Website Legal Requirements: What Must a Business Site Show?

What are the website legal requirements for a business?

Website legal requirements are the rules that tell a business which identity details, privacy information and cookie choices its site must show. In the UK, they come from company law, the e-commerce regulations, UK GDPR and PECR. Other countries differ, so a site serving several markets needs a check for each one.

This guide is general information, not legal advice, so ask a solicitor, an attorney or your accountant about your own case. We checked each point against the official text, but rules change. Because of that, we name the source for every point, and we never quote penalty amounts.

Read it in three passes. First, find which rules fit your business. Then compare your site with the tables. Finally, run the 10-minute audit near the end.

Which rules apply to your website, and in what order do you check them?

Start with who you are, then what the site does, then what data it collects. Each answer switches on a different group of rules.

1. Establishment: the country where your business is established decides which identity rules apply first.
2. Legal form: a limited company, a sole trader and a partnership face different rules, so this answer narrows the list.
3. Function: selling, taking bookings and simply informing visitors also trigger different duties.
4. Data: for example, forms, newsletters, chat widgets and analytics all collect personal data or set cookies.
5. Visitors: this matters because some privacy laws follow the visitor, not the business.

Where these details sit on the page is a design decision. In our business website design services, we plan the footer, the contact page and the legal pages at the start. So nothing gets bolted on at the end.

One limit applies to this guide. If you sell to consumers online, additional consumer-contract information rules apply, and we do not cover them here.

Which website legal requirements apply to a UK limited company?

A UK company must put its registered name on its website. Regulation 24 of the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations says that every company shall disclose its registered name on its websites. Regulation 25 then adds further particulars for business letters, order forms and websites:

• The part of the UK where the company is registered
• The registered number
• The address of the registered office
• For a limited company that does not use "limited" in its name, the fact that it is a limited company
• For a community interest company that is not a public company, the fact that it is a limited company
• For an investment company, the fact that it is one.

If you show your share capital, regulation 25 also says the figure must be the paid-up amount. In addition, GOV.UK gives the same core list in plain English on its page about signs, stationery and promotional material. You can read the legal text in regulation 25 on legislation.gov.uk.

Use the registered office address here, not your trading address. The rule asks for the registered office specifically. If your trading address differs, you can show both. However, label each one.

If you work from home and worry about your privacy, talk to your solicitor about your options before you change anything. The site must stay consistent with your official records.

What do the UK online service regulations add?

The Electronic Commerce (EC Directive) Regulations 2002 apply to a service provider, which means any person providing an information society service. The law defines that term by reference to EU rules. In other words, it covers services normally provided for payment, at a distance, by electronic means, at a user's individual request.

Whether a particular site fits is a legal question. However, publishing the details below is the low-risk habit. Regulation 6 lists them:

• Your name
• The geographic address where you are established
• Contact details that let people reach you quickly and directly, including your email address
• If you are on a trade or similar public register, the register and your registration number
• If an authorization scheme applies, the details of the supervisory authority
• If you practice a regulated profession, your professional body, your title and the professional rules that apply
• If your activity is subject to VAT, your VAT number.

Regulation 6 also wants this information in a form and manner that is easily, directly and permanently accessible. It also says that if you show prices, you must state them clearly and say whether they include tax and delivery costs.

Which UK details go on the page, where, and on what basis?

The table sums up the two instruments above. Specifically, the third column names the legal basis, while the second column shows common practice, not a rule.

Do sole traders and partnerships follow the same rules?

Not in the same way, because regulations 24 and 25 speak of every company. So they are written for companies. Sole traders and partnerships follow separate business name rules, and GOV.UK covers those on its own pages. Ask your solicitor which ones apply to you.

However, the online service rules are wider. Regulation 6 covers any person providing an information society service. As a result, a sole trader with a qualifying site still shows a name, a geographic address and an email address.

In practice, we suggest the same identity block for every business type. It also builds trust, and it keeps your options open if you incorporate later.

What does a UK privacy notice need to say?

Because your site may collect personal data, UK GDPR requires you to tell people what you do with it. Articles 13 and 14 set the minimum content, and the ICO explains them as the right to be informed. Article 13 applies when you collect data directly from the person, for example through a contact form.

• Your identity and contact details, and your data protection officer's if you have one
• Why you process the data and your lawful basis
• Your legitimate interests, if that is the basis
• Who receives the data, and any transfers outside the UK
• How long you keep it
• People's rights, including the right to withdraw consent and the right to complain
• Whether providing the data is a legal or contractual requirement
• Any automated decision-making, including profiling.

The ICO says the information must be concise, transparent, intelligible and easily accessible, in clear and plain language. It prescribes no format, so layered notices work. In practice, for direct collection, you give the information when you obtain the data. The ICO reviews its guidance, so read the current version before you draft.

How do the UK cookie rules work under PECR?

Regulation 6 of the Privacy and Electronic Communications Regulations stops you from storing or accessing information on a visitor's device unless an exemption applies. Schedule A1 sets out the exemptions and the conditions. Cookies are the best-known example, but the rule also covers similar technologies.

Where no exemption applies, you then need consent. Consent needs clear and comprehensive information about the purpose, and then the visitor's agreement. Instead, some exemptions ask only for clear information and a simple, free way to object.

The ICO's guidance on storage and access technologies is the first stop. It also explains when consent is needed, what clear and comprehensive information means, and which uses are exempt.

Which cookie purposes need consent and which do not?

The table follows Schedule A1 in simplified form. That said, check the ICO guidance for the exact conditions before you rely on an exemption.

A banner only helps if the tools behind it respect the choice. So test that advertising scripts stay off until the visitor agrees.

Are there website legal requirements in the US as well?

There is no single nationwide rule that matches the UK or German imprint duties, as far as we know. Requirements come mostly from state privacy laws, consumer protection rules and industry rules. We cannot cover them all, so treat this section as a starting point and ask a US attorney.

For example, California's Online Privacy Protection Act, usually called CalOPPA, covers commercial sites. Under Business and Professions Code sections 22575 to 22579, operators of commercial websites or online services that collect personally identifiable information from California consumers must conspicuously post a privacy policy. The policy names the categories of information collected and the categories of third parties that may receive it.

The California Attorney General explains the law on its Privacy Laws page. Also, other states have their own privacy statutes, and some apply by the visitor's state, not yours.

What about visitors from other countries?

Every country sets its own rules, so check local law for each market you serve. Germany is a useful example because its rules are specific. Section 5 of the Digitale-Dienste-Gesetz asks providers of business digital services to keep their name, address, contact details with an email, register details and similar items easy to recognize, directly reachable and permanently available.

The EU also sets common privacy rules through the GDPR. Do not copy another country's imprint into your site and assume it covers you. Instead, ask a local adviser for each target market.

How do the three markets compare?

The table shows what to check first in each market and where to read the official source.

Where should each detail sit on the page?

The law rarely tells you which page to use, so only the wording about being easily accessible guides you. The following layout is common practice, not a rule.

• Footer: company name, registered number, registered office address, email, phone, and links to the legal pages on every page
• Contact page: address, email, phone and, where relevant, VAT number and register details
• Privacy page: the full privacy notice, with a link beside every form
• Cookie information: a short notice on the first visit and a permanent link to change choices.

A footer block can follow this pattern; replace each bracket with your own details:

• Company name: [registered name]
• Registered in: [England and Wales, Scotland or Northern Ireland]
• Registered number: [number]
• Registered office: [address]
• Email: [address], phone: [number].

Write these details as text, not as an image, because screen readers cannot read text inside an image. Visitors cannot copy it either. Also check the contrast of small footer text with our free color contrast checker.

How do you check your website legal requirements in 10 minutes?

These eight steps take about ten minutes when your company documents are at hand. As a result, you catch gaps before a customer or a regulator does.

1. First, open the home page on a phone and on a computer. Look for the company name, address, email and phone in the footer.
2. Next, compare the name and the registered office address with your company record.
3. Then check that the registered number and the part of the UK where you are registered appear.
4. Open every form and look for a privacy notice link next to the submit button.
5. After that, open the site in a private window and look at which cookies load before you agree to anything. Our free website technology checker lists the tools your pages load.
6. Click every footer link, because our free broken link checker catches dead pages.
7. Read the privacy notice against the tools you actually use.
8. Finally, write down the gaps in order of importance.

Which gaps show up most often, and what do you fix first?

Check this first: stale details. A moved office, a renamed company or a closed phone line is the easiest gap to miss and the easiest to fix. Then work down the list.

1. Stale company details: match the name, registered office and numbers to your official record
2. Forms without a privacy notice: add the link next to every submit button
3. A copied privacy notice: text from another site rarely matches your tools and data flows, so rewrite it for your real setup
4. Cookie information that does not match reality: compare the notice with the tools that load
5. Contact details as images: turn them into text
6. A trading address in place of the registered office: add the registered office address.

The logic is simple. First close the gaps that every visitor can see. Then move on to deeper topics such as data flows.

Do contact forms and CAPTCHAs change your privacy notice?

Often, yes. Some verification services send a visitor's device and browser data to a third party. Check each service's official documentation, because services differ in what they process.

As a result, your privacy notice and cookie information should describe what really runs on the form. We compare the main options in our guide on how to stop contact form spam. That article also points back here for the privacy side.

What happens to your legal pages when you rebuild or migrate?

Legal pages are the easiest part to lose during a move because they sit in the footer, bring no traffic and rarely get tested. If they go missing, however, the new site loses its company details, privacy notice and cookie information.

• List every legal page and footer block on the old site
• Confirm that each one is current, and do not carry over outdated text
• Redirect old addresses to the new ones when they change
• Test the forms and the cookie banner on the new site before launch.

If you are leaving Wix, our guide on how to migrate from Wix and transfer your domain covers the full move. Finally, for the last steps, use the website launch checklist.

Which trust details go beyond the legal minimum?

Some details are not in any regulation. However, they help visitors decide. Think of them as good practice, not as obligations.

• An about page that shows who you are and how you work
• A real address, opening hours and a map
• References and reviews you have permission to show
• Clear delivery, return and cancellation terms if you sell online
• An accessibility statement that shows what you do for every visitor.

We explain how to write the first of these in our guide on how to write an about us page. Our article on website trust signals covers the rest. In addition, for accessibility, read what web accessibility and WCAG mean. For the technical side of privacy, see our guide to a GDPR compliant website.

How do you keep your website legal requirements current?

Update the site on the same day your company details change. Make that a fixed step in your process. Otherwise the website quietly drifts away from your official record.

• Company name, registered office address or registered number changes
• New phone line, email address or professional registration
• A new form, analytics tool or advertising tool on the site.

Keep the details in one place so the footer and the contact page draw from the same source. In addition, save a dated copy of your legal pages before you change them. Our free website history tool shows older versions of a site.

What does an example audit look like?

This is an example scenario, not a real client. A small UK consultancy runs as a limited company. Its site has a contact form and an analytics tool, and it sells nothing online.

1. First, the owner checks the footer and finds the old trading address instead of the registered office.
2. Then she adds the company name, registered number, registered office address and the part of the UK where it is registered.
3. Next, she lists an email and a phone number on the contact page.
4. After that, she links a privacy notice next to the form.
5. She also places the analytics tool behind the cookie choices and updates the cookie information.
6. Finally, she asks her solicitor to read the texts and publishes the update.

If the firm later starts taking bookings online, the checklist grows. So it should return to this list before it adds any new feature.

What is the final checklist?

Before you publish, you should be able to answer yes to every line. Otherwise, ask your solicitor or accountant.

• The registered company name appears on the site
• The registered number and the part of the UK of registration appear
• The registered office address appears, not only a trading address
• An email address and a second way to contact you appear as text
• VAT number, register details and regulated profession details appear where they apply
• Every form has a privacy notice link next to it
• Cookie information matches the tools that actually load
• No footer link is broken.

This list is not legal advice, so use it as a starting point, not as the final word.

Would you like us to build and maintain this for you?

As Talha Aslan and team, we are not a law firm or an accounting practice. Your solicitor writes the legal texts. Instead, we design, build, migrate and manage your website, and we place the company details, the contact block, the form links and the cookie choices where they belong.

We are not a hosting or email provider, so we work with the setup you already have. We do not promise prices or delivery times in advance, because every scope differs. Tell us about your project, and request a quote for web design services.