UK Website Legal Pages, Policies and Cookie Banners: What You Might Be Missing
A lot of small business websites in the UK treat legal pages as an afterthought - something to bolt on later once the "real" content is finished. The trouble is that several of these requirements are not optional extras. Under UK GDPR and the Privacy and Electronic Communications Regulations, businesses that collect any personal data, even just through a contact form or analytics, have legal obligations to meet. Skipping them is not just a compliance risk; it can also result in fines or enforcement action from the ICO, while signaling to visitors that your business might not be as trustworthy as your competitors.
Cookie banners and consent
If your website uses cookies for analytics, advertising, or anything beyond the bare minimum needed to make the site function, you need a proper consent mechanism. That means visitors should be able to say yes or no to non-essential cookies before those cookies are set, not after. A banner that only says "we use cookies" with an “OK” button that cannot be declined does not meet the standard. Getting this right protects the business from regulatory risk and also gives visitors a better first impression, since it shows the site is being run properly and with respect for applicable laws.
What is the bare minimum for website cookies? It’s what regulations call “strictly necessary” cookies - meaning cookies the site cannot function without. Examples include a cookie that remembers what is in a shopping basket, one that keeps a visitor logged into an account area, or session cookies used by platforms like Squarespace or Wix to keep the site functioning securely. Anything beyond that needs consent, such as analytics cookies for Google Analytics, advertising or retargeting cookies for platforms like Meta or Google Ads, and embedded content such as YouTube videos or social media feeds that set their own cookies. Even an analytics tool that only counts visits without identifying anyone personally still falls outside the “strictly necessary” category in most cases and thus needs the consent of your website visitors under PECR.
A privacy policy that actually says something
Every website that collects personal data needs a privacy policy, but many of the ones already out there are generic templates that do not reflect what the business actually does with people's information. A good privacy policy should explain in plain language what data is collected, why, how long it is kept, and who it might be shared with, such as email marketing platforms or website hosts. This is not just a legal checkbox. Today, AI makes it easy for website visitors to scan your legal pages - whether they want to verify your credibility, ensure they are protected or are actively seeking legal leverage against your business.
Having a privacy policy is a specific legal requirement in its own right, not just good practice, and it needs to genuinely reflect what the business does and the data it collects. A generic or outdated policy can be worse than none at all if it describes handling that does not match reality, since that mismatch is itself a compliance gap and suggests the business was neglecting its obligations when it was written.
Beyond direct compliance, many email marketing platforms, payment processors, and advertising tools now expect a compliant policy to be in place before allowing full use of their features, and some will suspend an account if a complaint is raised and no proper policy can be produced. A clear, accurate privacy policy is also frequently the first thing either party points to if a dispute over data ever comes up. A strong privacy policy gives your business something solid to stand on.
Terms and Conditions
Terms and conditions set expectations for how your website and services work, from payment terms to what happens if something goes wrong. For a service based business, this might cover things like project timelines, cancellation terms, and intellectual property once a website or piece of content is delivered. It is worth writing these to reflect the specific business rather than pulling a generic template wholesale, since the terms therein can miss the details that actually matter if a dispute ever comes up.
Consumer protection law adds another layer worth getting right. If a business sells to consumers rather than only to other businesses, the Consumer Rights Act 2015 sets certain protections that terms and conditions cannot override, such as the right to have services carried out with reasonable care and skill. Where services are sold online or at a distance, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 give consumers specific cancellation rights (such as the 14-day cooling-off period) that generic templates rarely address correctly.Terms and conditions should also typically set out limitations of liability, meaning what the business is and is not responsible for if things go wrong, and which country's law and courts apply if a dispute ever needs resolving.
Accessibility Statements
Accessibility is often overlooked entirely, yet an accessibility statement, and genuine effort toward an accessible site, matters both legally and practically. Public sector websites in the UK have a strict legal duty here, and while small private businesses have more flexibility, an accessible website reaches more customers and performs better in search results. A short statement outlining what has been done and who to contact with accessibility concerns costs little to add and shows visitors the business takes them seriously.
Under the Equality Act 2010, private businesses can be liable if a disabled visitor is unable to access important information or complete a purchase and no reasonable adjustments have been made, since a website is generally treated as a service in this context. Most modern website builders, including Squarespace and Wix, support elements of the Web Content Accessibility Guidelines, commonly known as WCAG, and working toward that standard, through steps like proper alt text, sufficient colour contrast, and full keyboard navigation, gives a business something concrete to point to rather than a vague claim of being accessible.
Getting it right the first time
Cookie banners, privacy policies, terms and conditions, and accessibility statements are not very “sexy” - they are not the most glamorous parts of a website, but they are foundational ones. A site that gets these right looks more credible, protects the business running it, and avoids the scramble of trying to fix things after a complaint or a warning letter. If your current website is missing any of these, or has versions that were clearly copied from somewhere else without much thought, it is worth having them properly reviewed and rewritten.
At Regan Web Design, every website package includes properly considered legal pages as standard, not as an optional extra. Always included are separate Terms and Conditions, Privacy Policy, Cookie Policy, and Disclaimer pages, alongside a dedicated Accessibility Statement to ensure your site is built on solid foundations. That said, this article is meant as a practical starting point rather than legal advice. It is always highly advisable to have a solicitor or other qualified legal professional review your legal pages, particularly your terms and conditions, to make sure everything holds up for your business. Getting the foundations right from the start means fewer surprises later, and a website you can be genuinely confident in.