Legal & Compliance9 Nov 2026 · 12 min read

UK Website Legal Requirements 2026: What You Actually Need

Privacy policy. Cookie banner. Terms and conditions. You have been told you need all three — but do you? And if so, what exactly must they say? This is the plain English answer, covering every UK law that applies to business websites in 2026.

Get a GDPR-compliant website View our services

The short answer

Every UK website needs these three things

UK GDPR / Data Protection Act 2018

If you collect any personal data — which includes contact forms, analytics, and cookies

Cookie Consent Banner

PECR (Privacy and Electronic Communications Regulations)

If your site uses non-essential cookies — which includes Google Analytics, Facebook Pixel, and most marketing scripts

Terms & Conditions

Consumer Contracts Regulations 2013 / Consumer Rights Act 2015

Not mandated by a single law, but legally essential in practice — especially for ecommerce

Privacy Policy

Required under: UK GDPR & Data Protection Act 2018

A privacy policy is legally required on any UK website that collects personal data. Under UK GDPR, personal data includes far more than names and email addresses — it covers IP addresses, cookie identifiers, location data, and any information that could be used to identify a living individual.

In practical terms: if your site has a contact form, uses Google Analytics, or loads any third-party script that sets a cookie, you are collecting personal data and you need a privacy policy. That covers almost every business website in the UK.

What a UK privacy policy must include

Your identity and contact details

Full legal name, address, email

What data you collect

Names, emails, IPs, cookies, etc.

Lawful basis for processing

Consent, legitimate interest, contract, legal obligation

How long you retain data

Specific retention periods per data type

Third-party sharing

Email platforms, analytics, payment processors

International transfers

If data leaves the UK (e.g. US-hosted services)

User rights

Access, erasure, rectification, objection, portability

How to complain

Right to contact the ICO

Common mistake

Copying a privacy policy from another website is a breach of copyright and almost certainly produces a non-compliant document, since the data you collect will differ from theirs. The ICO provides a free privacy policy generator at ico.org.uk — use it as a starting point, then customise it to reflect exactly what your site does.

Cookie Consent Banner

Required under: PECR (Privacy and Electronic Communications Regulations)

The UK cookie law (PECR) requires you to obtain prior, informed consent before placing any non-essential cookies on a visitor's device. The consent must be active — a pre-ticked box or continuing to use the site does not count.

Which cookies need consent?

Cookie type	Examples	Consent needed?
Strictly necessary	Login session, shopping cart, CSRF tokens	No
Analytics	Google Analytics, Hotjar, Mixpanel	Yes
Marketing / tracking	Facebook Pixel, Google Ads, LinkedIn Insight	Yes
Preferences	Language, font size, remembered form fields	Yes (unless essential)
Third-party embeds	YouTube videos, Google Maps, Calendly	Yes

What a valid cookie banner must do

Appear before any non-essential cookies are set — not after
Give users a genuine choice to accept or reject — the "reject" option must be as easy to find as "accept"
Explain what categories of cookies you use and why
Allow users to change their preferences at any time
Record and store consent so you can prove it was given
Not use dark patterns — no pre-ticked boxes, no guilt-tripping language

ICO enforcement

The ICO has been increasingly active on cookie compliance. In 2023 it issued an enforcement notice against a major UK publisher for non-compliant consent. The ICO's own guidance states that banners which make it harder to reject than accept are non-compliant — a design decision, not a legal grey area.

Terms & Conditions

Required under: Consumer Contracts Regulations 2013 & Consumer Rights Act 2015

No single UK law says "you must have terms and conditions on your website." But multiple laws together make T&Cs legally essential — particularly if you sell goods, services, or digital products online. Without them, you have no written basis to enforce your own policies, and customers retain broader rights than you may expect.

For service businesses

→What is included (and excluded) in your service
→Payment terms and late payment clauses
→Intellectual property ownership
→Limitation of liability
→Cancellation and refund policy
→Dispute resolution process

For ecommerce (additional)

→14-day right to cancel (Consumer Contracts Regs)
→Returns and refund process
→Delivery timescales and costs
→Product descriptions and pricing accuracy
→What happens if an item is out of stock
→No pre-ticked add-ons at checkout

Companies Act 2006 Disclosures

Required for: all UK limited companies

If your business is a UK limited company, the Companies Act 2006 requires specific information to appear on your website — not buried in a footer page, but accessible from the site. This is one of the most commonly overlooked requirements.

Mandatory disclosures for UK Ltd companies

Registered company name

Full legal name as registered at Companies House

Company registration number

The 8-digit number from Companies House

Registered office address

Not necessarily your trading address

Country of registration

e.g. "Registered in England and Wales"

VAT number

If VAT-registered — also required on invoices

ICO registration number

If processing personal data (most businesses)

These disclosures must also appear on all business emails and letters under the Companies Act.

Sector-Specific Legal Requirements

Regulated industries carry additional website obligations beyond the baseline UK GDPR and PECR requirements. These are some of the most commonly missed — and the most likely to attract a regulator's attention.

Law Firms & Solicitors

Regulator: SRA

→Price and service transparency pages (SRA Transparency Rules)
→Complaints procedure published on the site
→Professional indemnity insurance disclosure
→SRA authorisation number displayed

Law firm website design →

Dental Practices

Regulator: GDC / CQC

→GDC registration number for all practising dentists
→CQC registration status
→NHS vs private treatment clarity
→Complaints and patient rights information

Dental practice website design →

Financial Advisors & Mortgage Brokers

Regulator: FCA

→FCA registration number and authorisation status
→"Your home may be repossessed" risk warnings where applicable
→Past performance disclaimers on investment content
→Appointed representative disclosures

Financial advisor website design →

Healthcare Providers

Regulator: CQC

→CQC registration and inspection rating displayed
→Named registered manager
→Patient rights and complaints procedure
→GDPR-specific healthcare data disclosures

Healthcare website design →

Estate & Letting Agents

Regulator: TPO / NAEA

→Redress scheme membership displayed (TPO, PRS, or CEDR)
→Client money protection scheme disclosure
→Fee transparency for letting agents (Tenant Fees Act 2019)
→Anti-money laundering policy

Estate agent website design →

The Complete UK Website Legal Checklist 2026

Use this to audit your existing site or brief your developer before launch.

Every UK website

Privacy policy — covers what data you collect, lawful basis, retention, and user rights
Cookie consent banner — appears before non-essential cookies load
Cookie policy — either separate or part of privacy policy
Companies Act disclosures — registered name, number, address (Ltd companies)
ICO registration number displayed (if processing personal data)
VAT number displayed (if VAT-registered)

Service businesses

Terms and conditions — covering payment, IP, liability, cancellation
Complaints procedure
Professional indemnity disclosure (if applicable)

Ecommerce websites

14-day cancellation rights notice (Consumer Contracts Regulations)
Returns and refund policy — visible before purchase
Delivery timescales and costs — visible before checkout
Product descriptions accurate and not misleading
No pre-ticked extras at checkout
Order confirmation email system in place

Regulated businesses

Regulator registration number displayed (SRA, FCA, GDC, CQC etc.)
Redress scheme membership (estate agents, letting agents)
Required risk warnings and disclaimers
Sector-specific transparency requirements met

What if Your Current Website Is Not Compliant?

Most UK business websites built before 2018 were built before UK GDPR came into force. Many sites built since then still lack a compliant cookie banner, correctly structured privacy policy, or the right Companies Act disclosures. Non-compliance is very common — but it is not a defence if the ICO investigates.

The good news is that legal compliance does not require a full website rebuild. In most cases it means adding or updating specific pages and implementing a cookie consent management platform (CMP) such as Cookiebot, CookieYes, or Usercentrics.

If your site is old enough to have compliance gaps, it may also have performance, SEO, or design issues worth addressing at the same time. Our website redesign service includes a full legal compliance review as part of the discovery process.

Frequently Asked Questions

Is a privacy policy legally required on a UK website?+

Yes, if your website collects any personal data — including names, email addresses, IP addresses, or cookies — a privacy policy is legally required under UK GDPR and the Data Protection Act 2018. This applies to virtually every UK business website, including those that only have a contact form or use Google Analytics.

Do I need a cookie consent banner on my UK website?+

Yes, if your website uses non-essential cookies. Under PECR (Privacy and Electronic Communications Regulations), you must obtain prior, informed consent before placing any cookies that are not strictly necessary to deliver the service. Google Analytics, Facebook Pixel, and most marketing and tracking scripts count as non-essential and require a consent banner. Session cookies that keep a shopping cart working do not.

Are terms and conditions legally required on a UK website?+

Terms and conditions are not mandated by a single UK law, but they are legally necessary in practice. If you sell goods or services online, the Consumer Contracts Regulations 2013 require you to provide specific pre-contract information before the customer buys. For ecommerce, failure to include the required information means customers can cancel orders and get refunds. Without T&Cs you also have no legal basis to enforce your policies on disputes, refunds, or IP ownership.

What must a UK website privacy policy include?+

Under UK GDPR, your privacy policy must include: who you are and your contact details, what personal data you collect, the lawful basis for processing it, how long you keep it, whether you share it with third parties, any international data transfers, and the rights of your users (access, erasure, rectification, objection). It must be written in clear, plain language — not legal jargon.

What if my website does not have a privacy policy?+

Operating without a privacy policy when you collect personal data is a breach of UK GDPR. The ICO (Information Commissioner's Office) can issue fines of up to £17.5 million or 4% of global annual turnover, whichever is higher. In practice, enforcement against small businesses tends to involve warnings and enforcement notices first, but the risk is real — and a complaint from one user is enough to trigger an ICO investigation.

Does a UK limited company have to put anything on its website?+

Yes. Under the Companies Act 2006, a UK limited company must display on its website: the full registered company name, the registered company number, the registered office address, and the country of registration. If you are VAT-registered, your VAT number must also appear. These requirements also apply to emails sent from the business.

Does UK GDPR still apply after Brexit?+

Yes. After Brexit, the UK retained the EU GDPR as "UK GDPR" and supplemented it with the Data Protection Act 2018. The rules are substantially the same as EU GDPR. If your website serves customers in EU member states as well, you may also need to comply with EU GDPR separately — meaning you may have obligations under both regimes.

What is the difference between a cookie policy and a privacy policy?+

A privacy policy covers all personal data you collect — forms, accounts, analytics, purchases. A cookie policy specifically explains what cookies your site uses, their purpose, and how users can manage them. Many UK businesses combine both into a single document. What the ICO requires is that the information is provided clearly and accessibly — the format is less important than the content.

Do I need a legal disclaimer on my UK website?+

A disclaimer is not required by law, but it is strongly advisable for certain types of business — especially if your website contains information that could be acted upon (financial, legal, medical, or nutritional advice). A disclaimer limits your liability if a user relies on content and suffers a loss. Regulated professionals such as solicitors, IFAs, and doctors must also include specific regulatory disclosures on their sites.

Are there extra legal requirements for ecommerce websites in the UK?+

Yes. Online retailers must comply with the Consumer Contracts Regulations 2013 (right to cancel within 14 days for most goods), the Consumer Rights Act 2015 (goods must be of satisfactory quality), and the Electronic Commerce Regulations 2002 (clear identity, pricing, and order process). You must also display your returns policy clearly, confirm orders by email, and not use pre-ticked boxes for optional extras.

Need a legally compliant website?

Every website WebAnts builds includes a GDPR-compliant cookie consent setup, correctly structured legal pages, and Companies Act disclosures — not bolted on at the end, built in from the start.

Start a project View our services

Dream Algorithm Ltd, trading as WebAnts · London · 4.9★ rated · No deposit required