Entrepreneur Legal UK · Insight
Do I Need Website Terms and a Cookie Policy in the UK?
By Gabriel C. Mbanefo — Solicitor of the Senior Courts of England and Wales; Director, Entrepreneur Legal Ltd (Entrepreneur Legal UK).
Website Terms and Cookie Policy at a glance
| Question | Practical answer | Typical route |
|---|---|---|
| Does every website legally need Website Terms? | No single UK rule says every site must have a document with that title. Terms are often commercially important where users browse, register, upload content, buy, subscribe or rely on site functionality. | Website Terms of Use through StartWise® for a reasonably standard site; legal support for unusual or regulated models. |
| Does every website need cookie information? | If the service stores information on, or accesses information from, a user’s device, PECR applies. Consent is generally required unless a statutory exception applies. | Cookie Policy plus a consent/objection mechanism that reflects the technologies actually used. |
| Is a Cookie Policy the same as a Privacy Policy? | No. PECR regulates storage/access technologies. UK GDPR transparency deals with personal-data processing. The same technology can trigger both regimes. | Cookie Policy and Privacy Policy should be coordinated, not merged blindly. |
| Can a legal page fix a non-compliant implementation? | No. A written policy does not cure cookies firing too early, missing pre-contract information or an unfair consumer term. | Document drafting + product/checkout/consent implementation. |
The founder problem: a compliant-looking footer can still hide four different legal problems
Imagine a UK startup launches a subscription platform. Its footer contains “Terms”, “Privacy” and “Cookies”. The site also uses analytics, a marketing pixel, session replay, account creation and an online checkout. The founder assumes the legal layer is complete because the footer looks professional. It may not be. Company disclosures, contract information, consumer rights, privacy transparency and PECR consent are separate legal questions, and the website has to implement each one correctly.
1. Website Terms are usually contractual tools, not a universal statutory form
Website Terms of Use can define who may use a site, account rules, acceptable use, intellectual-property permissions, user content, suspension, disclaimers, liability and dispute arrangements. They are especially useful where the user does more than passively read a brochure site. But the existence of a Terms page does not itself prove that a contract has been formed, that the terms were incorporated, or that every clause is enforceable. The user journey, notice, acceptance method and the substance of the terms all matter.
If the website sells goods, services, subscriptions or digital content, general Website Terms may also be insufficient. The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 impose pre-contract information duties for many distance contracts, and the Consumer Rights Act 2015 controls fairness and transparency in consumer terms. A business should therefore distinguish rules for using the site from the terms governing the actual sale or subscription.
2. A limited company can have mandatory website disclosures even if it sells nothing online
Companies House guidance requires a limited company’s website to show specified corporate information, including the registered company number, registered office address, the part of the UK in which the company is registered, and the fact that it is limited. This duty arises from trading-disclosure rules, not from a document called Website Terms. A trading name can be prominent, but the legal operator still needs to be identifiable.
3. Online services may need extra identity and ordering information
Regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 requires providers of information society services to make specified details easily, directly and permanently accessible. These include the provider’s name, geographic address and an email/contact route enabling rapid, direct and effective communication; public-register details, regulator/professional information and a VAT identification number may also be required where applicable. A company-registration footer alone may not address every applicable item.
Regulation 9 also requires, for relevant electronic contracts, pre-order information about the technical steps to contract, whether the concluded contract is filed and accessible, ways to identify and correct input errors, and available contract languages. Applicable terms must be made available for storage and reproduction. The regulation has exceptions and limited scope for non-consumer agreement to different arrangements; the relevant purchase or sign-up journey must be checked, not merely the Terms page.
4. PECR applies to more than browser cookies
The ICO now uses the broader term “storage and access technologies”. PECR can cover cookies, tracking pixels, web storage, device fingerprinting, link decoration, scripts and tags where information is stored on or accessed from terminal equipment. The regime applies to websites, apps and connected services. Where the information is personal data, UK GDPR requirements can apply alongside PECR.
Following amendments made by the Data (Use and Access) Act 2025, regulation 6 now contains a broader set of statutory exceptions. The ICO’s final April 2026 guidance identifies the communication, strictly necessary, statistical purposes, appearance and emergency-assistance exceptions. The statistical and appearance exceptions still require clear information and a simple, free means of objecting. They are not a general licence for advertising, profiling or cross-site tracking.
5. “Analytics” is not a legal category that automatically avoids consent
A statistical-purpose exception can apply only where the statutory conditions are met. The legal analysis follows the actual purpose and operation of the technology, not the vendor label. If a tool also supports advertising, behavioural profiling, audience building or another purpose outside the exception, the business should not assume that calling it analytics removes the consent requirement.
6. Cookie information should come from a technology inventory, not a copied table
- Identify what fires on first visit, after consent, after sign-in and after checkout.
- Map first-party and third-party technologies, purposes, duration and data sharing.
- Classify each use against the relevant PECR rule or exception.
- Make sure non-exempt technologies do not activate before valid consent where consent is required.
- Provide a practical way to withdraw consent or object where the applicable exception requires an objection mechanism.
- Recheck the inventory when the analytics, advertising, consent-management or product stack changes.
7. Privacy information and cookie information overlap, but they answer different questions
A privacy notice explains how personal data is processed: purposes, lawful bases, recipients, retention, transfers, rights and contact details. Under UK GDPR Articles 13 and 14, a controller must ordinarily provide specified information when collecting personal data, or at the applicable later point when obtaining it indirectly, subject to the statutory rules and exceptions. This duty applies to the information and its delivery—not to a prescribed webpage title. Cookie information addresses storage/access under PECR. The same tool can trigger both regimes, and a Cookie Policy alone cannot replace UK GDPR transparency.
8. Online sales create a separate consumer-contract layer
Where the site takes orders from consumers, the business should map the contracting journey: information displayed before ordering, price, the point at which the consumer becomes bound, cancellation rights/exceptions, digital-content consent where relevant, and fairness of terms. Under the Consumer Contracts Regulations 2013, an electronic order that entails payment needs clear and prominent specified information immediately before the order and an unambiguous acknowledgement of the obligation to pay. A footer link cannot repair disclosures delivered too late; nor can a Website Terms page exclude mandatory consumer rights.
9. Subscription services should distinguish law now in force from future DMCC rules
A subscription website already needs to comply with applicable consumer-contract information and cancellation duties, the Consumer Rights Act 2015 fairness regime and current unfair-commercial-practices law. Chapter 2 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 establishes additional subscription-specific requirements, including pre-contract information, reminder notices and cancellation rights, but the relevant chapter remains prospective as checked on 16 October 2026. Do not describe those new requirements as already in force. Monitor their commencement and implementing guidance before launch or product changes.
Common mistakes and their practical consequences
| Mistake | Practical consequence |
|---|---|
| Copying another company’s Terms | The legal operator, business model, customer relationship, liability allocation and acceptance process may not match your own. |
| Treating all cookies as “essential” | Non-exempt technologies may fire without the consent or objection controls PECR requires. |
| Using a Cookie Policy but no real consent mechanism | Written transparency does not substitute for consent where consent is legally required. |
| Using a Privacy Policy as the Cookie Policy | The business may explain personal-data processing without satisfying the specific PECR transparency/consent position. |
| Putting consumer information only in the Terms | Mandatory pre-contract information may be shown too late or too obscurely in the buying journey. |
| Never updating the documents after adding new vendors | The written documents and actual technology stack can diverge quickly. |
| Assuming a company-registration footer meets every online-service disclosure rule | An information society service may also owe provider-contact and electronic-contracting disclosures under the E-Commerce Regulations. |
| Treating forthcoming subscription provisions as already in force | The site may confuse current consumer-law duties with uncommenced DMCC subscription provisions. |
How StartWise® Drafting fits
For a reasonably standard website where the legal position is already understood, StartWise® can help with the documentation step. Choose the relevant document, answer guided questions, generate a tailored first draft and review any Drafting Notes. Drafting Notes can make assumptions, decisions and completion points more visible, but they are not legal advice and do not identify every possible issue.
Current UK documents include Website Terms of Use, Cookie Policy and Privacy Policy. The business remains responsible for accurate inputs, checking that the selected document fits the real service, and implementing the legal rules in the website, checkout and consent layer. Complex ad-tech, children’s services, regulated products, unusual consumer models or cross-border data arrangements may justify lawyer review or separate legal advice and strategy.
Frequently asked questions
Do I legally need Website Terms for a brochure website?
Not necessarily as a document with that exact title. But a limited company can still have mandatory trading disclosures, and terms may be useful if the site creates contractual or usage risk.
Do analytics cookies need consent in the UK in 2026?
Sometimes. A narrow statistical-purpose exception can apply if its statutory conditions are met. Advertising, profiling or other non-statistical uses should not be folded into that exception.
Does a UK commercial website need additional contact details under the E-Commerce Regulations?
Often, if it is an information society service: regulation 6 may require readily accessible identity, geographic address and rapid electronic contact details, with other particulars where applicable. Check the provider and the precise service.
Can I use one document for Terms, Privacy and Cookies?
Not necessarily. UK law distinguishes the functions rather than requiring three separately titled pages in every case. A clear, accessible combined notice can sometimes give the necessary information, but UK GDPR privacy transparency, PECR consent or objection mechanisms and contractual incorporation still have to work independently. Separate, linked pages are often easier to maintain.
Do cookie rules apply to mobile apps?
Yes. PECR can apply to storage/access technologies used in apps and connected devices, not just browser cookies.
If my cookie banner is compliant, is my website compliant?
No. The site may still have company, consumer, privacy, contractual, accessibility, advertising or sector-specific obligations.
Are the DMCC subscription-contract rules already in force in October 2026?
No. The specific subscription-contract chapter remained prospective as checked on 16 October 2026. Existing consumer and contract rules still apply to current subscriptions. Check commencement and implementing guidance before relying on the new regime.
Can StartWise® tell me whether my ad-tech setup is lawful?
StartWise® is a guided drafting product, not legal advice. It can help create documents from your inputs, but complex ad-tech or regulatory classification should be analysed separately.
Author, legal-review and update information
Author / reviewer: Gabriel C. Mbanefo — Solicitor of the Senior Courts of England and Wales; Director, Entrepreneur Legal Ltd (Entrepreneur Legal UK). Author/profile: https://uk.entrep.legal/about/. Confirm final editorial approval before publishing.
Planned publication date: 20 October 2026.
Current source-check date: 16 October 2026 (verified authorities identified in the updated source register; final check on 20 October).
Jurisdiction statement: General UK information, not legal advice. Consumer-contract, company and other obligations depend on the service and may differ across England and Wales, Scotland and Northern Ireland. Different rules can apply to regulated and cross-border services.
Sources and related Entrepreneur Legal resources
Choose the right next step
Map the website first. Then draft the documents.
For a reasonably standard website where the legal and technical position is understood, explore the current guided UK documents through StartWise. Use separate legal support where consumer, ad-tech, children, regulated-service or cross-border issues require individual analysis.
