Website Legal Requirements in the UK: The Plain English Checklist

Every UK business website must show who is behind it, how to contact you, and what you do with visitors’ data. If you are a limited company that means your registered name, company number, place of registration and registered office address. If you use any non-essential cookies you need consent before they load, not after. And if you sell online, a further set of rules applies on top.

This is a plain English summary written by a web studio, not legal advice. The rules below are the ones we see broken most often on small business sites, and they are current as of September 2026. If anything here applies to you in an unusual way, take proper advice.

Who you are: the details that must appear

This is the requirement most commonly missed, and it is the easiest to fix.

Limited companies must display the registered company name, the company registration number, the part of the UK where the company is registered, and the address of the registered office. This applies to the website as well as to letters and order forms. It does not have to be on every page in large type, and the footer or a dedicated page is normal, but it must be findable.

Sole traders and partnerships trading under a name that is not simply their own must display the owner’s name and an address where documents can be served.

If you are VAT registered, show the VAT number.

If you belong to a regulated profession or trade body, the registration details and the body should be stated, along with any professional title and where it was awarded.

Alongside that, you need a way to be contacted quickly and directly, which in practice means an email address or a form that reaches you, plus a geographic address. A contact form on its own has been argued about for years, and the safe position is to publish an email address as well.

If you sell anything online

Selling to consumers at a distance brings in a further set of obligations, and these are the ones that generate complaints.

• Clear pricing including whether VAT is included, and delivery costs shown before the customer commits.
• A description of the goods or services sufficient for the customer to know what they are buying.
• Cancellation rights. Consumers generally have 14 days to cancel a distance purchase, and you must tell them so, explain how, and provide a model cancellation form.
• Delivery timescales and what happens if you cannot meet them.
• An order confirmation and a clear point at which the customer understands they are entering a contract. This is why the final button should say something like “Pay now” rather than “Continue”.

Digital products and services have their own wrinkles around when the cancellation right ends, so check those specifically if that is what you sell.

The privacy notice

If your website collects any personal data, and a contact form counts, you need a privacy notice. Under UK GDPR it has to explain what you collect, why, what your lawful basis is, how long you keep it, who else sees it, and what rights the individual has.

Two practical points. A generic template that does not describe what your site actually does is not compliance, it is decoration, and the most common giveaway is a privacy policy referring to services the business does not use. And if you are relying on consent for marketing, that consent has to be a positive action, separately obtained, and recorded.

The ICO’s guidance for organisations is genuinely readable and is written for small businesses.

Cookies, and the banner nearly everyone gets wrong

Cookie rules come from PECR rather than GDPR, and they are stricter than most sites behave as though they are.

Non-essential cookies, which includes analytics and anything advertising related, must not be set until the visitor has consented. That is the rule that gets broken: a banner that says “by continuing to use this site you accept cookies” while the tracking has already loaded is not compliant, and neither is one where the only button is “Accept”.

What a compliant banner looks like in practice: nothing non-essential loads on arrival, rejecting is as easy as accepting and visible at the same level, consent is recorded, and the visitor can change their mind later. Cookies strictly necessary for the site to work, such as keeping items in a basket, do not need consent.

Accessibility, the part most agencies skip

There is a common misconception that accessibility law only applies to the public sector. Public sector bodies do have specific regulations requiring them to meet a defined standard. But the Equality Act 2010 applies to service providers generally, and a website is a service. The duty to make reasonable adjustments applies to private businesses too.

There is no single certificate to buy. The accepted benchmark is the Web Content Accessibility Guidelines, and the practical minimum most sites fail on is short:

• Text that has enough contrast against its background to be read.
• Every image that carries meaning has alt text.
• The whole site can be operated with a keyboard alone.
• Form fields have labels that are actually attached to them.
• Video has captions.

If you sell into the EU, the European Accessibility Act brings additional obligations for certain services and is worth checking against what you sell.

Not required, but get them anyway

Terms and conditions are not usually a legal requirement for a brochure site, and they are the thing most businesses assume is compulsory. They are still worth having, because they are where you set out what you are agreeing to and what you are not.

The same goes for HTTPS. No statute names it, but a site collecting personal data over an unencrypted connection is hard to defend as appropriate security, and browsers now mark it plainly to visitors. We covered what that warning actually means in why your website says not secure.

The checklist

Common questions

What legally needs to be on a website?

At minimum, who is behind the business and how to reach them, plus a privacy notice if you collect any data at all. For a limited company the identity details are specific and prescribed. Everything else depends on what you do: selling adds a substantial layer, regulated trades add another.

Do I need terms and conditions on my UK website?

For a brochure site, generally no. For anything transactional, effectively yes, because that is where the cancellation terms, delivery terms and limits of liability live, and several of those disclosures are required. The distinction that matters is not whether you have a page called terms, it is whether the required information is presented before the customer commits.

Is a cookie banner a legal requirement?

A banner is not required. Consent is. If your site sets no cookies beyond those strictly necessary to make it work, you do not need a banner at all, and a small brochure site with no analytics is a genuine example. The moment you add analytics or an advertising pixel, you need consent before it fires.

Does accessibility law apply to a small private business?

The Equality Act duty applies to service providers regardless of size, so yes in principle, though what counts as a reasonable adjustment is proportionate to your resources. In practice the basics on the list above are cheap to get right during a build and expensive to retrofit, which is the real argument for doing them.

What happens if we get this wrong?

It varies by which rule. Data protection failures sit with the ICO and are the ones with meaningful financial consequences. Missing company details are an offence but rarely pursued unless something else has gone wrong. The realistic risk for most small businesses is not a regulator, it is a customer dispute where you have no terms to point at.

Getting it checked

Most of this is a couple of hours of work on an existing site, and it is the sort of thing that is easy to fix and awkward to explain if it has been missed for three years. Our care plans cover keeping it right as the rules move. If you would rather we just looked at where yours stands, you know where we are.