Which website legal requirements UK businesses face: a 60-second decision tree
There is no universal pack of legal pages that every UK business website must publish. The website legal requirements UK businesses face depend on the organisation operating the site, the data it processes, the transactions it supports and the markets it serves.
Most business sites need accurate identity and contact information. Privacy, cookie, ecommerce, review and accessibility duties are triggered by what the site actually does, not by somebody selling a standard bundle of templates.
The short answer: identify the business accurately, explain how personal data is used, control tracking properly and add transaction-specific information wherever customers can buy or book.
Use this decision tree:
- Are you a limited company? Company disclosures are required. Sole traders and other organisations need different identity information.
- Does the site have forms, accounts, analytics, recruitment tools or embedded services? Privacy information is required in these circumstances.
- Does it use cookies or similar browser storage? A cookie banner is required in some circumstances, but not automatically.
- Can consumers buy, subscribe or book online? Pre-contract, payment and cancellation information is required.
- Do you publish customer reviews? A process for preventing and removing misleading reviews is required.
- Is the service aimed at EU consumers? Additional accessibility rules may apply.
- Is it a brochure site? Clear contact details, accessible design and an accurate explanation of any data collection remain the sensible baseline.
What company and contact information must appear?
A UK limited-company website must display its registered company name. It must also show the registered number, registered-office address, place of registration and limited status.
That company information on the website should be easy to find on every visit. A global footer containing the details, or linking to a clearly labelled contact or legal page, is normally the most robust implementation.
Businesses providing online services must also make their name, geographic address and rapid electronic contact details easily and permanently accessible. Those details include an email address, so a contact form alone is not enough.
A sole trader should not copy limited-company wording or invent a company number. They should identify the person or business operating the service, give the applicable trading name and provide the direct contact information relevant to their operation.
VAT registration, regulated professions and consumer sales can trigger further disclosures. Treat these as required in those circumstances, rather than filling the footer with labels that do not apply to the business.
Do you need a privacy policy on a UK website?
Privacy information is required when a website collects or otherwise processes personal data. Calling the page a “privacy policy” is conventional; what matters is that its contents are accurate and users receive the information at the right time.
Common triggers include:
- contact, quote and recruitment forms;
- newsletter subscriptions;
- customer accounts and order histories;
- analytics and session-recording tools;
- embedded maps, videos, chat tools or booking systems;
- server logs containing identifiers such as IP addresses.
The notice should identify the controller and explain the purposes and lawful bases for processing, recipients, relevant international transfers, retention, individual rights and how to complain. The ICO lists identity, processing purposes and retention periods among the information that must be provided.
A copied template is unreliable when it names the wrong suppliers, promises retention periods nobody follows or misses data collected by the live site. We map the notice against the forms, integrations and databases actually in use.
Use layered notices where possible. Put a short explanation and privacy link beside each form, then provide the complete information on the main privacy page. A footer link alone may not give somebody useful information at the point their data is collected.
Cookie banners after the February 2026 changes
Consent is still generally needed before advertising, profiling and other non-essential tracking technologies run. However, not every website automatically needs a consent pop-up.
The rules changed when section 112 of the Data (Use and Access) Act 2025 came into force on 5 February 2026. A statistical-purpose exception can cover qualifying technologies used to produce aggregate information about how a service is used. It does not cover identifying, profiling or advertising to individual visitors.
Organisations relying on that exception must provide clear information and a simple, free way for users to object. Essential storage needed to provide a requested feature, such as keeping a basket working, sits separately from analytics. Marketing tags and analytics configurations outside the exception still need prior consent.
Test the implementation in a fresh private-browser session. Before making a choice, check that consent-dependent requests do not run. Reject tracking, reload the site and confirm those requests remain blocked.
This is not paperwork theatre: PECR fines can now reach £17.5 million or 4% of global turnover.
Extra requirements when customers can buy or book online
Ecommerce website legal requirements in the UK apply before the customer commits, not somewhere below the checkout in faint text.
Pre-contract information must cover matters including the product or service’s main characteristics, trader identity and geographic address. Customers also need the total price, applicable delivery arrangements, payment information, complaint handling and relevant cancellation rights.
The usual 14-day cancellation period applies to many distance contracts, but statutory exceptions exist. Digital content, personalised goods and services that begin early need particular care, so obtain advice on the exact cancellation wording for your offer.
The final checkout button must make the obligation to pay unambiguous. “Pay now” is clearer than “Continue”, and optional paid extras should not be preselected.
Online sellers must provide clear payment, delivery and pricing information and let customers store and reproduce applicable terms. That could mean downloadable terms or terms supplied with the order confirmation, rather than a page that can change without a record.
A generic terms page is not mandatory for every brochure site. Online sellers do need specific contractual information, and any wording they use must be fair and transparent. A template cannot decide how your fulfilment, subscriptions, refunds or cancellations work.
Publishing customer reviews creates compliance duties
Since April 2025, businesses publishing consumer reviews must take reasonable and proportionate steps to prevent and remove fake, concealed-incentivised and misleading reviews. This covers reviews displayed directly, imported through a review tool or used within product listings.
A disclaimer saying reviews are “the opinions of customers” is not an operational process. Depending on the risk and volume, controls can include verification, moderation, reporting and removal routes, named staff responsibility and records of decisions.
Publish a clear explanation of how reviews are collected, checked and treated. If discounts, free products or other incentives are involved, the process must ensure those relationships are not concealed.
Enforcement is significant but should be kept in proportion: the CMA can fine a company up to 10% of global turnover under its direct consumer-protection regime.
Accessibility duties in the UK and when selling into the EU
Private-sector websites are not all subject to one universal statutory WCAG score. However, the Equality Act can require reasonable adjustments, and the relevant code gives an inaccessible website as an example that may trigger duties and amount to indirect disability discrimination.
We use WCAG 2.2 AA as a practical engineering benchmark, not as a substitute for the legal test applying to an individual business. Public-sector organisations are covered by a separate accessibility regime and need a more specific review.
Real testing should cover:
- complete keyboard operation and visible focus;
- form labels, instructions and useful error messages;
- colour contrast and text resizing;
- appropriate alternative text and captions;
- headings, landmarks and screen-reader structure.
Businesses serving the EU market also need to check the European Accessibility Act. European rules cover relevant online shops and apply to covered products and services placed on the market after 28 June 2025.
There is an exemption for service micro-enterprises with fewer than 10 employees and annual turnover below €2 million. Cross-border scope and exemptions deserve specialist advice rather than assumptions based only on the business’s UK address.
Run this practical website compliance audit
Check one representative page, every form, the checkout and the site on a mobile device.
Identity and contact
- Correct legal or trading identity in the footer.
- Limited-company number, registered office, registration place and status.
- Geographic address and direct email contact.
Privacy and tracking
- Privacy links beside forms, not only in the footer.
- Notice matches the live forms, suppliers and retention practices.
- Consent-dependent tracking is blocked before a choice.
- Rejection and later preference changes work.
Sales and reviews
- Total price, delivery, payment and cancellation details appear before purchase.
- Final button clearly creates an obligation to pay.
- Applicable terms can be stored and reproduced.
- Review verification, incentives, reporting and removal are documented.
Accessibility and security
- Keyboard, focus, forms, contrast, resizing and screen-reader structure are tested.
- HTTPS is enabled across the site. It supports appropriate data security, but it is not a substitute for legal notices or secure internal handling.
Automated tools can detect HTTPS, missing links, company-number patterns, common cookie-banner problems, forms and mobile-layout faults. Humans still need to assess whether the privacy explanation is true, trackers are classified correctly, checkout wording is fair and disabled users can complete important tasks.
This checklist is general information, not legal advice for an individual business. Legal review is sensible where you sell across borders, operate in a regulated sector or have unusual data and contractual arrangements.
Do not treat the presence of legal pages as proof of compliance. Test the footer, forms, trackers, checkout and review process as working parts of the product.
Run our free website audit on your own site, then talk to us about the implementation if the findings need fixing.