Which pages you need
| Page | When | Main rules |
|---|---|---|
| Privacy notice | Whenever you collect personal data, including via contact forms, analytics or orders | GDPR / UK GDPR; in the US, California’s CalOPPA and state privacy laws |
| Cookie notice and consent | When you use non-essential cookies or similar tracking (analytics, ads, affiliate tracking) | UK PECR; EU ePrivacy Directive |
| Terms of sale | When you sell to customers | Consumer law (UK Consumer Rights Act, EU Consumer Rights Directive, US state law) |
| Business details | Always in the UK and EU | UK Electronic Commerce Regulations 2002 and company law; EU E-Commerce Directive (and Germany’s “Impressum”) |
| Website terms of use | Recommended for most sites | Contract law |
What a privacy notice must cover
Under the GDPR and UK GDPR, tell people, in clear and plain language:
- who you are and how to contact you (and your data protection officer, if you have one);
- what personal data you collect, why, and your lawful basis for each purpose;
- who you share it with, and whether it’s transferred abroad;
- how long you keep it;
- people’s rights, including access, correction, erasure and objection, and the right to complain to the regulator.
In the US, California’s CalOPPA requires commercial websites that collect personally identifiable information from California residents to post a privacy policy. Businesses covered by the California Consumer Privacy Act must also offer rights such as opting out of the “sale” or “sharing” of personal information, and honour Global Privacy Control signals.
Cookie consent done right
- Strictly necessary cookies (such as a shopping basket or security) don’t need consent.
- Other cookies, including most analytics, advertising and affiliate tracking, need consent before they are set.
- Rejecting should be as easy as accepting, with no pre-ticked boxes and no “cookie walls” that leave no real choice.
- Let people change their mind at any time.
Regulators such as the UK’s ICO and France’s CNIL actively enforce these rules. In the UK, the Data (Use and Access) Act 2025 creates new exemptions from consent for some low-risk cookies, such as certain analytics, as its provisions come into force, so follow the ICO’s latest guidance.
Terms and conditions
- Write terms that fit your business and the law where your customers are. Copying another company’s terms can infringe their copyright and may not match your business or the right law.
- In the UK and EU, unfair terms in consumer contracts aren’t binding on consumers, and terms must be transparent.
- Cover ordering, prices, delivery, cancellation and returns, faulty goods, liability and how to complain.
General information, not legal advice. Rules vary by country, state and situation, and they change. Check the official sources below, and speak to a qualified lawyer or accountant before making decisions for your business.
Last updated: 14 October 2026
