What does a business website legally need?

What a website needs legally depends on what it does and who it serves. A site that only presents a local business has far fewer obligations than one that sells online or collects data at scale. Here's each requirement in turn, the law behind it, and what changed in 2025 and 2026.

At a glance

A privacy policy

California's Online Privacy Protection Act (CalOPPA) requires any commercial website that collects personally identifiable information from California residents to post a privacy policy conspicuously. Names, email addresses and phone numbers from a contact form all count. Because a website can't keep Californians out, most US businesses treat this as a national requirement.

Under CalOPPA, the policy has to:

• list the categories of personal information you collect and the kinds of third parties you share it with;
• explain how visitors can review and request changes to their information, if you offer that;
• explain how you'll notify visitors of changes to the policy, and show its effective date;
• say how the site responds to browsers' "Do Not Track" signals;
• say whether other parties can collect information about visitors' activity over time and across sites, for example through ad pixels.

Link to the policy in the footer of every page and next to every form.

State privacy laws

By August 2026, 20 US states had comprehensive consumer privacy laws in effect, with more signed and taking effect in 2027. They give residents rights such as accessing and deleting their data and opting out of its sale or use for targeted advertising.

Most of these laws only apply above a threshold. California's CCPA, the best known, covers businesses that do business in California and meet at least one of these tests:

• $26.625 million or more in annual gross revenue (the figure since 1 January 2025);
• buying, selling or sharing the personal information of 100,000 or more California residents or households;
• making 50% or more of revenue from selling or sharing personal information.

A café or a dental practice usually falls below every threshold. A growing online store or a business with a large marketing list should check each state where it has customers.

Cookies and tracking

No federal law requires a cookie banner in the US. Two situations change that:

• State opt-out rights. Where a state privacy law applies to you, visitors can opt out of targeted advertising, and several states require you to honour browser opt-out signals such as Global Privacy Control.
• EU and UK visitors. If your site targets people in Europe, the GDPR and ePrivacy rules require consent before analytics, ad pixels and other non-essential cookies are set.

Email and text marketing

CAN-SPAM applies to every commercial email, not just bulk campaigns. The FTC's guide lists the main rules: no misleading "From" lines or subject lines, identify the message as an ad when it is one, include your physical postal address, offer a clear way to opt out and honour opt-outs within 10 business days. Each email that breaks the law can cost up to $53,088 in penalties.

Text messages fall under the Telephone Consumer Protection Act: promotional texts need the recipient's prior express written consent, and carriers require businesses to register before sending texts from a regular phone number.

Accessibility

The Department of Justice says the ADA applies to the websites of businesses open to the public, and accessibility lawsuits are common: more than 3,000 were filed in federal courts in 2025. What that means for your site is in website accessibility: the ADA and the European Accessibility Act.

If you sell online

A site that takes orders and payments needs clear terms before checkout:

• the full price, taxes and shipping costs;
• delivery times; the FTC's Mail, Internet or Telephone Order Merchandise Rule requires you to ship within the time you state, or within 30 days if you don't state one;
• your return and refund policy;
• for subscriptions, the renewal terms and how to cancel.

The FTC's "click-to-cancel" rule was struck down by a federal appeals court in July 2025, but the Restore Online Shoppers' Confidence Act still applies, and states such as California, New York and Minnesota have their own automatic renewal laws with cancellation requirements.

If you have UK or EU customers

• UK companies must show on their website the registered company name, registration number, registered office address and where the company is registered.
• Selling to EU consumers brings EU rules: company details on the site, GDPR-compliant privacy information, cookie consent and a 14-day right of withdrawal. From 19 June 2026, the EU also requires a withdrawal function for online contracts: a clearly labelled "withdraw from contract here" button, a confirmation step, and an acknowledgement sent by email with the date and time.
• Accessibility: since 28 June 2025, the European Accessibility Act applies to online stores selling to EU consumers, with an exemption for micro-enterprises.

Checklist

1. A privacy policy written for your site, linked in the footer and next to every form.
2. Contact details and, for a UK company, the registered details in the footer.
3. No tracking pixels you don't actually use.
4. Marketing emails with your postal address and a working unsubscribe link.
5. Accessible design: contrast, alt text, labelled forms, keyboard navigation.
6. If you sell: prices, shipping, refunds and cancellation terms before checkout.

When we build a site, we start from this list: the right privacy policy for what the site actually does and as few trackers as possible. The details are on our web design page, and the rest of what a site should contain is in what a small business website should include.