Website Legal Requirements: Privacy, Cookies and Sales

It depends on what the site does. A site that only introduces the company and gives contact details needs little; the list grows as a contact form, a newsletter sign-up, accounts, cookies or sales are added. Start by writing down what your site really does: what data does it collect, which tools does it load, and does it sell anything?

That inventory is also the basis of your conversation with a lawyer. The lawyer decides which text is mandatory for you, and you arrive with a clear picture.

• Privacy notice: for forms and registrations that collect personal data
• Privacy policy: how data is handled across the site
• Cookie notice and choice settings: for sites that use cookies or similar trackers
• Distance-selling terms and pre-contract information: for sites that sell
• Business details: company name, address, ways to get in touch

A privacy notice tells a person who leaves their data who will use it, for what purpose and how. On the site, the job is to make that notice readable at every point where data is collected: the contact form, the newsletter sign-up, account creation, orders, quote requests and application forms. It should not be buried in a corner of the page but reachable through a link close to the form.

The privacy policy describes how the site handles data in general. On most sites the two are separate pages that link to each other. Where consent is needed, pre-ticked boxes are generally not regarded as suitable, so settle with your lawyer how the box should work. Do not copy a text from another site, because it will not describe the data you collect.

Have a lawyer decide the content of the texts, the legal basis relied on and the retention periods. The site's task is to connect the text the lawyer prepares to the right places, and to keep each form limited to the data it really needs.

A cookie notice is not just a banner; it is the real application of the choice made in it. List which cookies and similar trackers run on your site: measurement tools, advertising tags, embedded video and maps, chat windows. Under what conditions cookies that the site does not need to function may load before the visitor chooses is a legal question. On the technical side, a setup that can load tools according to the choice must be ready.

Visitors must be able to change their choice later, so a permanent link or button should sit at the foot of the page. We cover cookie consent and passing the choice to measurement tools in our cookie consent article. The cookie check tool on our site is a quick way to see which cookies your page sets. Write the banner text and the category names with a lawyer's advice.

The general framework is this: on sites that sell products or services online, the buyer should see information about the seller, the product, the total price, delivery and withdrawal terms before placing the order, and should confirm the contract. This information and the contract text are shown, readably, before the payment step. Its scope and wording are for a lawyer to decide.

The site's tasks are these: links to the texts on the payment page, a separate confirmation step before the order, sending the buyer a copy of the contract and the information after the order, and making withdrawal information reachable from product pages and the order flow. Exceptions to the right of withdrawal vary by product, so ask a lawyer which of your products fall under an exception and whether the text fits your product groups.

A visitor should be able to see who owns the site. The trade name, address, ways to get in touch and tax or registration details usually sit in the footer or on a separate contact page. Which details are required for you depends on your company type and activity, so settle this with your lawyer and your accountant.

One topic often forgotten here is newsletters and campaign messages. In general, sending commercial electronic messages needs the person's permission and an easy way out. Set up a record that keeps who gave permission, when and under which wording, and agree its scope with your lawyer.

The most common mistake is copying a ready-made text as it stands; it does not describe the data you collect, the tools you use or your terms of sale. The second is putting the text on a page without connecting it to the form and the flow: there is no link beside the form and no confirmation box at the payment step.

The third is not updating the texts after the site changes. If a new form, a new measurement tool or a new payment method has been added, the text and cookie settings must be updated too. The fourth is a banner where you choose to refuse but the tools keep running in the background; choice and behaviour must agree. Go through these points with a lawyer.

Placing distance-selling terms on a site that sells nothing is unnecessary and misleads visitors; the text should reflect what the site really does. A very plain site that uses no forms, sign-ups, cookies or measurement tools and only gives information needs few texts. That simplicity ends when a tool is added later, so review the texts then.

Putting up a cookie banner as decoration, leaving the whole decision to a plugin, or having an AI write legal texts and publishing them unchecked are wrong choices. In each case the final decision belongs to a lawyer, and the site team applies that decision correctly.