Guide · UK
Website legal requirements in the UK: a 2026 checklist
The nine things most UK business websites need to get right, in plain English, with a free test for each. This is a general guide, not legal advice.
The checklist
1. Show your company details
A UK limited company must show its registered name on its website, plus its registered number, the part of the UK it is registered in and its registered office address.
Companies (Trading Disclosures) Regulations 2015
Check company details →2. Ask before setting non-essential cookies
Analytics and advertising cookies or trackers must not load until the visitor agrees. Rejecting should be as easy as accepting, and must actually stop tracking.
PECR Reg. 6 · UK GDPR Art. 7
Test your cookie banner →3. Publish a full privacy policy
Explain who you share data with, how long you keep it and how people can use their rights, including complaining to the ICO.
UK GDPR Art. 13
Check your privacy policy →4. Explain the 14-day cooling-off period
Consumers buying online in the UK generally have 14 days to cancel. For goods it usually runs from delivery; for services from the day the contract is made. You must tell customers about this right before they buy.
Consumer Contracts Regulations 2013
Check your terms →5. Make subscriptions easy to cancel
Be clear about renewal price and frequency before payment, and let customers who signed up online cancel online without calls or chat.
DMCC Act 2024 Part 4, Ch. 2
Check your subscription flow →6. Show the full price up front
Headline prices should include fees customers can't avoid, rather than adding them at checkout.
DMCC Act 2024 Sch. 20
Check your pricing →7. Make your site accessible
Readable contrast, labelled form fields, image descriptions and visible keyboard focus. The Equality Act 2010 applies in the UK, and the European Accessibility Act applies if you sell to the EU.
Equality Act 2010 · EAA · WCAG 2.1 AA
Run an accessibility pre-check →8. Label AI chatbots and AI images (if you serve the EU)
The EU AI Act can apply to UK businesses whose AI reaches people in the EU. Visitors should be told when they're talking to an AI, and realistic AI-made images should be labelled.
EU AI Act Art. 50
Check AI labelling →9. Keep the site secure
Serve every page over HTTPS and use standard security headers to protect visitors' data.
UK GDPR Art. 32
Check security headers →
Common questions
- What are the legal requirements for a UK website?
- Most UK business websites need company details, cookie consent for non-essential cookies, a privacy policy, clear prices and, if they sell to consumers, terms explaining the 14-day cooling-off period. Subscription sites also need clear renewal terms and easy online cancellation.
- How long is the cooling-off period in the UK?
- For most online purchases it is 14 days. For goods it usually starts when they are delivered; for services it starts when the contract is made. Some items, such as personalised goods, are exempt.
- Do I need a cookie banner in the UK?
- You need consent before setting non-essential cookies such as analytics or advertising. Strictly necessary cookies do not need consent.
Halvus reports risks found, not legal advice.