Website Privacy Policy, Terms and Cookies: What You Need

Your website is ready to launch. The pages look good, your contact form works, and perhaps you’re already taking orders. Then come the questions: do you need a privacy policy, website terms and a cookie banner?

For most UK businesses, you’ll need privacy information and clear business details. Your cookie requirements depend on the technologies your website uses. If you sell online, you’ll also need clear sales information and appropriate terms.

Here’s what each part does, what’s required and what to check before you publish.

What legal information does your website need?

There isn’t one standard set of documents that works for every website. A simple brochure site has different needs from an online shop, subscription service or platform where users upload content.

Start with these five areas:

• Company and contact details

• A privacy notice, often called a privacy policy

• Cookie information and any required consent controls

• Website terms of use

• Terms of sale, if you sell through the website

Some information is legally required. Other documents help explain how your service works and reduce the scope for disputes. You can sometimes combine information into one page, provided visitors can find and understand it.

Company information: what must you display?

A UK limited company’s website must show:

• Its full registered company name, normally including “Limited” or “Ltd”

• Its company registration number

• Its registered office address

• Where it is registered: England and Wales, Scotland or Northern Ireland

A website footer is a practical place for these details.

If your brand differs from your registered name, make the relationship clear. For example: “Blue Pixel is a trading name of XYZ Digital Services Limited.” Our guide to company names and trading names explains how this works.

Company Name vs. Trading Name: What's the Difference?

Online business rules also require accessible contact information, including an email address, and your VAT number if applicable. Online sellers may need to provide further address and contact details.

Privacy policy: when do you need one?

If your website collects or uses personal data, you must provide appropriate privacy information. A privacy policy is the usual way to do this. That includes websites with enquiry forms, newsletter sign-ups, customer accounts or checkout pages. Some analytics and tracking tools also process personal data.

Your notice should explain:

• Who operates the website and how to contact them

• What personal data you use and why

• The lawful bases you rely on

• Who receives the information

• How long you retain it, or how you decide

• Relevant overseas transfers and safeguards

• People’s applicable rights, including withdrawal of consent where relevant

• How to complain to the ICO

Additional information may be needed for your particular activities.

Make the notice easy to find and link to it where people provide information, such as beside your contact form. It must describe what your business actually does.

Publishing a privacy policy doesn’t, by itself, make your data handling compliant. You still need appropriate security, lawful processing and suitable arrangements with providers handling data for you.

Cookies: do you need a policy and banner?

Cookies and similar technologies have separate rules under the Privacy and Electronic Communications Regulations, or PECR. Strictly necessary cookies, such as those needed for a shopping basket or requested login, can generally operate without consent.

Some cookies used solely for aggregate statistics to improve your website, or to adjust its appearance or functionality, may also qualify for exceptions. These have specific conditions, including clear information and a simple, free way to object.

Advertising and tracking cookies generally require consent before they operate.

Explain the technologies you use, their purposes and how visitors can control them. This information can sit in a separate cookie policy or alongside your privacy notice.

Where consent is required, your banner must offer a genuine choice. Make rejection as easy as acceptance, block relevant technologies until consent is given, and let visitors change their preferences later.

Audit your actual website, including plugins, embedded content and marketing tools. Follow the ICO’s cookie guidance when deciding which controls you need.

Terms of sale: what changes if you sell online?

If customers buy through your website, you need clear information about the transaction and appropriate contractual terms.

For consumer sales, this generally includes your identity and contact details, what you’re supplying, the total price including taxes, delivery charges, payment arrangements and applicable cancellation rights.

Customers should be able to read and save the terms before ordering. Make any obligation to pay clear at checkout, and provide the required contract confirmation in a format they can keep, such as an email.

For subscriptions, explain recurring charges, the contract duration and how customers can end it.

Common mistakes to avoid

Copying another website’s policies. Their documents may describe different tools, services or legal arrangements.

Installing a banner without testing it. Check that technologies requiring consent stay blocked when someone rejects them.

Missing third-party tools. Review your analytics, payment providers, newsletter platform, chat tools and embedded content.

Putting everything in the footer. Privacy information belongs at relevant collection points, and sales terms need to be available before customers commit.

Leaving policies unchanged as the business grows. Review them when you add tools, change your service or enter new markets.

Website requirements are part of your wider setup. Our guide on what happens after registering a business on other early responsibilities.

What Happens After You Register a Limited Company?

How FOUNDRS can help

FOUNDRS members can access partners that help with drafting, legal review and cookie management.

Genie AI helps draft and review legal documents using AI. Provide accurate details about your business and review the output carefully. FOUNDRS members can access a one-month free trial.

Sprintlaw offers legal support for businesses, including help with privacy documents and website terms. FOUNDRS members receive 5% off their first project.

Usercentrics Cookiebot helps scan websites for cookies and trackers and provides consent-management tools. Correct configuration and testing remain essential. A 14-day trial is available through FOUNDRS.