Plenty of small business owners assume the legal side of a website is something for big companies with legal teams. It is not. A handful of UK rules apply to almost every business website, from a sole trader’s one-page site to a national retailer, and most are simple to meet once you know what they are.
This checklist covers the UK website legal requirements that apply in 2026, grouped by what triggers them. It is a practical summary, not legal advice. Laws change and details depend on your business, so for anything specific, check the regulator guidance linked in the sources or speak to a solicitor.
Requirements at a glance
| Requirement | Applies to | Main law | Regulator or source |
|---|---|---|---|
| Business name, geographic address, email | Most businesses providing services online | Electronic Commerce (EC Directive) Regulations 2002 | legislation.gov.uk |
| Registered name, number, registered office, place of registration | Limited companies and LLPs | Companies Act 2006 and the 2015 trading disclosure regulations | Companies House / GOV.UK |
| VAT number | VAT-registered businesses | Electronic Commerce Regulations 2002 | legislation.gov.uk |
| Regulator and registration details | Regulated professions and trades | Electronic Commerce Regulations 2002, plus sector rules | Your regulator |
| Privacy notice | Any site collecting personal data, including contact forms and analytics | UK GDPR and Data Protection Act 2018 | ICO |
| Cookie consent | Sites using non-essential cookies or similar tracking | PECR, as amended by the Data (Use and Access) Act 2025 | ICO |
| Pre-contract information and cancellation rights | Businesses selling to consumers online or away from premises | Consumer Contracts Regulations 2013 | Trading Standards, CMA |
| Honest prices, no drip pricing, no fake reviews | All businesses dealing with consumers | Digital Markets, Competition and Consumers Act 2024 | CMA, Trading Standards |
| Accessible to disabled customers | All service providers | Equality Act 2010 | EHRC |
1. Tell people who you are
The Electronic Commerce Regulations 2002 require a business that provides services online, which in practice covers most commercial websites, to make certain information easily, directly and permanently available. That means your business name, the geographic address where you are established (not only a PO box), and contact details including an email address so people can reach you quickly.
If you are VAT registered, show your VAT number. If you belong to a regulated profession or need to be registered or authorised to do what you do, give the relevant body and your registration details, such as an SRA number for a law firm or FCA reference for an authorised firm. If you are on a public register such as Gas Safe, showing your number is good practice even where it is not strictly required on the website.
Most businesses put this in the website footer and on the contact page, which satisfies the “permanently available” test.
2. Limited companies: the extra disclosures
Limited companies and LLPs have extra duties under company law. GOV.UK’s guidance on signs, stationery and promotional material says a company’s website must show its registered name, its registered number, its registered office address and the part of the UK it is registered in (for example “Registered in England and Wales”).
If you trade under a name that is different from your registered company name, you must still show the registered name. A typical footer line reads: “Acme Plumbing is a trading name of Acme Heating Services Ltd, registered in England and Wales, company number 01234567, registered office 1 High Street, Exeter.”
3. Privacy notice and data protection
If your website collects any personal data, and almost every business site does through contact forms, booking systems, newsletter sign-ups or analytics, UK GDPR requires you to tell people how you use it. That is your privacy notice, usually called a privacy policy. The ICO’s guidance on the right to be informed lists what it must include, such as who you are, why you process the data, your lawful basis, who you share it with, how long you keep it and people’s rights, including the right to complain to the ICO.
Most businesses that process personal data also need to pay the ICO data protection fee each year unless an exemption applies. The ICO has a short self-assessment on its website to check.
4. Cookies and tracking
Cookies and similar technologies are governed by the Privacy and Electronic Communications Regulations (PECR). You must tell people about the cookies you use and get consent for those that are not exempt. Strictly necessary cookies, such as those that keep a shopping basket working, have always been exempt.
The Data (Use and Access) Act 2025 added new exceptions that came into force on 5 February 2026, including cookies used only for statistical purposes to improve your own service (with clear information and a simple, free way to object) and cookies that remember choices about how the website looks or functions. Advertising and cross-site tracking cookies still need consent. Whether a particular analytics tool fits the new exception depends on how it is set up, so read the ICO’s updated guidance before removing a consent banner.
5. Selling to consumers online
If consumers can buy, book or order from you online, or you agree contracts in their homes, the Consumer Contracts Regulations 2013 apply. Before the contract, you must give clear information including the main characteristics of what you sell, the total price including taxes and delivery, how to pay, delivery arrangements and whether there is a right to cancel. For most distance and off-premises contracts consumers have 14 days to cancel, with specific exceptions such as personalised goods and perishable items.
The order button must make it clear that clicking it means the customer will have to pay, for example “Order and pay”. After the sale you must confirm the contract on a durable medium such as an email. The Consumer Rights Act 2015 then sets the customer’s rights if goods are faulty or a service is not carried out with reasonable care and skill.
6. Prices, reviews, claims and accessibility
The Digital Markets, Competition and Consumers Act 2024 replaced the old Consumer Protection from Unfair Trading Regulations from April 2025 and gave the Competition and Markets Authority power to fine businesses directly for consumer law breaches. Two rules matter for websites in particular.
First, drip pricing: headline prices must include unavoidable fixed charges, rather than adding compulsory fees at the checkout. Second, fake reviews: businesses must not write, commission or publish fake reviews, conceal incentivised reviews, or present reviews misleadingly, for example by hiding negative ones. The CMA’s guidance CMA208 explains what it expects. Separately, the CAP Code enforced by the ASA applies to marketing claims on your own website, so claims such as “cheapest in town” need evidence.
The Equality Act 2010 requires service providers to make reasonable adjustments so disabled people can use their services. There is no private sector equivalent of the public sector accessibility regulations, but building to WCAG 2.2 AA is the sensible benchmark and protects you and your customers.
Your website legal checklist
None of this is exotic, but it is easy to miss when a website is built from a template and forgotten. When Nerdsharks builds a site, the business information, privacy notice and cookie setup are written from what the site actually does, and kept in step when features change. For anything beyond the basics, the ICO, Companies House and Trading Standards Business Companion guidance are the authoritative sources.
- Business name, geographic address and email address visible on every page, usually in the footer.
- For limited companies and LLPs: registered name, number, registered office and place of registration.
- VAT number if VAT registered.
- Regulator name and registration number if you are in a regulated profession.
- A privacy notice that matches what your site actually collects, linked from every form.
- ICO data protection fee paid, or exemption confirmed.
- Cookie banner or notice reflecting the cookies your site really uses, with consent before non-exempt cookies are set.
- If selling online: full pre-contract information, clear total prices, a cancellation policy and an order-with-obligation-to-pay button.
- Prices include all unavoidable charges.
- Reviews genuine, unedited in meaning and not cherry-picked.
- Claims on the site you can back up.
- Reasonable accessibility, with a way to contact you if something does not work.