Website legal requirements at a glance

Founder scenario: a website launch is more than “Terms + Privacy”

A UK SaaS startup launches a new website. It is a private limited company, collects names and account data, uses analytics and advertising pixels, takes recurring card payments from consumers, publishes customer reviews and lets users post content. The founder asks for “website terms and a privacy policy.” Those documents matter, but the legal exercise is broader: corporate disclosures, provider information, privacy transparency, cookie controls, consumer checkout rules, fair terms, marketing practices, accessibility and potentially the Online Safety Act can all sit behind the same website.

The useful sequence is to map what the website actually does, identify the laws triggered by those functions and then choose the documents and product controls that implement the result.

1. A UK company website must disclose its legal identity

The Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015 require companies to display their registered name on their websites. They also require websites to disclose the part of the United Kingdom in which the company is registered, its registered number and its registered office address, together with certain additional particulars for specific company types. These requirements apply to the legal operator, not merely the brand name shown in the header.

That information is often placed in the website footer or a legal-information/contact page, but it should be easy to find and kept accurate when the registered office or company details change.

2. Online service providers can have additional identity and contracting disclosures

The Electronic Commerce (EC Directive) Regulations 2002 require providers of information society services to make specified information easily, directly and permanently accessible. Depending on the business, this can include the provider’s name, geographic address, email/contact details, public-register information, authorisation or professional details and VAT identification number. The Regulations also contain rules for electronic contracting, including information about the technical steps used to conclude a contract.

This is one reason a bare trading name and contact form may not be enough for a commercial online service.

3. If the website processes personal data, privacy information is a legal requirement

The UK GDPR and Data Protection Act 2018 require organisations to process personal data lawfully, fairly and transparently. Articles 13 and 14 of the UK GDPR require controllers to provide specified privacy information when data is collected directly or obtained from elsewhere, subject to the applicable rules and exceptions. The Data (Use and Access) Act 2025 amended parts of that transparency framework and all of its data-protection stages are now in force.

A website privacy notice should therefore reflect the real data map: what is collected, purposes, lawful bases, recipients, retention, international transfers where relevant, individual rights and contact arrangements. A generic policy that does not match analytics, CRM, payments, support tools or advertising practices can be misleading as well as operationally unhelpful.

4. Cookie and tracking rules changed in 2025–26, so avoid old blanket statements

PECR regulation 6 governs storing information on, or accessing information from, a user’s device. Consent remains required unless a statutory exception applies. Following the Data (Use and Access) Act 2025, the framework now contains five exceptions, so the old shorthand that every “non-essential” cookie automatically needs consent is too broad. The correct analysis depends on the purpose and conditions of the relevant exception.

Advertising pixels, behavioural tracking and similar technologies still require careful analysis. Businesses should use the ICO’s final April 2026 storage-and-access-technologies guidance rather than relying on an outdated cookie-banner template.

5. Online consumer sales need more than a refund paragraph

If the website sells goods, services or digital content to consumers at a distance, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 can require substantial pre-contract information. Where an electronic order creates an obligation to pay, the trader must make specified information clear and prominent immediately before the order, obtain an explicit acknowledgement of the payment obligation and use an appropriately labelled order button or equivalent function.

Cancellation rights, delivery rules and exceptions depend on the transaction. Separately, the Consumer Rights Act 2015 protects statutory rights and requires consumer terms and notices to be fair and transparent. Website Terms cannot remove rights that consumer law makes non-excludable.

6. Pricing, promotions and reviews are now squarely within the DMCC consumer regime

The unfair-commercial-practices provisions of the Digital Markets, Competition and Consumers Act 2024 have applied to commercial practices from 6 April 2025. They replace and update the previous Consumer Protection from Unfair Trading Regulations framework. The regime includes rules on misleading actions and omissions, more detailed treatment of drip pricing and specific banned practices concerning fake or misleading consumer reviews.

That means compliance is not achieved by hiding qualifications in Website Terms. Material price information, limitations and other facts that influence a consumer’s decision must be presented appropriately in the buying journey, and review systems need reasonable and proportionate controls. See the CMA unfair-commercial-practices guidance.

7. Subscription websites should distinguish current law from the future DMCC subscription regime

Recurring-payment and subscription models already engage consumer-contract, fairness and unfair-commercial-practices rules. The DMCC Act also creates a new dedicated subscription-contract regime covering matters such as pre-contract information, reminder notices and cancellation, but the government’s current guidance expects those dedicated rules to come into force in Spring 2027. They should not be described as current law in a September 2026 article.

A business preparing a subscription product now should therefore comply with the law currently in force and monitor the 2027 implementation timetable rather than building its checkout around a future rule that has not yet commenced. See GOV.UK guidance on writing a fair contract for customers.

8. Website accessibility can be a legal issue, not just a design preference

In Great Britain, the Equality Act 2010 imposes duties on providers of services to the public, including an anticipatory duty to make reasonable adjustments for disabled people. The updated 2026 services Code of Practice explains that service providers should take positive steps to address barriers in advance. For private-sector websites, the law does not simply impose one universal technical standard on every site, but inaccessible digital services can still create legal risk.

Northern Ireland has a separate disability-discrimination framework. The Equality Commission for Northern Ireland confirms that disability protections apply when people buy or use services online as well as in person. Businesses serving the whole UK should therefore avoid treating Great Britain and Northern Ireland as legally identical.

9. User-generated content and search can trigger the Online Safety Act

A standard brochure or e-commerce website is not automatically an Online Safety Act service. But providers of in-scope user-to-user and search services with links to the UK can have risk-assessment, safety, reporting, complaints, terms and record-keeping duties. Ofcom’s 2026 guidance also requires in-scope services to assess whether they are likely to be accessed by children and, where they are, to comply with additional child-safety duties.

Startups adding community posts, messaging, reviews with social features, creator uploads or search functionality should therefore assess scope before assuming ordinary Website Terms are the whole answer. See Ofcom’s protection-of-children guidance.

10. Website Terms are often useful, but they are not a universal statutory page

Website Terms can govern account use, intellectual property, licences to user content, acceptable use, suspension, disclaimers, liability allocation, governing law and dispute processes. For consumer transactions, however, contractual drafting sits underneath mandatory statutory rights and fairness rules. For B2B sites, the legal and commercial balance can be different again.

Treat Website Terms as one implementation layer, not as a substitute for privacy, cookie, consumer, corporate or platform compliance.

A practical UK website launch checklist

• Identify the legal operator and display the correct company/LLP details where required.
• Check whether the E-Commerce Regulations require additional provider, regulatory or VAT information.
• Map all personal data collected directly and automatically and publish privacy information that matches the processing.
• Inventory cookies, pixels, SDKs and other storage/access technologies; identify consent requirements and statutory exceptions.
• If selling to consumers, map required pre-contract, price, order-button, cancellation, delivery and refund information.
• Review consumer terms for fairness and make sure statutory rights are not excluded or obscured.
• Review headline prices, promotions and consumer reviews under the current DMCC unfair-commercial-practices regime.
• Assess accessibility barriers and reasonable adjustments, including the separate Northern Ireland framework where relevant.
• If users can upload/share content or the service provides search, assess Online Safety Act scope and Ofcom duties.
• Choose Website Terms, Privacy Policy, Cookie Policy and refund/cancellation documents only after the operational map is clear.
• Recheck the legal position when the website adds new tracking, subscriptions, user-generated content, children’s features or new markets.

Common mistakes and practical consequences

How StartWise™ Drafting fits

StartWise currently includes UK Privacy Policy, Website Terms of Use, Cookie Policy and Refund and Cancellation Policy documents. For a reasonably standard website where the business has mapped its data, customer journey and legal scope, guided questions can support a tailored first draft and Drafting Notes.

StartWise does not determine which laws apply to a business, perform a cookie or Online Safety Act audit, decide whether consumer terms are fair, or resolve complex privacy, accessibility, regulated-sector or cross-border issues. Those questions may require legal or specialist support before drafting.

Choose the route that fits the issue

Frequently asked questions

Does every UK website need Terms and Conditions?

No. There is no single rule requiring every website to publish a page with that title. Terms are often commercially useful for accounts, content, transactions and risk allocation, but other statutory duties can apply whether or not Terms exist.

Is a Privacy Policy mandatory for a UK website?

If the business processes personal data and UK GDPR transparency duties apply, it must provide the required privacy information. The law requires the information, not necessarily a document carrying the exact title “Privacy Policy”.

Does every UK website need a cookie banner?

No. PECR prohibits storage/access unless an exception applies. Following the Data (Use and Access) Act 2025 there are five statutory exceptions, so the correct consent design depends on what each technology does. Advertising and behavioural tracking still require particular care.

Does a UK limited company need its company number on the website?

Yes. The current trading-disclosure regulations require a company website to display its registered name and specified particulars including the part of the UK in which it is registered, its registered number and registered-office address.

Do online shops have to give consumers cancellation information?

Often yes for distance consumer contracts, subject to the transaction and statutory exceptions. The Consumer Contracts Regulations require extensive pre-contract information and contain rules on electronic ordering and cancellation rights.

Is WCAG legally mandatory for every private UK business website?

Not as a single universal private-sector rule. In Great Britain, service providers have Equality Act duties including reasonable adjustments; Northern Ireland has separate disability-discrimination law. Technical accessibility standards can still be an important way to reduce legal and practical barriers.

Does the Online Safety Act apply to every business website?

No. It principally targets in-scope user-to-user, search and certain pornographic-content services with links to the UK. A normal brochure site is not automatically covered, but platforms, communities and search features should assess scope.

Can StartWise tell me whether my website is legally compliant?

No. StartWise provides guided drafting for available documents. Applicability, regulatory scope and complex compliance questions must be assessed separately.

Sources and further reading

• Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015, especially regs. 24–25
• Electronic Commerce (EC Directive) Regulations 2002, especially regs. 6 and 9
• Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, especially regs. 13–14
• Consumer Rights Act 2015
• Digital Markets, Competition and Consumers Act 2024; CMA unfair-commercial-practices guidance
• UK GDPR Articles 13–14 and Data (Use and Access) Act 2025 changes
• ICO final guidance on storage and access technologies (29 April 2026)
• Equality Act 2010 services/reasonable-adjustment framework and 2026 Code of Practice
• Equality Commission for Northern Ireland: disability discrimination in services
• Online Safety Act 2023 and Ofcom protection-of-children duties
• Entrepreneur Legal UK: What Legal Documents Does a UK Startup Need? (2026 Guide)
• Entrepreneur Legal UK: Legal Document Template vs AI vs Guided Drafting
• Entrepreneur Legal UK: Commercial Agreements
• StartWise UK Access
• Author profile: Gabriel Mbanefo / Entrepreneur Legal UK

Disclaimer

General information only. Not legal advice. StartWise™ Drafting is not legal advice, lawyer review, legal approval or legal sign-off. Creating an account, purchasing drafting credits or generating a document does not by itself create a lawyer-client relationship. Entrepreneur Legal UK is the trading name of Entrepreneur Legal Ltd. Entrepreneur Legal Ltd is not regulated by the Solicitors Regulation Authority and does not carry on reserved legal activities.