# UK website legal requirements for small businesses: the 2026 checklist

> What a UK business website legally has to show and do in 2026: business information, company details, privacy notice, cookies, online selling rules, reviews and pricing, with links to the regulators.

- Source: https://nerdsharks.com/blog/uk-website-legal-requirements
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-26

**Short answer:** Most UK business websites must show who runs the business, a geographic address and email address, company number and registered office for limited companies, and a VAT number if registered. They need a privacy notice under UK GDPR, cookie consent for non-essential cookies under PECR, honest prices and reviews, and, if selling to consumers online, the information and cancellation rights set by consumer law.

Published 2026-09-26. 11 min read. Category: Website advice.

Plenty of small business owners assume the legal side of a website is something for big companies with legal teams. It is not. A handful of UK rules apply to almost every business website, from a sole trader’s one-page site to a national retailer, and most are simple to meet once you know what they are.

This checklist covers the UK website legal requirements that apply in 2026, grouped by what triggers them. It is a practical summary, not legal advice. Laws change and details depend on your business, so for anything specific, check the regulator guidance linked in the sources or speak to a solicitor.

## Requirements at a glance

**UK website legal requirements and who they apply to**

| Requirement | Applies to | Main law | Regulator or source |
|---|---|---|---|
| Business name, geographic address, email | Most businesses providing services online | Electronic Commerce (EC Directive) Regulations 2002 | legislation.gov.uk |
| Registered name, number, registered office, place of registration | Limited companies and LLPs | Companies Act 2006 and the 2015 trading disclosure regulations | Companies House / GOV.UK |
| VAT number | VAT-registered businesses | Electronic Commerce Regulations 2002 | legislation.gov.uk |
| Regulator and registration details | Regulated professions and trades | Electronic Commerce Regulations 2002, plus sector rules | Your regulator |
| Privacy notice | Any site collecting personal data, including contact forms and analytics | UK GDPR and Data Protection Act 2018 | ICO |
| Cookie consent | Sites using non-essential cookies or similar tracking | PECR, as amended by the Data (Use and Access) Act 2025 | ICO |
| Pre-contract information and cancellation rights | Businesses selling to consumers online or away from premises | Consumer Contracts Regulations 2013 | Trading Standards, CMA |
| Honest prices, no drip pricing, no fake reviews | All businesses dealing with consumers | Digital Markets, Competition and Consumers Act 2024 | CMA, Trading Standards |
| Accessible to disabled customers | All service providers | Equality Act 2010 | EHRC |

## 1. Tell people who you are

The Electronic Commerce Regulations 2002 require a business that provides services online, which in practice covers most commercial websites, to make certain information easily, directly and permanently available. That means your business name, the geographic address where you are established (not only a PO box), and contact details including an email address so people can reach you quickly.

If you are VAT registered, show your VAT number. If you belong to a regulated profession or need to be registered or authorised to do what you do, give the relevant body and your registration details, such as an SRA number for a law firm or FCA reference for an authorised firm. If you are on a public register such as Gas Safe, showing your number is good practice even where it is not strictly required on the website.

Most businesses put this in the website footer and on the contact page, which satisfies the “permanently available” test.

## 2. Limited companies: the extra disclosures

Limited companies and LLPs have extra duties under company law. GOV.UK’s guidance on signs, stationery and promotional material says a company’s website must show its registered name, its registered number, its registered office address and the part of the UK it is registered in (for example “Registered in England and Wales”).

If you trade under a name that is different from your registered company name, you must still show the registered name. A typical footer line reads: “Acme Plumbing is a trading name of Acme Heating Services Ltd, registered in England and Wales, company number 01234567, registered office 1 High Street, Exeter.”

## 3. Privacy notice and data protection

If your website collects any personal data, and almost every business site does through contact forms, booking systems, newsletter sign-ups or analytics, UK GDPR requires you to tell people how you use it. That is your privacy notice, usually called a privacy policy. The ICO’s guidance on the right to be informed lists what it must include, such as who you are, why you process the data, your lawful basis, who you share it with, how long you keep it and people’s rights, including the right to complain to the ICO.

Most businesses that process personal data also need to pay the ICO data protection fee each year unless an exemption applies. The ICO has a short self-assessment on its website to check.

## 4. Cookies and tracking

Cookies and similar technologies are governed by the Privacy and Electronic Communications Regulations (PECR). You must tell people about the cookies you use and get consent for those that are not exempt. Strictly necessary cookies, such as those that keep a shopping basket working, have always been exempt.

The Data (Use and Access) Act 2025 added new exceptions that came into force on 5 February 2026, including cookies used only for statistical purposes to improve your own service (with clear information and a simple, free way to object) and cookies that remember choices about how the website looks or functions. Advertising and cross-site tracking cookies still need consent. Whether a particular analytics tool fits the new exception depends on how it is set up, so read the ICO’s updated guidance before removing a consent banner.

## 5. Selling to consumers online

If consumers can buy, book or order from you online, or you agree contracts in their homes, the Consumer Contracts Regulations 2013 apply. Before the contract, you must give clear information including the main characteristics of what you sell, the total price including taxes and delivery, how to pay, delivery arrangements and whether there is a right to cancel. For most distance and off-premises contracts consumers have 14 days to cancel, with specific exceptions such as personalised goods and perishable items.

The order button must make it clear that clicking it means the customer will have to pay, for example “Order and pay”. After the sale you must confirm the contract on a durable medium such as an email. The Consumer Rights Act 2015 then sets the customer’s rights if goods are faulty or a service is not carried out with reasonable care and skill.

## 6. Prices, reviews, claims and accessibility

The Digital Markets, Competition and Consumers Act 2024 replaced the old Consumer Protection from Unfair Trading Regulations from April 2025 and gave the Competition and Markets Authority power to fine businesses directly for consumer law breaches. Two rules matter for websites in particular.

First, drip pricing: headline prices must include unavoidable fixed charges, rather than adding compulsory fees at the checkout. Second, fake reviews: businesses must not write, commission or publish fake reviews, conceal incentivised reviews, or present reviews misleadingly, for example by hiding negative ones. The CMA’s guidance CMA208 explains what it expects. Separately, the CAP Code enforced by the ASA applies to marketing claims on your own website, so claims such as “cheapest in town” need evidence.

The Equality Act 2010 requires service providers to make reasonable adjustments so disabled people can use their services. There is no private sector equivalent of the public sector accessibility regulations, but building to WCAG 2.2 AA is the sensible benchmark and protects you and your customers.

## Your website legal checklist

None of this is exotic, but it is easy to miss when a website is built from a template and forgotten. When Nerdsharks builds a site, the business information, privacy notice and cookie setup are written from what the site actually does, and kept in step when features change. For anything beyond the basics, the ICO, Companies House and Trading Standards Business Companion guidance are the authoritative sources.

- Business name, geographic address and email address visible on every page, usually in the footer.
- For limited companies and LLPs: registered name, number, registered office and place of registration.
- VAT number if VAT registered.
- Regulator name and registration number if you are in a regulated profession.
- A privacy notice that matches what your site actually collects, linked from every form.
- ICO data protection fee paid, or exemption confirmed.
- Cookie banner or notice reflecting the cookies your site really uses, with consent before non-exempt cookies are set.
- If selling online: full pre-contract information, clear total prices, a cancellation policy and an order-with-obligation-to-pay button.
- Prices include all unavoidable charges.
- Reviews genuine, unedited in meaning and not cherry-picked.
- Claims on the site you can back up.
- Reasonable accessibility, with a way to contact you if something does not work.

## Questions

### Does a sole trader website need to show an address?

Most sole trader websites need to show a geographic address where the business is established, under the Electronic Commerce Regulations 2002, along with the business name and an email address. A PO box on its own is not enough. Many sole traders who work from home use a business address service; check it counts as a geographic address.

### Do I legally need a privacy policy on my website?

You need a privacy notice if your website collects any personal data, which includes contact forms, booking systems, email sign-ups and most analytics. UK GDPR requires you to tell people what you collect, why, on what lawful basis, who you share it with, how long you keep it and what rights they have.

### Do I need terms and conditions on my website?

Terms and conditions are not legally required on every website, but if you sell online to consumers you must give specific pre-contract information and cancellation details, and terms are the usual place for them. Service businesses benefit from clear terms on quotes, deposits and cancellations even when not selling online.

### What company information must be on a limited company website?

A limited company website must show the company’s registered name, registered number, registered office address and the part of the UK where it is registered, such as England and Wales. If VAT registered, it should also show the VAT number. The footer is the usual place.

### Who enforces website rules in the UK?

Different regulators enforce different website rules. The ICO covers data protection, privacy notices and cookies; the Competition and Markets Authority and local Trading Standards cover consumer law, pricing and reviews; the ASA covers advertising claims; and Companies House rules cover company disclosures.

### Is this legal advice?

No. This guide is a general summary of UK website legal requirements as of September 2026 and is not legal advice. Your obligations depend on your business, what your website does and who you sell to, so check the regulator guidance or speak to a solicitor about your circumstances.

## Sources

- The Electronic Commerce (EC Directive) Regulations 2002, legislation.gov.uk, 2002, as amended: https://www.legislation.gov.uk/uksi/2002/2013/contents
- Running a limited company: signs, stationery and promotional material, GOV.UK, 2026: https://www.gov.uk/running-a-limited-company/signs-stationery-and-promotional-material
- The right to be informed, Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/
- Guidance on the use of storage and access technologies (cookies), Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/
- Data (Use and Access) Act 2025, section 112 and Schedule 12, legislation.gov.uk, In force 5 February 2026: https://www.legislation.gov.uk/ukpga/2025/18/section/112
- The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, legislation.gov.uk, 2013, as amended: https://www.legislation.gov.uk/uksi/2013/3134/contents
- Digital Markets, Competition and Consumers Act 2024, legislation.gov.uk, Consumer provisions in force 6 April 2025: https://www.legislation.gov.uk/ukpga/2024/13/contents
- Fake reviews (CMA208), GOV.UK (Competition and Markets Authority), Published April 2025: https://www.gov.uk/government/publications/fake-reviews-cma208
- Equality Act 2010, legislation.gov.uk, 2010, as amended: https://www.legislation.gov.uk/ukpga/2010/15/contents