What Must a UK Business Website Include by Law? 2026 Checklist + Free Check

Under UK website legal requirements, every business website must show who is behind it: your business name, a geographic address, an email address and, if you have one, your VAT number. Limited companies must also show their registered number and registered office, and any site that collects personal data or uses non-essential cookies needs a privacy notice and proper cookie controls. Sell online, publish reviews or run a service business and a few more rules apply.

Most small business owners have never been told this, and many websites, including expensive ones, miss at least one item. The good news: fixing it usually takes an afternoon. This checklist explains the website legal requirements in the UK in plain English, shows which ones apply to your type of business, and ends with a two-minute interactive check you can run on your own site.

Website legal requirements: which rules apply to your business?

The rules stack up depending on what kind of business you are and what your website does. Find your column, then read the sections that apply.

These rules are not new, but they have been joined by recent changes that affect almost every small business site: the Data (Use and Access) Act changes to cookies from February 2026 and the Digital Markets, Competition and Consumers Act rules on fake reviews and hidden fees from April 2025.

Who you are: the details every business website must show

Regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 applies to almost any business that promotes or sells its services online. Your website must make these details “easily, directly and permanently accessible”:

• Your name. The legal name of the person or company running the business, not just a trading name.
• A geographic address. A real address where you are established. A PO box on its own is not enough.
• Contact details that allow rapid, direct contact, including an email address. The regulation names email specifically, so a contact form on its own is not enough.
• Trade or professional registers you belong to, with your registration number (for example Gas Safe, a professional body, or a trade association whose code you follow).
• Your VAT number, if you are VAT-registered.
• Clear prices. If you show prices, say whether they include VAT and delivery.

Extra rules for limited companies and LLPs

If you trade as a limited company, the Companies (Trading Disclosures) Regulations 2008 require your website to show:

1. Your registered company name, exactly as it appears at Companies House.
2. Your company registration number.
3. Your registered office address.
4. The part of the UK where the company is registered (for example “Registered in England and Wales”).

Limited liability partnerships have equivalent requirements. One line in the footer covers it:

A common mistake is showing only the trading name (“Acme Roofing”) with no company details. Another is a registered office that changed years ago on Companies House but never on the website. It takes a minute to check your company on the free Companies House register.

Sole traders and partnerships

Sole traders do not have a company number to show, but the e-commerce rules still require your name and a geographic address. If you trade under a business name, the clearest approach is “Jane Smith trading as Smith Garden Design”. The business names rules in Part 41 of the Companies Act 2006 also require your name and an address on business letters, orders, invoices and receipts, so it is sensible to be consistent across your website and your paperwork.

Worried about showing your home address? You can use a business address where you can receive post, such as a virtual office or a registered address service, as long as it is a genuine geographic address where you can be contacted.

Service businesses and trades

If you sell services (building, plumbing, hairdressing, consultancy, cleaning, photography and so on), the Provision of Services Regulations 2009 add more. You must make this information available to customers, and your website is the easiest place to do it:

• Your legal status and form (sole trader, partnership, limited company).
• Your general terms and conditions, if you use them.
• Any after-sales guarantee you offer beyond what the law requires (for example a 10-year workmanship guarantee).
• Your price, if it is fixed in advance, or how you work it out (day rate, free quote after a survey, call-out fee).
• The main features of the service, if they are not obvious.
• Details of professional liability insurance, where your profession requires it, including where it covers you.

This is also good selling. A clear “How we price” section and a written guarantee answer the questions customers are too polite to ask, and they are exactly what nervous buyers look for before picking up the phone.

Privacy notices and the ICO fee

If your website collects personal data, and a simple contact form does, UK GDPR requires a privacy notice: who you are, what you collect, why, how long you keep it, who you share it with, and people’s rights. Link to it from every page and next to every form. The ICO’s hub for small organisations has free tools and guidance to help you write one.

Many businesses that handle personal data electronically must also pay the ICO data protection fee. For micro businesses (up to 10 staff or turnover up to £632,000) it is £52 a year, with £5 off by direct debit; small and medium organisations pay £78. Plenty of small businesses are exempt, for example if they only use personal data for their own accounts, staff administration or marketing their own business, but using CCTV or other processing can change that. The ICO’s online self-assessment gives you the answer in a couple of minutes.

Cookies after the February 2026 changes

Cookies are covered by the Privacy and Electronic Communications Regulations (PECR). The rules changed on 5 February 2026 under the Data (Use and Access) Act:

The practical trap for small businesses is plugins and embeds that load trackers you never chose: a Facebook pixel added years ago, a map, a chat widget, a video. Open your site in a private browser window and check what loads before any cookie banner appears.

Marketing emails and sign-up forms

If your website has a newsletter sign-up or you email customers about offers, PECR applies here too. Individuals, including sole traders and some partnerships, need to have given consent, or you must meet the “soft opt-in” conditions (you got their details during a sale or negotiation, you market similar services, and they could refuse at the time and in every message). Emails to limited companies and other corporate bodies do not need consent, but you must never hide who you are and must always give a working way to opt out (ICO guidance on business-to-business marketing).

Selling online and pricing

If customers can buy or book and pay on your website, the Consumer Contracts Regulations 2013 apply to your sales to consumers. Before they pay you must give clear information about the product or service, the total price, delivery, your identity and address, and their right to cancel. For most distance sales, consumers get 14 days to cancel, and you should explain how, ideally with a model cancellation form.

Since 6 April 2025, under the Digital Markets, Competition and Consumers Act, “drip pricing” is banned: any mandatory fee (a booking fee, a compulsory call-out charge, an admin fee) must be included in the headline price, not added at checkout. Optional extras can still be shown separately. The Competition and Markets Authority can now fine businesses directly, up to 10% of global turnover.

Reviews, testimonials and the claims you make

Also since 6 April 2025, it is a banned practice to write, commission or publish fake reviews, or to present incentivised reviews without making the incentive clear. If your website publishes customer reviews, you must take reasonable and proportionate steps to prevent and remove fake ones (CMS summary of the new rules).

• Only publish reviews from real customers, and keep a record of where each one came from.
• Do not quietly drop the bad ones if you present your reviews as a complete picture.
• If you gave a discount or a prize draw entry for leaving a review, say so.

The claims around your reviews matter too. Since 2011 the Advertising Standards Authority’s rules apply to marketing on your own website, not just to paid adverts. “London’s best-rated roofer”, “cheapest in Essex” or “100% satisfaction” need evidence you could show if a competitor complained.

Accessibility

The Equality Act 2010 requires every service provider, whatever its size, to make reasonable adjustments so disabled people are not put at a substantial disadvantage. The Act does not name a technical standard for websites, but readable text, good colour contrast, image descriptions, forms that work with a keyboard and a site that works when zoomed are sensible, low-cost basics. The Web Content Accessibility Guidelines (WCAG) are the usual benchmark.

If you sell online to consumers in the EU, the European Accessibility Act has applied since 28 June 2025, including to UK-based businesses. Microenterprises with fewer than 10 staff and under €2 million turnover are exempt from some of its requirements.

What a compliant footer looks like

You do not need a wall of legal text. For most small businesses, a well-built footer plus three short pages (privacy, cookies, terms) covers the essentials.

Free 2-minute website legal check

Answer a few questions about your business to see which website legal requirements apply to you, then tick what your website already shows. The check builds your personal list and tells you what is missing. Nothing you enter leaves your browser.

The 8 most common mistakes we see

Planning a new website? Our UK website cost guide explains what you should pay and which hidden costs to look for, and our ready-made website guide covers the fastest route to a professional, compliant site.

Website legal requirements: frequently asked questions

Do I legally need a privacy policy on my website?

If your website collects any personal data, including names and emails through a contact form, or uses analytics that identify visitors, you need to tell people how you use it. In practice that means a privacy notice linked from every page and next to your forms.

Do I need a cookie banner in 2026?

Only if your site uses cookies that still need consent, such as advertising, remarketing or social media tracking. Since 5 February 2026, cookies used only for measuring your own site’s use, and cookies that remember display preferences, can be set without consent if you explain them and offer an easy opt-out.

Do I have to show my home address on my website as a sole trader?

You must show a geographic address where you can be contacted, but it does not have to be your home. A business address or a registered address service is fine, as long as post really reaches you there.

Where should my company number go on my website?

Anywhere it is easy to find is acceptable. Most businesses put their registered name, company number, registered office and place of registration in the footer so it appears on every page.

Can I publish testimonials from customers?

Yes, as long as they are genuine, you can show where they came from, and any incentive for leaving them is made clear. Writing or buying fake reviews has been a banned practice since April 2025.

What happens if my website does not comply?

For most small businesses the first consequence is a complaint, a request from a regulator to fix something, or a customer who does not trust you enough to buy. Serious or deliberate breaches can lead to enforcement and fines, which for consumer law can now reach 10% of global turnover.

Is this legal advice?

No. This guide is general information to help you ask the right questions. If your business is regulated, sells high-value goods online or handles sensitive data, speak to a solicitor or your trade body.

Sources

1. Electronic Commerce (EC Directive) Regulations 2002, regulation 6.
2. Companies (Trading Disclosures) Regulations 2008; Companies Act 2006, Part 41 (business names).
3. Provision of Services Regulations 2009, regulation 8.
4. Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.
5. ICO: data protection fee, business-to-business marketing, advice for small organisations.
6. Clifford Chance, Key aspects of the Data (Use and Access) Act take effect (February 2026).
7. CMS, The DMCC Act: consumer elements in force from 6 April 2025.
8. ASA, Remit: own websites.
9. GOV.UK, Equality Act: disability quick start guide for service providers; Travers Smith, The European Accessibility Act now applies.