Open your website's contact form. Since 19 June 2026, the privacy information that goes with it must tell people they can complain to you, as well as to the Information Commission (the ICO). And on 5 February 2026, the cookie rules were rewritten, with exceptions that now reach some analytics and the way a site looks.
UK GDPR website requirements are only part of what the law asks. This checklist covers rules on what a UK business website must show and do, for a company, an LLP, a sole trader or a partnership. Clinics have extra rules, in the clinic website checklist.
Checked against the legislation and the regulators' published guidance on 2 October 2026. WebAsk is a web agency, not a law firm. This summarises published law and guidance; it is not legal advice.
TL;DR
What UK law asks of your website depends on your legal form and on what the site does. It covers trading details, privacy information, consent before cookies that need it, reasonable adjustments for disabled visitors, honest reviews and, for consumer sales, checkout rules. WCAG 2.2 AA is a technical standard rather than the legal test, and no checklist can say a site is compliant.
The checklist by business type
A dash means none of the sources in this table puts that duty on you. Dates are when a rule came into force, or the date of the guidance.
By legal form
| What to show | Company | LLP | Sole trader or partnership | Source (in force) |
|---|---|---|---|---|
| Registered name, on the website | Yes | Yes | — | 2015 Regulations, reg 24(2); for LLPs, SI 2009/1804 reg 14 (both 31 January 2015) |
| Part of the UK it is registered in, registered number and registered office address, on the website | Yes | Yes | — | 2015 Regulations, reg 25 (31 January 2015) |
| That it is a limited company, or an LLP | Only if exempt from using "limited" in its name, or a private community interest company | Only if its name ends "llp", "LLP", "pac" or "PAC" | — | 2015 Regulations, reg 25(2)(d)–(e), and as applied to LLPs |
| Name and an address for service, on letters, written orders, invoices, receipts and payment demands, not the website | Own paperwork rules (regs 24(1) and 25(1)) | Own paperwork rules | Only if trading under a business name | Companies Act 2006 ss.1200–1204 (1 October 2009) |
| Name, geographic address and email address | Yes | Yes | Yes | E-Commerce Regulations 2002, reg 6(1)(a)–(c) (21 August 2002) |
| VAT number, if the activity is subject to VAT | Yes | Yes | Yes | E-Commerce Regulations 2002, reg 6(1)(g) |
| Trade register and number, supervisory authority, or professional body, title and rules, where they apply | Yes | Yes | Yes | E-Commerce Regulations 2002, reg 6(1)(d)–(f) |
| Prices, if the site gives any: clear and unambiguous, and saying whether tax and delivery are included | Yes | Yes | Yes | E-Commerce Regulations 2002, reg 6(2) |
The last four rows apply to an "information society service" (see below).
By what your site does
| If your site … | Then | Source (in force) |
|---|---|---|
| collects personal data, such as through a form, a booking or an account | Privacy information when you collect it, including the right to complain to you and to the ICO; a way to complain to you, with each complaint acknowledged within 30 days | UK GDPR Article 13, point (ca) added 19 June 2026; Data Protection Act 2018 s.164A (19 June 2026) |
| stores or reads anything on a visitor's device, such as cookies | Clear information, then consent first, unless an exception applies; refusing as easy as accepting | PECR reg 6 and Schedule A1 (5 February 2026); ICO guidance (last updated 29 April 2026) |
| does so only for statistics to improve the site, or to adapt how it looks or works | No consent needed if every condition is met, including clear information and a simple, free way to object | PECR Schedule A1, paragraphs 5 and 6 (5 February 2026) |
| serves the public in Great Britain | Reasonable adjustments, thought about in advance | Equality Act 2010 ss.20 and 29(7), Schedule 2; EHRC code (5 August 2026) |
| serves the public in Northern Ireland | Reasonable steps under the 1995 Act's own test | Disability Discrimination Act 1995 ss.19 and 21 |
| shows customer reviews | No fake reviews or hidden incentives; negative reviews not hidden; reasonable and proportionate steps to keep banned reviews off | DMCC Act 2024, Schedule 20, paragraph 13 (6 April 2025); CMA208 (4 April 2025) |
| uses testimonials in its marketing | Documentary evidence each is genuine, the giver's contact details, and permission | CAP Code rules 3.47 and 3.50 |
| takes orders from consumers | Information before the order; an "order with obligation to pay" button, or "a corresponding unambiguous formulation"; an acknowledgement and a confirmation; a 14-day right to cancel, with exceptions | Consumer Contracts Regulations 2013 (13 June 2014); E-Commerce Regulations 2002 regs 9 and 11 |
| shows consumers a product and its price | The total price, including fees the consumer "will necessarily incur", unless it is "already apparent from the context"; leaving it out "omits material information" | DMCC Act 2024 ss.225(4)(b) and 230(1), (2)(b) and (4) (6 April 2025) |
| sells only to businesses | Rules framed around consumers fall away, and regs 9(1)–(2) and 11(1) can be varied by agreement; trading details, privacy, cookies and CAP's testimonial rules still apply | Consumer Contracts Regulations reg 4; DMCC Act 2024 s.225(3); E-Commerce Regulations regs 9(1)–(2) and 11(1) |
Trading details your website must show
Companies and LLPs
"Every company shall disclose its registered name on its websites."
That is regulation 24 of the 2015 trading disclosure rules. Regulation 25 adds the other company details in the first table. They must be readable "with the naked eye" (regulation 20). Failing without reasonable excuse is an offence by the company and every officer in default (regulation 28). The same rules apply to LLPs. They do not say where on the site; a footer can carry them on every page.
Sole traders and partnerships
The Companies Act 2006 rules for sole traders and partnerships apply only "under a business name". A surname with a forename or initial, such as "J. Smith", is not a business name; "Smith Plumbing" is.
Under a business name, your name and an address for service go on business letters, written orders, invoices, receipts and payment demands. They also go on a notice at premises customers visit. Anyone you deal with in the business who asks must get them in writing (sections 1202 and 1204). These sections do not mention websites.
Every legal form: the E-Commerce Regulations 2002
Regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 reaches every legal form. It applies to "a person providing an information society service", which the ICO says an online service "is likely" to be. The three rows above the price row in the first table must then be "easily, directly and permanently accessible". A user can sue for "damages for breach of statutory duty" (regulation 13).
Regulation 6 asks for "the geographic address at which the service provider is established". It has no exception for a home; ask a solicitor how that applies to you. The local SEO checklist covers keeping these details the same wherever you are listed.
UK GDPR website requirements: privacy notice and forms
What the privacy information must say
UK GDPR Article 13 applies when you collect personal data from someone, such as through a form. You must give them privacy information "at the time when personal data are obtained". Among other things, it covers who you are, why you use the data, your lawful basis and how long you keep it. It must also set out their rights, including to complain to you and to the ICO. Article 12 asks for "clear and plain language".
The ICO says you can put this on your website, but you "must make individuals aware of it and give them an easy way to access it". Its Right to be informed page is "under review". Its checklist does not yet mention complaining to you.
A way to complain, since 19 June 2026
"A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means."
That is section 164A of the Data Protection Act 2018. "Such as" matters: a form is one option, not a must. The ICO's complaints guidance says "How you do this is up to you", from an email address to a phone line. You must acknowledge a complaint within 30 days. The ICO adds that you "must tell people they can complain to you, as well as to us". Do it when you collect their data, for example in your privacy notice. For marketing tick-boxes, see our PECR post on email and texts.
Cookie banner rules under PECR
Do you need a cookie banner?
"Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user."
That is regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR). It covers cookies and similar technologies. The ICO says that, "unless an exception applies", you must tell people what they are, explain what they do, and "obtain prior consent for their use". Since 5 February 2026, Schedule A1 has listed five exceptions: communication, strictly necessary, statistical purposes, appearance and emergency assistance. Storage that is "strictly necessary" for a service the visitor asked for needs no consent (paragraph 4). Its examples include keeping "a record of selections made on a website".
Regulation 6 and Schedule A1 never say "banner". The ICO says banners "might seem to be the easiest option", but "you should consider their implementation carefully", not least on phones. Does anything on your site need consent, or use the statistics or appearance exception? Then you need a way to inform people and let them choose or object. A banner is one way.
Accept all and reject all
The ICO's rule is that people can refuse non-exempt cookies "as easily as they can accept". Its picture of good practice shows "equally prominent options to 'accept all' or 'reject all'". So "as easily" is the test, and equal prominence is the ICO's illustration.
Its guidance adds that consent needs "a clear and positive action". Carrying on browsing is not consent, and nor is a pre-ticked box. Nothing that needs consent may run before it is given. People must be able to withdraw "with the same ease that they gave it". After a refusal, you should wait a reasonable time before asking again. The ICO's "general guideline" is six months.
The analytics and appearance exceptions
Two exceptions let some storage run without consent, on conditions (Schedule A1, paragraphs 5 and 6). The "sole purpose" must be statistics to improve the site, or fitting how it looks or works to the user's preferences, or otherwise enhancing it. The user must also get "clear and comprehensive information" and "a simple means of objecting, free of charge". For statistics, the information may be shared only so that someone can "assist with making improvements" (paragraph 5(1)(c)).
The ICO says the statistics exception "does not allow you to monitor or track individual visitors". It excludes online advertising. Any outside provider "must be a processor, not a joint controller". The toggles for these two exceptions could be "on by default", the ICO says, if users can switch them off at any time. Consent still needs a positive action. External font libraries may collect information about users, such as their IP address. If so, you "must explain this" and offer a simple, free way to object. Or, the ICO says, you "could consider self-hosting fonts". This post does not assess any analytics tool.
Website accessibility requirements in the UK
Great Britain: the Equality Act 2010
In England, Wales and Scotland, a business serving the public has a duty to make reasonable adjustments for disabled people. That holds "for payment or not" (Equality Act 2010, section 29). If a practice puts disabled people at a "substantial disadvantage", you must take reasonable steps to avoid it (section 20). For information, that includes steps so it "is provided in an accessible format".
"The obligation also applies to the provision of services on a website (section 29)."
That is the statutory code from the Equality and Human Rights Commission (EHRC), in force since 5 August 2026. The duty applies "regardless of whether" you know a customer is disabled. The code's example is a legal services website with all its text inside images. Visually impaired visitors cannot resize that text or have it read aloud. That, the code says, "will be indirect disability discrimination unless the provider can justify it". Courts and tribunals "must consider any part of the Code that appears relevant", though the code itself "does not impose legal obligations".
Northern Ireland: the Disability Discrimination Act 1995
Neither the Equality Act's service duties nor the code extends to Northern Ireland. There, section 21 of the Disability Discrimination Act 1995 applies. Its test is whether a practice makes it "impossible or unreasonably difficult for disabled persons to make use of a service". If so, the provider must take reasonable steps to change it. The Equality Commission for Northern Ireland says these protections "apply whether you buy products or services online or in person".
Where WCAG 2.2 AA fits
Is WCAG 2.2 AA compliance a UK legal requirement? Not by name, for a private business. The legal test is reasonable adjustments; WCAG 2.2 AA is a technical standard.
WCAG 2.2 is a W3C Recommendation, first published on 5 October 2023 (current version 12 December 2024), with levels A, AA and AAA. GOV.UK says a public sector website "will meet the legal requirements" if it meets WCAG 2.2 AA and publishes an accessibility statement. WCAG is not named in the Equality Act sections we read, the EHRC code, or the 1995 Act's service sections.
Reviews and testimonials under the DMCC Act
Are fake testimonials illegal?
In short: the Digital Markets, Competition and Consumers Act 2024 (DMCC Act) has prohibited fake consumer reviews since 6 April 2025. The Competition and Markets Authority (CMA) can impose a penalty.
Schedule 20 of the Act lists the following among practices considered unfair in all circumstances:
"Submitting, or commissioning another person to submit or write— (a) a fake consumer review, or (b) a consumer review that conceals the fact it has been incentivised."
It also lists publishing reviews "in a misleading way", or without "reasonable and proportionate steps" against such reviews. A fake review "purports to be, but is not, based on a person's genuine experience". Unfair commercial practices "are prohibited" (section 225).
The CMA counts a fake review given to a trader "to include it in their marketing materials" as submitted (CMA208, 4 April 2025). It can impose a penalty of up to £300,000 or 10% of global turnover, whichever is higher (section 182). These practices are excluded from the Act's criminal offence for Schedule 20 (section 237); we did not assess other offences.
The DMCC rules are framed around consumers. The CAP Code, the advertising code the Advertising Standards Authority applies, reaches business-to-business testimonials too. It covers marketing by businesses "on their own websites". Its consumer is "anyone who is likely to see a given marketing communication, whether in the course of business or not". You need documentary evidence that each testimonial is genuine, unless it is obviously fictitious, and the giver's contact details (rule 3.47). With some exceptions, you also need their permission (rule 3.50).
If your website shows reviews
Publishing "in a misleading way" includes hiding negative reviews while publishing positive ones. It also covers giving positive ones "greater prominence", and leaving out that a reviewer was commissioned (paragraph 13(5)). The CMA adds:
"Even a small trader publishing only reviews from their own customers … is required to implement reasonable and proportionate measures where their content poses a risk."
Your site may show ratings from a review site. If you want to rely on that site's checks, the CMA says you "should review" its "policies and arrangements for tackling banned content" to satisfy yourself, "on reasonable grounds", that they "meet the duty". The CMA calls the duty to take steps against banned reviews "non-delegable" (CMA208, 8.32). And "You should have a published policy that clearly prohibits fake reviews", says the CMA's short guide. Asking for reviews "without predetermining the contents or sentiment" is "not prohibited under the banned practice" (3.6). But a trader "may infringe the law" if they "selectively promote positive or negative reviews" (4.3). Inviting only happy customers is one way cherry-picking "might be done" (4.5). Requests, incentives and replies are covered in our guide to what UK law allows when you ask for Google reviews.
If you sell online to consumers
The Consumer Contracts Regulations 2013, in force since 13 June 2014, cover a "distance contract" with a "consumer". A consumer is an individual acting "wholly or mainly outside" their trade, business, craft or profession.
| Stage | What the law asks | Source |
|---|---|---|
| Before the consumer is bound | The Schedule 2 information "in a clear and comprehensible manner", including: the main characteristics; your identity, geographic address and, where available, phone and email; the total price with taxes, and delivery charges; payment and delivery arrangements; your complaint handling policy, where applicable; how and when to cancel, or that there is no right to cancel; for goods, a reminder of your duty to supply goods that conform to the contract | CCRs reg 13 and Schedule 2 |
| Any page that invites a purchase | The total price, which "includes any fees, taxes, charges or other payments that the consumer will necessarily incur", unless it is "already apparent from the context"; leaving it out "omits material information" | DMCC Act 2024 s.230(1), (2)(b) and (4) (6 April 2025) |
| Start of the ordering process | Whether delivery restrictions apply, and which payment methods are accepted | CCRs reg 14(6) |
| Ordering | The technical steps, how to correct input errors, the languages offered, and terms the buyer can "store and reproduce" | E-Commerce Regulations regs 9 and 11 |
| Directly before the order | Key details, including the main characteristics and the total price, "in a clear and prominent manner" | CCRs reg 14(2) |
| The order button | Labelled "only with the words 'order with obligation to pay'" or "a corresponding unambiguous formulation"; if not, "the consumer is not bound by the contract or order" | CCRs reg 14(4)–(5) |
| After the order | An acknowledgement "without undue delay and by electronic means" | E-Commerce Regulations reg 11 |
| Confirmation | Sent "on a durable medium", such as email, within a reasonable time, and no later than delivery of goods or the start of a service | CCRs reg 16 |
| Cancellation | Cancelling "without giving any reason": 14 days from the contract for a service, 14 days from receipt for goods; the model cancellation form where a right to cancel exists | CCRs regs 13, 29 and 30 |
| Cancellation information missing | The period runs on, for up to 12 months after it would have ended | CCRs reg 31 |
| No right to cancel | For example, personalised goods, goods that spoil quickly, and leisure services for a set date | CCRs reg 28 |
Small online orders get no £42 exemption: the regulations' £42 limit covers off-premises contracts only (regulation 7).
Footer, banner, form and checkout: a one-page check
The same duties, sorted by where they could sit on a site; the placement is ours, not the law's.
| Where | Check | Source |
|---|---|---|
| Footer | Companies and LLPs: registered name, part of the UK, registered number, registered office | 2015 Regulations, regs 24 and 25 |
| Footer | Every legal form: name, geographic address and email; VAT number if the activity is subject to VAT; any register, regulator or professional body | E-Commerce Regulations, reg 6 |
| Footer | Links to your privacy information and your cookie settings | UK GDPR Article 13; ICO guidance |
| Cookie banner | Reject as easy as accept; no pre-ticked boxes; carrying on browsing is not consent | ICO guidance |
| Cookie banner | Nothing that needs consent runs before consent is given | ICO guidance |
| Cookie banner | Each technology, purpose, third party and duration explained; readable on a phone | ICO guidance |
| Cookie banner | Statistics and appearance settings only on their conditions, and any objection honoured | PECR Schedule A1, paragraphs 5 and 6 |
| Cookie banner | Embedded videos set not to store anything "the instant someone visits the page" | ICO guidance ("should") |
| Forms | Privacy information at the point of collection, including both complaint rights | UK GDPR Article 13 |
| Forms | A route for complaints, each acknowledged within 30 days | Data Protection Act 2018 s.164A |
| Checkout | Every row of the consumer table above | Consumer Contracts Regulations; E-Commerce Regulations; DMCC Act s.230 |
| Reviews | Nothing fake, no hidden incentives, negative reviews not hidden | DMCC Act, Schedule 20, paragraph 13 |
| Reviews | A published policy against fake reviews | CMA short guide ("should") |
| Reviews | For a ratings widget whose checks you rely on, the review site's policies reviewed | CMA208, paragraph 8.32 ("should") |
| Testimonials | Documentary evidence, contact details and permission, with the code's exceptions | CAP Code rules 3.47 and 3.50 |
What no checklist can tell you
Several tests here turn on what is "reasonable" or "proportionate". Some guidance is due to change: the ICO's Right to be informed in spring 2027, and its PECR advice for small organisations in autumn 2026. No list of checks can give a verdict.
Where to start
- Check your own site. Read your footer against the first table, and check your privacy information says people can complain to you. Then refuse cookies on a phone, and try your site with a keyboard alone. The free audit gives five prioritised findings on search, speed and conversion. It reads what any visitor or search engine can see.
- Build it in. WebAsk's web development build standard puts trading details in the footer and makes Reject as easy as Accept, with equal prominence. It targets WCAG 2.2 AA, checked automatically as the site is built and by a manual keyboard pass before launch. That is our standard, not a promise that a site meets the law.
- Or talk to us about a build. Get in touch.