[email protected]
0333 050 1245

Fix UK website legal gaps in 3 days: GOV.UK and ICO steps to stop fines

  1. Home
  2. »
  3. Blog
  4. »
  5. When is it Time To Rebrand: 6 Signs That It’s Time To Take The Plunge

Every UK business website must show its legal name, geographic address, an email address, its Companies House number if registered, and its VAT number if VAT-registered, and this information has to sit somewhere visitors can find easily, directly and permanently. Beyond that, you need a privacy notice, cookie consent for anything non-essential, an accessible design, and clear pre-contract information if you sell online. Start by checking your footer and your checkout flow today. Those two spots reveal most compliance gaps in minutes.

TL;DR:

  • Most UK websites must display their legal name, address, email, Companies House number, and VAT number in a permanently accessible location.
  • A privacy notice is mandatory if any personal data is collected, covering data processing, retention, sharing, user rights, and should be layered across forms and footers.
  • Cookie consent must be active, granular, and reversible, with scripts for non-essential cookies blocked until explicit visitor approval is obtained.
  • Online checkout information must clearly include total price, delivery details, product characteristics, and cancellation rights before payment, with confirmation sent immediately after purchase.
  • Accessibility compliance is guided by WCAG, requiring basic features like alt text, keyboard navigation, and color contrast; a short accessibility statement can demonstrate ongoing efforts.

Table of Contents

If you run a website for your business, Regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 already applies to you, whether you knew it or not. It sets out exactly which identity details you must disclose, and it uses a specific phrase worth remembering: the information must be “easily, directly and permanently accessible.” That rules out burying your company number three clicks deep in a PDF, or hiding your contact details behind a form that only sends an email once someone fills it in.

According to Gov, the required disclosures are:

  • Your full legal business name (not just a trading name or logo)
  • A geographic address, not a PO box, where you can be contacted
  • A working email address
  • Your Companies House registration number, if you trade as a limited company
  • Your VAT registration number, if you’re VAT registered

A contact form alone doesn’t satisfy this. Visitors need to see the actual details without submitting anything or waiting for a reply. The most reliable fix is a two-layer approach: put the essentials in your site footer, visible from every page, and back it up with a dedicated “Company Information” or “Legal” page where you can list everything in full, including downloadable terms if you have them.

There’s a director angle too. Companies House guidance on being a company director confirms that directors carry personal responsibility for keeping company filings accurate and up to date, and your registered office address is public record regardless of what you display on your site. If your business operates in a regulated sector, such as financial services or legal advice, you’ll usually need to add your regulator’s name and your registration or authorisation number alongside the standard disclosures.

Do UK websites need a privacy notice?

Almost certainly, yes. UK GDPR applies the moment your website collects any personal data, and that threshold is lower than most owners expect. A name in a contact form, an email address for a newsletter signup, or even an IP address logged by your analytics tool all count as personal data. ICO guidance for small organisations is blunt about this: most small businesses that hold any personal data need a privacy notice, and the regulator even provides a generator to help you build one.

A compliant notice needs to cover:

  • Who you are (the data controller) and how to contact you
  • What data you collect and why (your lawful basis for processing it)
  • How long you keep it
  • Who else might see it, such as payment processors or delivery couriers
  • What rights people have over their data and how to exercise them

Don’t try to cram all of that into one dense wall of text on your homepage. The better pattern is a layered notice: a short, plain-English summary placed directly on any form where you collect data, linking through to the full policy for anyone who wants the detail. Link the full policy from your footer as well, so it’s never more than one click away regardless of where someone lands on your site.

Pro Tip: Keep dated versions of every privacy policy you publish, even old ones. If a customer ever disputes what you told them at the time they handed over their data, you’ll want proof of exactly what was live on the site that day.

If your data processing gets more complex (profiling, sensitive categories, large-scale tracking) it’s worth a conversation with the ICO directly or a data protection adviser before you scale it up.

Many UK sites get at least one part of cookie consent wrong, usually by loading analytics or advertising scripts before a visitor has said yes to anything. ICO guidance on cookies under PECR draws a clear line: strictly necessary cookies (the ones that make your shopping basket or login work) don’t need consent. Everything else, including analytics, advertising and most third-party embeds, does.

Consent under UK cookie law has to be an active, informed, positive action. A banner that just says “by continuing to browse you accept cookies” does not meet that bar, and neither does a banner where the “accept” button is bright and obvious while “reject” is a barely visible grey link. The ICO expects genuine choice, and that choice needs to be granular and reversible.

A workable implementation checklist looks like this:

  1. Set your cookie banner to default to “no” on every non-essential category
  2. Block analytics, marketing and third-party scripts technically until consent is actively given
  3. Offer clear, equally weighted accept and reject options, plus a way to manage preferences by category
  4. Store a timestamped consent record for every visitor decision
  5. Publish a cookie policy listing what each cookie does, how long it lasts and who sets it
  6. Give visitors an easy way to withdraw or change consent later

The ICO has repeatedly flagged setting scripts before consent as one of the most common implementation errors it sees, alongside implied-consent banners that assume a “yes” from continued browsing. Both are straightforward to fix with the right technical setup, and Kukoocreative’s guide to cookie banner design that blocks scripts before consent walks through the build in more detail.

What must UK online checkouts show before payment?

If you sell anything online, the Consumer Contracts Regulations 2013 set out exactly what a customer needs to see before they’re bound to a purchase, and exactly what you need to confirm afterwards. Get this wrong and you risk extending a customer’s cancellation window well beyond the standard period, sometimes indefinitely, until the missing information is finally supplied.

Before the customer clicks to pay, your checkout must show:

  • The total price, including all taxes and any unavoidable charges
  • Delivery arrangements, timescales and delivery costs
  • The essential characteristics of the goods or service being bought
  • Confirmation that a 14-day cancellation right exists, and how to use it

The checkout flow itself has design obligations too. Customers need a clear order summary before payment, a genuine opportunity to correct mistakes (wrong quantity, wrong size, wrong address) before committing, and a payment button that’s labelled with an obligation to pay, not something vague like “continue.”

Once the order is placed, Regulation 9 of the Electronic Commerce Regulations requires you to acknowledge it without undue delay, and the Consumer Contracts Regulations require you to repeat the key pre-contract information in that confirmation, sent in a durable format such as email. Include the model cancellation form if your product or service qualifies for the 14-day right. A confirmation email that just says “thanks for your order” and nothing else falls short of the standard.

Website accessibility law in the UK doesn’t sit in one tidy statute the way cookie rules do, but the Equality Act 2010 still bites. If your business provides a service to the public, you have a duty to make reasonable adjustments, and courts and regulators increasingly treat an inaccessible website as a barrier no different to a shop with no wheelchair ramp.

The practical response is the Web Content Accessibility Guidelines (WCAG), and you don’t need to tackle every checkpoint at once. Start with the ones that catch the most people:

  • Alt text on every meaningful image, so screen readers can describe it
  • Full keyboard navigation, so a mouse isn’t required to use any part of the site
  • Headings used in a logical, genuine hierarchy, not just for visual size
  • Colour contrast strong enough to read in bright light or with low vision
  • Labelled form fields, so assistive technology knows what each box is asking for
  • Captions or transcripts on video content

Pro Tip: Run a free automated scan first (tools like WAVE or the built-in Lighthouse audit in Chrome catch the obvious issues), then test manually by tabbing through your own site using only the keyboard. Automated tools miss roughly a third of real accessibility problems.

A short accessibility statement, published on its own page, sets out what you’ve done and what’s still in progress; that’s often enough to show good faith while you work through the rest. Where budget allows, bringing in a specialist for a full audit tends to pay for itself in reduced complaints and a wider customer base who can actually use your site.

Is website accessibility a legal requirement in the UK? — overview diagram

Terms and conditions, a returns policy, and basic intellectual property housekeeping round out the legal picture, and each carries its own small print worth getting right.

Your terms and conditions need to be storable, not just readable on screen. Regulation 9 of the E-Commerce Regulations expects contract terms to be reproducible, so a downloadable PDF or a clean, printable web page both work; a wall of text a customer can’t save or print does not.

Your returns and refunds policy has to align with the Consumer Rights Act 2015 and the Consumer Contracts Regulations together, since the two work in tandem to set enforceable standards for goods, services and digital content. Missing disclosures here don’t just annoy customers, they can undermine the contract’s enforceability.

A few habits worth building in from the start:

  • Never use third-party images or text without a licence or clear attribution
  • Publish a takedown contact address for copyright complaints, so rights holders have somewhere to go
  • Keep language plain: short sentences in your T&Cs get read; dense legal paragraphs get ignored, then disputed later
  • Review your terms whenever you add a new product type, delivery region or payment method

How do you build a UK website compliance checklist?

Priority Item Owner
Days 1–3 Footer identity details, privacy summary link, cookie banner defaults Site owner or web developer
Days 4–14 Checkout walkthrough, storable T&Cs, order confirmation templates Developer or agency
— Accessibility audit, consent log review, dispute process documentation Specialist or solicitor if needed

Sequence matters more than most owners assume. Start with the three fastest wins:

  1. Add your legal name, address, email, company number and VAT number to the footer
  2. Publish a short privacy summary linked from every data-collection form
  3. Reset your cookie banner so nothing non-essential fires before consent

Those three alone close the most commonly cited gaps. From there, move to the mid-term work: walk through your own checkout as a customer would, make your terms downloadable, and rewrite your confirmation emails to include everything the Consumer Contracts Regulations require.

Keep evidence as you go, not after the fact. Dated screenshots of your privacy policy, timestamped consent logs, and a record of when each page went live all matter if a customer or the ICO ever asks what you were showing on a given date.

Escalate to a solicitor when the issue touches sector-specific regulation (financial promotions, health claims, regulated professions) or when a dispute has already reached a formal complaint. Escalate to an accessibility specialist when your automated scan flags dozens of issues across templates rather than one-off content mistakes. Kukoocreative’s guide to why website audits matter for UK SMEs covers the audit side in more depth, and the small business website must-haves checklist is a useful companion for the identity and structure basics.

Most compliance failures we see aren’t malicious, they’re structural. A privacy policy gets written once by whoever’s available, then never revisited when the site’s design changes around it. A cookie banner gets bolted on as an afterthought rather than built into the template from day one. Over a decade of building websites for small and growing UK businesses, the pattern is consistent: sites that treat legal disclosures as part of the design, not a bolt-on, get fewer customer disputes and a smoother checkout journey.

Clear terms and an honest cookie banner don’t just keep you compliant, they read as trustworthy, and trust tends to show up in fewer abandoned baskets and lighter support queues. Briefing an agency makes sense for the structural work, the templates, the checkout flow, the accessible design. A solicitor still earns their fee on sector-specific risk and genuine disputes.

— Kukoo

Our service integrates footer disclosures, privacy summaries, cookie consent setup and accessible templates into the site itself, so compliance isn’t a patch job sitting on top of your design.

Kukoocreative

A typical update, refreshed footer, storable terms page, working cookie consent and an accessibility pass, usually takes a matter of weeks rather than months, depending on how much of your existing site needs rebuilding around it. If you’re planning a redesign anyway, this is the moment to fix the legal gaps at the same time rather than twice. Take a look at our web design process for Leeds business owners and get in touch to discuss what your site needs.

Where to check the rules yourself

For direct verification, the primary sources behind this checklist are worth bookmarking:

For anything sector-specific or genuinely contested, a solicitor familiar with UK consumer and data protection law remains the right next call.

Sources