only one that does it properly is Origin, which imposes a purchase time window for 18-rated games of 23:00 until 06:00, which essentially makes it unusable.
(Just out of curiosity, what happens if you set your DOB in GOG to be under 18?)