What has to be on your website by law
Plenty of people will tell you your site is illegal in order to sell you something. Some of it is real, and it is less work than they imply.
This is a plain summary of what is generally required of a small British business, not legal advice — if anything below is close to the line for you, check it properly.
If you are a sole trader
Trading under your own name — Dave Wilkins, plumber — and there is nothing extra to do.
Trading under a business name — Wilkins Plumbing, Northgate Heating — and the Companies Act requires you to disclose your own name and an address in the UK where documents can be served. That goes on your website as well as your invoices and letters.
In practice that is one line in the footer. It is not a page, and it does not have to be prominent.
If you are a limited company
More is required, and it is specific. Your website has to show the registered company name, the company number, where it is registered — England and Wales, Scotland or Northern Ireland — and the registered office address.
The registered name is the one on the certificate, which is not always the name you trade under. If you trade as 'Northgate Heating' but the company is 'N. Heating Services Ltd', both need to appear somewhere.
Everybody: contact details and prices
The e-commerce regulations, which still apply after Brexit, require any business offering services online to give its name, a geographic address, and a way of contacting it electronically — an email address or a form.
If you are VAT registered, the VAT number goes on too. And if you show prices, it has to be clear whether they include VAT.
Data: the privacy notice and the ICO fee
A contact form collects personal data, so UK GDPR expects you to tell people what you do with it: what you collect, why, how long you keep it, and how to ask for it back. For a small firm that is a short page in plain English, not a legal document.
Separately there is the ICO data protection fee, which is a modest annual payment most organisations that process personal data have to make. There are exemptions and they are narrower than people assume. The ICO has a short self-assessment on its own site — five minutes, and worth doing rather than guessing.
Cookies: less than you think
The rule is that you need consent before setting cookies that are not strictly necessary. Analytics counts as not necessary.
Which means the banner is not compulsory — it is a consequence of what you chose to install. A site with no analytics and no advertising pixels needs no banner at all, and there are cookieless ways of counting visitors that keep it that way. That is usually a better answer than a banner nobody reads.
What is just scaremongering
- "Your site must be WCAG AA compliant or you’ll be fined." The 2018 accessibility regulations apply to the public sector. Private businesses have a general duty under the Equality Act to make reasonable adjustments — a real duty, but not a specific standard with a fine attached.
- "You need terms and conditions." For a brochure site that shows what you do, no. If you sell or take bookings online, yes.
- "You must register your website." There is no such register.
- "You need a cookie banner." Only if you set non-essential cookies.
Common questions
Where do the company details have to go?
Anywhere on the site that a visitor can reach — the footer is the normal place and is perfectly acceptable. It does not have to be on every page in large print, but it does have to be findable without hunting.
I’m a sole trader with a made-up business name. Do I really have to put my own name on it?
If you trade under a name that is not your surname, yes — your name and an address for service. It puts some people off, but it is one line and it is the law rather than a preference.
Can I use a PO box instead of my home address?
The requirement is an address where documents can actually be served, and a PO box on its own generally does not satisfy that. A registered office service — a few pounds a month from an accountant or a formations company — is the usual answer for people who do not want their home address published.
Does any of this apply if the site is just a single page?
Yes. The obligations follow the business, not the number of pages. On the upside everything above fits into one footer line and one short page.
Want the boring bits handled?
Every site I build goes live with the trading details, a plain-English privacy notice and no cookie banner, because there is nothing to consent to.
Get a free mock-up