Website legal requirements in the UK: the pages and details a business site must have

The website legal requirements UK businesses have to meet are fewer than most people fear. Every business site must say who is behind it: a name, a geographic address and an email address, plus the registered name, company number, registered office and place of registration for a limited company or LLP, and a VAT number if you have one. If the site collects personal data it needs a privacy notice. If it sets non-essential cookies it needs consent. If it sells to consumers it must give pre-contract information and, for most orders, a 14-day right to cancel.

The rest of this guide takes each item in turn, names the law behind it, and shows what four common kinds of site need. It is general information from people who build websites for a living, not legal advice. Rules change and some depend on your trade, so check the guidance from the ICO, GOV.UK, Companies House or the CMA, or ask a solicitor, before relying on it.

Website legal requirements in the UK by type of site

A checklist written for an online shop is overkill for a five-page brochure site. “Yes” means the rule normally applies; the sections below give the conditions.

Company details that must be shown

Limited companies and LLPs

The Companies Act 2006 and the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015 require a company to disclose the following on its websites, as well as on business letters and order forms:

• The registered name, exactly as it appears on the register, including “Limited” or “Ltd”. A trading name on its own is not enough.
• The part of the UK where the company is registered: England and Wales, Wales, Scotland or Northern Ireland.
• The registered number.
• The registered office address, which is often your accountant’s office. If you trade from somewhere else, show both and label them.

The footer is the sensible place, because nobody has to hunt for it. A typical line reads: “Example Joinery Ltd. Registered in England and Wales, company number 01234567. Registered office: 1 Example Street, Leeds LS1 1AA.”

You do not have to list directors. The same rules cover business emails and electronic order forms, so the email signature and order confirmation need the details too. Failing to make the disclosures is an offence for which the company and its officers can be fined. Prosecutions over a missing footer line appear to be rare, but it is a five-minute fix.

Sole traders and partnerships

If you trade under a business name, for example Sarah Khan trading as Northside Dog Grooming, the business-name rules in Part 41 of the Companies Act 2006 require your own name (or each partner’s name) and an address where documents can be served to appear on business letters, written orders, invoices, receipts and written demands for payment.

That list does not name websites, but the E-Commerce Regulations below require any business site to give a name and a geographic address. So a sole trader’s site should show the owner’s name beside the trading name, and a real address. If you work from home, a virtual office address that reliably forwards post is the usual answer, though check with an adviser that your arrangement is good enough.

Contact details under the E-Commerce Regulations

The Electronic Commerce (EC Directive) Regulations 2002 apply to online services normally provided for payment, which is generally taken to include a site that advertises a business as well as one that sells. They require the following to be “easily, directly and permanently accessible”:

• the name of the business providing the service;
• the geographic address where it is established;
• contact details that allow rapid and direct communication, including an email address;
• your regulator or professional body, if your work is authorised or regulated;
• your VAT number, if you are VAT-registered.

A contact form does not replace a published email address. That is one of the gaps we most often find on sites we take over.

Privacy notice, the ICO fee and cookies

Privacy notice

Under the UK GDPR and the Data Protection Act 2018, you must tell people what you do with their personal data when you collect it. Contact forms, newsletter sign-ups, orders, bookings and most analytics tools all count. Going by the ICO’s guidance on the right to be informed, a privacy notice says who you are, what you collect and why, your lawful basis, who you share it with (your host, email provider, payment processor), whether it leaves the UK, how long you keep it, and what rights people have, including complaining to the ICO.

Do not copy another site’s policy; it describes their suppliers, not yours. The ICO publishes a free privacy notice generator for small organisations. Link the notice from the footer and beside every form; ours is at /privacy-policy/ if you want to see a layout. The Data (Use and Access) Act 2025 has amended parts of this regime, so check the ICO’s site for current wording.

The data protection fee

Most organisations that process personal data pay an annual fee to the ICO. At the time of writing it lists £52 for the smallest tier and £78 for the next. There are exemptions, and the ICO’s self-assessment tool tells you whether you need to pay. Not paying when you should can bring a fixed penalty of £400 or £600 for small organisations, and up to £4,350 for the largest.

Cookies and PECR

The Privacy and Electronic Communications Regulations (PECR) require consent before you store or read anything on a visitor’s device that is not strictly necessary for the service they asked for. A shopping basket cookie is necessary. Advertising pixels and remarketing tags are not. The ICO’s position is that rejecting must be as easy as accepting.

The 2025 Act added narrow exceptions, including one for cookies used purely to count visitors and improve the site, subject to conditions. Whether your analytics set-up fits depends on how it is configured, so read the ICO’s current guidance before removing a banner. Our guide to cookie banners under UK GDPR and PECR covers the practical side.

Terms and conditions

No law says a brochure website must have a page called “Terms and Conditions”. Terms of sale are different. If people can buy, book or subscribe on the site, the law requires you to give them specific information before they commit, and a clear set of terms is how you do it. Under the Consumer Rights Act 2015 an unfair term does not bind a consumer, so have a solicitor review terms that take deposits or limit liability. Customers should be able to read the terms before they pay and tick to accept them, and you should keep dated copies of each version.

Selling online to consumers

Pre-contract information

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 apply when you sell to consumers at a distance, which includes any website checkout. Before the order is placed you must give, among other things:

• the main characteristics of what you are selling, and who you are;
• the total price including taxes, and all delivery and other charges;
• how and when you will deliver;
• the right to cancel, how to use it, who pays for returns, and a cancellation form;
• the length of any ongoing contract and how to end it.

Three details affect how the checkout is built. The button that places the order must make clear that pressing it means paying: “Pay now” is fine, “Continue” is not. Paid extras cannot be added through pre-ticked boxes. And you must confirm the contract in a durable form, normally an email, no later than delivery.

The 14-day right to cancel

Most online sales to consumers carry a 14-day cancellation period. For goods it runs from the day after delivery; for services, from the day after the contract is made. No reason is needed. You refund the price and the standard outbound delivery charge, generally within 14 days of getting the goods back or proof they were sent. If you never tell customers about the right, the period can be extended by up to a year.

The exceptions matter as much as the rule. They include personalised or made-to-order goods, perishables, sealed items that cannot be returned for hygiene reasons once opened, and accommodation, goods transport, vehicle hire, catering and leisure services booked for a specific date or period. Passenger transport tickets fall outside these rules altogether. A service can start within the 14 days only if the customer expressly asks. Regulation 28 of the Consumer Contracts Regulations has the full list, and GOV.UK’s page on accepting returns and giving refunds summarises the main ones for goods.

Faulty goods, deposits and bookings

Separately, the Consumer Rights Act 2015 requires goods to be of satisfactory quality, fit for purpose and as described, with a short-term right to reject faulty goods within 30 days. Your returns policy can be more generous than the law. It cannot be less, so “no refunds” has no place on a consumer site.

On deposits, CMA guidance on unfair terms takes the view that a deposit should be a small proportion of the price and that what you keep on cancellation should reflect what you really lose. A blanket “deposits are non-refundable” line may not hold up. Whether the 14-day right applies to a booking depends on the service: a restaurant table or a ticketed event on a set date is likely to be exempt, while a course of treatment is less clear, so take advice on your own case. Our article on taking booking deposits with Stripe covers the technical side.

Showing prices and VAT

Prices shown to consumers must be the full price including VAT. That comes from the Price Marking Order 2004 for goods and from the ASA’s advertising rules more generally. If your prices are clearly addressed only to business customers who can recover VAT, you can quote them excluding VAT, as long as you state the amount or rate of VAT prominently; our own hourly rates are shown that way, with the 20 % rate stated, for that reason.

The Digital Markets, Competition and Consumers Act 2024 tightened this from April 2025: mandatory charges such as booking fees belong in the headline price, not the last step, and fake reviews are banned. Its rules for subscription contracts are not yet in force; the government has said they will start in January 2027.

Email marketing: consent and the soft opt-in

PECR also governs marketing emails. To email an individual, which includes sole traders, you need their consent or the “soft opt-in”. Consent means an unticked box and a plain description of what they will receive. The soft opt-in lets you email your own customers without that box if you collected the address during a sale or a negotiation for one, you are marketing your own similar products or services, and you offered a simple way to refuse at the time and in every message since.

It does not cover bought lists, or someone who downloaded a free guide and was never told about marketing. Emails to people at limited companies are treated differently, but you must still identify yourself and honour opt-outs. See the ICO’s direct marketing guidance.

Accessibility

Under the Equality Act 2010, anyone providing goods or services to the public in England, Scotland and Wales must make reasonable adjustments so that disabled people are not put at a substantial disadvantage, and that is widely understood to include websites. Northern Ireland has equivalent duties under the Disability Discrimination Act 1995.

The Act names no technical standard. The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018, which require WCAG 2.2 AA and a published accessibility statement, apply to public sector bodies only. A private firm does not have to publish a statement, though WCAG 2.2 AA is the benchmark most people would measure a site against. Our article on website accessibility and UK law goes into detail.

Copyright, images and fonts

Under the Copyright, Designs and Patents Act 1988, copyright exists automatically. An image that turns up in a Google search is not free to use, and picture agencies run automated checks and send payment demands, sometimes years after the page went up. Use photos you took, commissioned or licensed, keep a record of where each came from, and remember that web fonts often need their own licence.

What happens if you get it wrong

For a small business the realistic risks are mundane: a chargeback you cannot defend because the terms were unclear, a payment provider or ad platform pausing the account until the site shows proper business details and policies, a copyright demand, or a complaint to the ICO, the ASA or Trading Standards.

The formal powers are far larger. The ICO can fine up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, under the UK GDPR, and since 5 February 2026 the 2025 Act has raised the PECR ceiling to match. Since April 2025 the CMA can decide consumer law breaches itself and impose penalties of up to 10% of global turnover. Those ceilings are aimed at large firms and serious cases.

A legal checklist for your website

• Footer shows registered name, company number, place of registration and registered office, or the owner’s name and address for a sole trader
• Email address published in text, not only a form
• VAT number shown, if registered
• Privacy notice matches your actual suppliers and is linked beside each form
• ICO fee paid, or exemption checked
• No non-essential cookies before consent
• Terms of sale readable and accepted before payment
• Total price including VAT and delivery shown before the final step
• Cancellation and returns information on the site and in the confirmation email
• Marketing sign-up uses an unticked box; every email has an unsubscribe link
• Keyboard access, colour contrast, form labels and alt text checked
• A record of the licence for every image and font

What it costs to put right

Most of this is an afternoon’s work once the wording is ready. As an illustration, a WordPress brochure site with a contact form and a newsletter sign-up needs footer details, privacy and terms pages, consent wording on two forms, and cookie consent wired to the tags. We would allow about four hours at our WordPress development rate of £50 an hour: 4 × £50 = £200, plus VAT of £40, so £240. A shop takes longer because the checkout, emails and returns flow need checking, work that sits under our e-commerce development service.

We are developers, not solicitors. We build the pages, the consent mechanics and the checkout so they behave the way the rules expect; the wording of your terms and privacy notice is yours to write or have reviewed. If you want a second pair of eyes on a site, book a few hours and we will tell you what we would fix first. We are based in London and work with businesses across the UK.

Photo: Windows via Unsplash