The legal pages a business website needs, and what they must say

1. Why they are not a formality

Three areas of law meet on any commercial website: rules on identifying who runs it, privacy law covering everything you do with customer data, and consumer law, which applies as soon as you sell. In the EU these are broadly harmonised; in the US they come from federal rules, state privacy laws and consumer protection enforced by the FTC and state attorneys general.

The practical reason is another one: legal pages are what a cautious customer reads before giving you their number or paying. A site with no name behind it, or a privacy policy that talks about a shoe shop when you are a physical therapist, costs trust at the worst moment.

2. Who is behind the site

In the EU: e-commerce rules require your identity to be easy to find, usually through a link in the footer. Include at least:

• Your name or company name, address and a direct contact email.
• Company registration number and register, if you are incorporated.
• VAT number, if you have one.
• Professional body, title and rules, if you work in a regulated profession, and the supervisory authority if your activity needs a license.

In the US: there is no general “imprint” rule, but clear contact details are expected by customers and payment providers, required for commercial email under CAN-SPAM (a valid physical address) and, for regulated professions, often required by your licensing board.

3. Privacy policy: what you do with data

The most important page and the most copied one. With your real details, it must answer these questions:

Several US states require a privacy policy for any site that collects personal information from their residents, and many state privacy laws apply above certain size thresholds. In forms, a hidden link is not enough: next to the submit button, add a short note with purpose and a link. Marketing consent needs its own unticked box in the EU.

4. Cookies and tracking

In the EU: strictly necessary cookies need no consent. Everything else — third-party analytics, advertising, embedded videos that track — needs consent before it loads.

• A first layer visible on arrival, with accept and reject at the same level. A reject option hidden in a submenu does not meet regulators' expectations.
• Nothing loads before the answer. If your analytics fires on arrival, the banner is decoration.
• The choice can be changed later, from a permanent footer link.
• The cookie information lists what you use, whose it is, what for and for how long.

In the US: there is no general consent rule, but state privacy laws give residents the right to opt out of targeted advertising and the “sale or sharing” of their data, often through a visible link and by honouring browser privacy signals. The simplest way to comply everywhere is not to use cookies you do not need.

5. If you sell: terms of sale

As soon as someone can pay on your site — a booking deposit, a product, a package — you need terms the customer accepts before paying. They should cover:

• What is sold and the total price, including taxes and shipping, without fees added at the last step.
• How and when you deliver the product or service.
• Cancellation and refunds. In the EU, consumers buying online usually have a 14-day right of withdrawal, with exceptions such as leisure services on a fixed date. In the US there is no general equivalent, so your own policy is what applies: state it clearly.
• Your appointment cancellation policy and what happens to the deposit.
• Warranties on products and how to claim.
• Automatic renewals, if you sell subscriptions: clear disclosure before payment and an easy way to cancel, which many US states and EU countries require.

For the commercial side of selling on your site, see how to sell online.

6. Health data and other sensitive data

If you are a physical therapist, psychologist, nutritionist or run a beauty clinic that asks about allergies or treatments, you handle health data. The bar rises:

• Ask only for what is essential in the booking form. The full history belongs in the consultation, not in a free-text field.
• Explain in more detail the purpose, confidentiality and who has access.
• Sign a data processing agreement with every provider that stores this data. In the US, if you are a covered entity under HIPAA, you need a business associate agreement with them.
• Apply real security: strong passwords, personal accounts, backups and no spreadsheets shared by link.
• Keep a record of what data you process and why: in the EU it is required in many cases, and everywhere it makes your answers consistent.

This is where a professional review of your texts and procedures really pays off. A mistake with health data carries higher penalties and, above all, breaks your patients' trust.

7. Accessibility

In the EU: since mid-2025 the European Accessibility Act requires many consumer e-commerce services to be usable by people with disabilities. Microenterprises providing services are generally exempt. In the US: businesses open to the public face accessibility lawsuits over their websites under the ADA, even small ones.

• Text with enough contrast and a readable size.
• Alternative text on images that carry information.
• Forms and buttons that work with a keyboard and have understandable names.
• Captions on videos with important content.

Meeting the basics is good practice everywhere and helps sales. If you grow or sell widely online, check what applies to you and publish an accessibility statement.

8. Keeping them current

A text that is correct on launch day can be out of date in three months. Review it whenever one of these happens:

• You add a new form or a new field to an existing one.
• You install a tool: analytics, chat, map, video, advertising pixel.
• You start selling something new or taking payment another way.
• You change website, email or payment provider.
• You start sending newsletters or marketing reminders.

Put the date of the last update at the top of each page: it forces a review and shows someone is paying attention. To go over everything else your site needs before launch, see how to create a website for your business.