What the law asks of your website

Who it is for. Every business website. Government guidance says this includes a site that only tells people about a business and sells nothing online.

Show the name of whoever runs the business, a postal address and an email address, where anyone can find them easily at any time. For a sole trader that is your own name; for a company, its registered name.

Add your VAT number if you are registered, and your Companies House number if you have one. If your trade is regulated, name the body that regulates you or your professional body.

Any price you show must be clear, and say whether it includes tax and delivery.

What to do. Put these details in the footer of every page, or on a contact page the footer links to.

• The Regulations, regulation 6 (opens a new tab)
• GOV.UK: the eCommerce Directive and the UK (opens a new tab)

Who it is for. Any site that collects names, emails or other personal details: a contact form, an enquiry email, a booking, or analytics that identify visitors.

When you collect someone’s details, tell them who you are, why you want the details, the legal reason you rely on, who else sees them, how long you keep them, their rights, and that they can complain to the Information Commissioner’s Office (ICO). Write it in plain language.

Since 19 June 2026 you must also make it easy for people to complain to you about how you use their data, and confirm you have their complaint within 30 days.

Most organisations that use personal information, sole traders included, pay the ICO a data protection fee each year. You are exempt if you use it only for certain things, such as staff records, your own accounts and records, or your own marketing. The lowest fee was £52 when we checked.

What to do. Write a privacy notice and link to it from every form and from the footer. Give people a simple way to complain, such as an email address or a form. Take the ICO’s short self-assessment to see whether you pay the fee.

• ICO: what privacy information to give (opens a new tab)
• UK GDPR, Article 13 (opens a new tab)
• Data (Use and Access) Act 2025, section 103 (opens a new tab)
• ICO: the data protection fee (opens a new tab)

Who it is for. Any site that stores or reads anything on a visitor’s device: cookies and similar tools, whether or not they hold personal details.

Ask before you set anything the site does not strictly need. Cookies needed for something the visitor asked for, such as a basket or the site’s security, do not need a yes.

Since 5 February 2026, two more kinds can run without asking, if you explain them clearly and give a free, simple way to say no: statistics used only to improve your own site, and settings that remember how a visitor likes the site to look or work. If an analytics company uses the data for its own ends, such as advertising, this does not apply.

Where you do ask, make Reject as easy as Accept. Leave optional cookies off until the visitor says yes. Carrying on browsing is not a yes.

What to do. List the cookies your site sets and what each one does. The list can sit inside your privacy notice. For advertising and tracking, use a banner with a Reject button as easy to use as Accept.

• ICO: the exceptions (opens a new tab)
• ICO: managing consent (opens a new tab)
• PECR, Schedule A1 (opens a new tab)

Who it is for. Every business that offers goods or services to the public in Great Britain. In Northern Ireland the same duty comes from the Disability Discrimination Act 1995.

A business must make reasonable adjustments so disabled people are not put at a disadvantage, and that includes giving information in a format they can use. The duty is owed to disabled people in general, so you plan for it before anyone asks.

The law names no technical standard. WCAG 2.2 at level AA is the one the public sector must meet, and the clearest measure for everyone else.

What to do. Check your site against WCAG 2.2 AA: text people can read and enlarge, pictures with descriptions, and forms that work with a keyboard and a screen reader.

• GOV.UK: accessibility requirements (opens a new tab)
• The Equality Act 2010, section 29 (opens a new tab)
• Section 20 (opens a new tab)

Who it is for. Every business across the UK, sole traders included. Since 1 March 2011 the advertising rules cover what you say to sell on your own website and social media accounts.

Claims must not mislead, or leave out something a customer needs to decide. Before you publish a claim a customer would take as fact, such as a number, a result or a claim to be the best, hold the evidence for it. A price you quote must include any fee the customer cannot avoid.

The CAP Code is the advertising industry’s own rulebook, and the Advertising Standards Authority (ASA) applies it. It is not an Act of Parliament.

What to do. Keep a file with the proof behind each claim on your site. Take down any claim you cannot prove.

• ASA: your own website (opens a new tab)
• The CAP Code, section 3 (opens a new tab)

Who it is for. Limited companies and LLPs. For sole traders and partnerships, the name and address rules cover business paperwork and signs at premises, not websites; the details under “Say who you are” still apply.

Your website must show the company’s registered name, its registered number, the part of the UK it is registered in (such as England and Wales) and its registered office address.

What to do. Put all four in the footer, so they are on every page.

• Regulation 25 (opens a new tab)
• Regulation 24 (opens a new tab)
• Companies Act 2006, section 1202 (opens a new tab)

Who it is for. Businesses that sell to consumers without meeting them, for example through an online shop or a booking system. Not sales to other businesses.

Before a customer is bound, give them set information: who you are, your address, the total price, and their right to cancel, with a model cancellation form.

Customers can usually cancel within 14 days: from delivery for goods, from the day they agree for services. Some things are not covered, such as goods made to their order, food that goes off, and bookings for a set date. A service can start inside the 14 days only if the customer asks; if they then cancel, they pay for what you have done.

The pay button must say “order with obligation to pay”, or something just as clear. If the cancellation information is missing, the time to cancel runs on, for up to 12 months more.

No law asks every site for a page called Terms. The law asks for this information, and a terms page is the usual place for it.

What to do. Show the information before checkout, put a cancellation notice and form in your terms, and check the words on your pay button.

• GOV.UK: online and distance selling (opens a new tab)
• The Regulations, regulation 13 (opens a new tab)
• Regulation 14, the pay button (opens a new tab)

Who it is for. Businesses that deal with consumers. In force since 6 April 2025.

You must not write, buy or commission fake reviews, or hide that a reviewer was paid or given something. You must not show reviews in a misleading way, for example only the good ones. If you publish reviews, take reasonable steps to stop fake and misleading ones.

When you invite people to buy, the price must be the total, including every charge they cannot avoid, such as fees and taxes. If the total cannot be worked out in advance, say how it is calculated.

What to do. Show real reviews only, and say when a reviewer got something in return. Write down how you check reviews. Show all-in prices from the first price on the page.

• CMA: unfair commercial practices (opens a new tab)
• The Act, Schedule 20 (opens a new tab)
• Section 230, prices (opens a new tab)