If you’re building a website in the UK, you may be wondering what legally needs to be on it. UK website legal requirements aren’t quite as simple as adding a privacy policy and a cookie banner to every site. What you need depends on who operates the website, what information you collect and whether you sell goods or services online.
A simple personal website has different requirements from a limited company’s website or an online shop. If you collect names, email addresses or other personal information, additional data-protection responsibilities may also apply.
This guide explains the main requirements in plain English, including privacy notices, cookies, company information and online selling.
Important: This guide provides general information for people creating websites in the UK. It isn’t legal advice. Requirements can change and your circumstances may create additional obligations, so check the current official guidance or seek professional advice where necessary.
What legally needs to be on a UK website?
There isn’t one page or piece of information that every UK website must display.
Instead, ask what your website actually does.
For example:
- Do you collect personal information? You will usually need to provide privacy information.
- Does your website use cookies or similar technologies? You need to consider the rules governing them.
- Is the website operated by a limited company? Certain company details must be displayed.
- Do you sell goods or services online? Additional consumer-information and distance-selling rules apply.
- Are you providing a service to the public? You should also consider your responsibilities towards disabled users and accessibility.
Let’s look at each area separately.
1. Does my website need a privacy policy?
For many business websites, yes.
The Information Commissioner’s Office (ICO) says that if your organisation holds personal data — such as people’s names and email addresses — you’ll need a privacy notice. The ICO also explains that there are very few circumstances where privacy information isn’t required.
This matters even for a relatively simple website.
For example, you may be collecting personal information if someone can:
- complete a contact or enquiry form;
- join your email list;
- create an account;
- make a purchase;
- book an appointment; or
- provide their details in another way.
A privacy notice — sometimes called a privacy policy — explains what you’re doing with people’s personal information.
The ICO says this should include information such as why you’re processing the data, your lawful basis where relevant, how long you keep the information, who you share it with and people’s information rights. It should be written in clear language and be easy to access.
Don’t simply copy another website’s privacy policy. Their business may collect and process completely different information from yours.
The ICO also provides a free tool designed to help sole traders, start-ups and small organisations create an appropriate privacy notice.
2. Does my UK website need a cookie notice?
If your website uses cookies or similar technologies, you need to understand what they’re doing rather than automatically installing a generic cookie banner.
The ICO says website visitors need clear information about cookies. For cookies that aren’t strictly necessary, consent requirements can apply.
This can become relevant when you add services such as analytics, advertising or other tools that place or access information on a visitor’s device.
It’s therefore worth knowing which cookies your website actually uses.
This is also an area where current guidance deserves particular care. The ICO has been updating parts of its guidance following changes introduced by the Data (Use and Access) Act.
Rather than copying an old cookie-policy template, check the current ICO guidance when setting up your site.
We’ll cover this subject separately in our guide to Do I Need a Cookie Policy on My Website UK?
3. What information must a limited company show on its website?
If your website belongs to a UK limited company, there are specific disclosure requirements.
GOV.UK says that company websites must show information including:
- the company’s registered number;
- its registered office address;
- where the company is registered — England and Wales, Scotland or Northern Ireland; and
- the fact that it is a limited company.
This information doesn’t necessarily need a large dedicated section in the middle of your homepage. What’s important is that the required information is displayed appropriately on the website.
For a small business, the footer can often be a sensible place for relevant company information because it remains accessible throughout the site.
4. What if I sell products or services online?
The legal requirements for a UK website become more extensive when you’re selling online.
Before a customer places an order in a distance sale, businesses must provide specified information. This can include the business’s name, contact details and address, a description of what is being sold, the price including taxes, payment information, delivery arrangements and applicable cancellation information.
There are additional requirements specifically for online selling.
For example, businesses need to make it clear when placing an order creates an obligation to pay, provide relevant payment and delivery information, explain applicable contractual information and provide appropriate confirmation after an order has been made.
Consumer cancellation rights can also apply in many distance-selling situations, although there are exceptions and different rules can apply to particular products and services.
So if you’re creating an ecommerce website, don’t assume that adding a generic Terms & Conditions page is enough.
5. Does every website need Terms and Conditions?
Not every website automatically needs the same Terms and Conditions page simply because it exists.
This is where generic website checklists can become misleading.
The information and contractual terms you need depend on what the website does. If you’re selling goods or services online, for example, consumer and distance-selling requirements become highly relevant. A simple informational website isn’t in the same position as an ecommerce business accepting payments.
Instead of adding a copied Terms and Conditions template because you’ve seen one on another website, establish what terms are actually relevant to your business and how customers interact with you.
6. What about website accessibility?
Accessibility is important, but this is another area where it’s easy to oversimplify the law.
You may have seen claims that every UK website must meet WCAG 2.2 AA and publish an accessibility statement. That isn’t an accurate description of the specific public-sector accessibility regulations.
Public-sector websites and services are subject to specific accessibility requirements, including requirements relating to accessibility standards and accessibility statements.
Separately, the Equality Act 2010 protects people from discrimination in services and wider society, so businesses providing services should consider their responsibilities towards disabled users.
For a beginner building a website, there’s also a practical reason to care about accessibility: a website should be usable by as many of the people you’re trying to reach as reasonably possible.
Things such as readable text, sensible heading structures, keyboard accessibility, descriptive alternatives for meaningful images and sufficient contrast aren’t merely boxes to tick. They make websites easier for people to use.
7. What if I use Google Analytics?
Adding analytics can change the privacy and cookie considerations for your website.
Don’t assume that installing an analytics plugin is purely a technical decision. You need to understand what the particular service stores or accesses, what information is collected and what that means for your privacy and cookie setup.
The rules don’t only concern traditional cookies. Other storage and access technologies can also be relevant, including tracking pixels, web storage, fingerprinting, scripts and tags.
So before adding analytics, advertising pixels or similar tracking technology, check what the tool actually does and make sure your website’s privacy information and consent mechanisms are appropriate.
8. What about contact forms and email newsletters?
A contact form might seem like a tiny part of your website, but if somebody enters their name, email address, telephone number or other identifiable information, you’re collecting personal data.
Organisations processing personal data will usually need to provide people with privacy information explaining how that information will be used.
That doesn’t mean you need to frighten visitors with pages of legal language every time they send an enquiry.
It means being transparent.
Your privacy notice should be easy to find, and you should think about what information you’re requesting in the first place. If you don’t actually need someone’s date of birth, home address or telephone number to answer their enquiry, ask whether you need to collect it.
Email marketing can introduce further requirements beyond the basic website issues covered in this guide, so don’t assume that collecting an email address automatically gives you permission to send promotional messages indefinitely.
Do I need all of these things before launching?
Not necessarily.
The point of understanding UK website legal requirements isn’t to make building your first website frightening. It’s to identify which requirements actually apply to what you’re creating.
A basic personal website that doesn’t sell anything and collects very little information has a different compliance profile from an ecommerce business taking payments, using advertising trackers and maintaining a customer database.
Before launching, ask yourself:
- Who operates this website?
- What personal information do I collect?
- What cookies or tracking technologies does the site use?
- Am I operating through a limited company?
- Do I sell goods, services or digital products online?
- How can disabled visitors access and use the site?
- Have I checked the current official guidance relevant to what I’m doing?
Those questions are more useful than blindly adding five “legal pages” because another website has them.
A simple legal checklist for your first UK website
If you’re creating your first website, start by checking these areas:
Privacy: Are you collecting personal information? If so, work out what you collect, why you collect it, how you use it and what privacy information you need to provide.
Cookies and tracking: Find out what your website actually sets or accesses. Don’t assume installing a cookie banner automatically makes everything compliant.
Business information: If you’re operating through a limited company, make sure the required company details appear on the site.
Selling online: If customers can buy from you through the website, check the consumer, distance-selling and online-selling requirements that apply.
Accessibility: Build accessibility into the website rather than treating it as something to fix afterwards.
Review: Legal requirements and official guidance change. Revisit your privacy, cookie and ecommerce setup when you add new tools or change how the website operates.
Don’t let the legal side stop you building
Legal terminology can make creating a first website seem much more intimidating than it needs to be.
You don’t need to become a data-protection lawyer before you can create a website. You do need to understand what your own site does, recognise when that creates responsibilities and use reliable, current sources rather than copying legal pages from another site.
If you’re still at the planning stage, start with What Do I Need for a Website? and What Pages Does a Website Need? These will help you work out the basic structure before you begin building.
Leave a Reply