UK website legal requirements in 2026: the checklist for small businesses

Most of this takes an afternoon to put right. Fines for getting it wrong have gone up sharply, though: up to £17.5 million or 4% of turnover under the cookie and marketing rules, and up to 10% of global turnover for consumer law breaches. This is a practical checklist, not legal advice.

1. Say who you are

Under the Electronic Commerce Regulations 2002, a commercial website should show:

• your business name
• the geographic address where you're established
• an email address, plus other details that let people contact you quickly
• your registration number, if you're on a public register such as Companies House
• details of your regulator or professional body, if your work needs authorisation or is a regulated profession
• your VAT number, if you're VAT registered

Limited companies must also show their full registered name (which may differ from the trading name), registered number, registered office address and the part of the UK they're registered in, such as England and Wales. Missing these is an offence for the company and its directors. A footer or contact page is the usual place.

If you're a sole trader working from home, note that the 2002 rules ask for a geographic address and have no exemption for home workers. If you don't want your home address public, ask your accountant about the options before you remove it.

2. Explain how you use personal data

If your site has a contact form, booking form or newsletter sign-up, you're collecting personal data. UK GDPR requires a privacy notice that explains what you collect, why, how long you keep it and who you share it with. Link it from every form.

You may also need to pay the ICO's data protection fee. It runs from £52 to £3,763 a year depending on size, and not paying when you should can mean a fine of up to £4,350. Some small businesses are exempt, so use the ICO's self-assessment to check.

3. Follow the new cookie rules

The Data (Use and Access) Act 2025 changed the cookie rules from 5 February 2026, and the ICO published its final guidance on 29 April 2026. Two new kinds of cookie no longer need consent:

• statistics, used only to see how your site is used so you can improve it
• appearance and functionality, used to adapt how your site looks or works for the visitor

The catch: you must give clear information about them, and a simple, free way to object, such as a toggle that's on by default. If an outside provider is involved, it must only use the data to improve your site and not combine it with other data. Advertising and cross-site tracking still need consent first.

So yes, most small business sites still need a banner. But a site using privacy-first analytics and no ad tracking may only need a clear notice with an opt-out.

4. Only show genuine reviews

Since 6 April 2025, the Digital Markets, Competition and Consumers Act has banned fake reviews. That covers writing or commissioning them, and hosting consumer reviews without reasonable steps to check they're real. The Competition and Markets Authority can now fine businesses itself, up to 10% of global turnover.

For your website, that means using real reviews in the customer's own words. Don't write testimonials yourself, and don't show a star rating you can't back up, even on a mock-up.

5. Show the full price

If you show prices, include any fee everyone has to pay in the headline figure, and say whether VAT and delivery are included. Hidden compulsory fees, known as drip pricing, were banned from April 2025.

6. Back up your claims

The Advertising Standards Authority covers marketing claims on your own website. “Fully insured”, “Gas Safe registered”, “No.1 in St Albans” and “cheapest in Hertfordshire” all need to be true and provable. Keep membership logos current.

7. If you sell online or agree jobs at the customer's home

The Consumer Contracts Regulations give consumers 14 days to cancel contracts made online, by phone, or face to face away from your premises, including at the customer's home. For services, you shouldn't start within those 14 days unless the customer asks you to. If they cancel after asking, they pay for the work done so far. If you don't give the required cancellation information, the cancellation period can be extended by up to a year.

The checklist

• Business name, geographic address and email on the site
• Company name, number, registered office and place of registration (limited companies)
• VAT number, if registered
• Regulator or professional body details, where they apply
• Privacy notice, linked from every form
• ICO fee self-assessment done
• Cookie banner or notice that matches the tools you actually use
• Advertising tags blocked until the visitor consents
• Only genuine reviews, in customers' own words
• Prices include compulsory fees and say whether VAT is included
• Every claim and badge is current and provable
• Cancellation information, if you sell online or agree jobs at customers' homes

Frequently asked questions

Do I still need a cookie banner in 2026?

Probably, if you use Google Analytics as normally set up, the Meta Pixel or ad tags. If you only use essential cookies and analytics that fits the new exemption, a clear notice with a simple opt-out may be enough.

Do I need a privacy policy on my website?

Yes, if the site collects personal data, which includes any contact or booking form.

What does a sole trader have to show?

Your name, a geographic address, an email address, your VAT number if registered, and regulator or professional body details where they apply.

Can I put reviews from Google or Facebook on my site?

Yes, if they're genuine and shown fairly. Don't edit them or make any up.

What are the fines?

Up to £17.5 million or 4% of worldwide turnover under the cookie and marketing rules, and up to 10% of global turnover under consumer law.

We scope every project around your requirements. Explore our web design service.

Sources

• Electronic Commerce (EC Directive) Regulations 2002, regulation 6
• Company, LLP and Business (Names and Trading Disclosures) Regulations 2015, Part 6
• Brodies: Online trading disclosures
• ICO: Data protection fee FAQs
• Bratby Law: Data (Use and Access) Act 2025 commencement
• Womble Bond Dickinson: ICO guidance on the new cookie exceptions
• Privado: ICO finalises tracking technologies guidance
• CookieChimp: Do analytics cookies require consent?
• Which?: Fake reviews and hidden fees banned
• Which?: Consumer Contracts Regulations