Legal Requirements for Business Websites
Introduction
Business websites must comply with a range of legal requirements. Some of these apply to all business websites, and others only apply in specific circumstances; for example if you collect customers' data or sell goods and services via your website.
Here we provide a checklist of some of the key legal requirements relating to business websites. It is intended as a starting point only, and appropriate professional advice should always be taken where necessary.
Providing information about your business
Generally, your business website must display:
The name of your business.
Trading address.
Business email address and phone number.
VAT registration number (if applicable).
If your business is a registered limited company or limited liability partnership, your website must also display certain information that is set out in the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015, such as:
Where in the UK it is registered (i.e. England and Wales, Scotland or Northern Ireland).
The registration number.
The address of its registered office.
If you are a sole trader and the name of your business is different from your own name, you must provide your name in addition to the business name.
Data protection and privacy
The General Data Protection Regulation (GDPR) makes several requirements relating to business websites, including the following:
If your business collects or processes personal data via your website (for example if it asks for users' email addresses), you must clearly display a privacy notice stating information such as the purposes for which you are collecting the data, how long it will be kept and who, if anyone, it will be shared with.
Online forms asking for website users' personal details should collect a minimum of information.
Tick-boxes asking for consent for your business to use personal data must not be pre-ticked. Consent must require an active 'opt-in' and it must be easy for users to withdraw consent at any time.
Consent to use cookies
If your website stores cookies on website users' devices to collect data such as their viewing preferences and browsing habits, you must provide a clear explanation of what each cookie does and get website users' active consent to store them, for example by asking them to click an 'accept cookies' button. It must be easy for website users to select which cookies they will accept and which they will reject. It must also be easy for them to withdraw consent. These requirements are made by the Privacy and Electronic Communications Regulations 2003.
Alternative dispute resolution
If you are required to use an alternative dispute resolution (ADR) service to resolve customer complaints, your website must provide the name and web address of that ADR service, under the Alternative Dispute Resolution for Consumer Disputes (Competent Authorities and Information) Regulations 2015.
Many traders are required to use an ADR service under the terms of their membership of a trade association or a quality assurance scheme and must therefore provide information about the service on their website. For example, the Federation of Master Builders operates its own ADR service that members must use in the event of a customer complaint, and the Which? Trusted Trader Scheme requires traders to use the services of the Dispute Resolution Ombudsman.
Consumer protection
Various regulations set out requirements you must meet if you sell goods or services via your website. For example:
Under the Electronic Commerce (EC Directive) Regulations 2002, your website must provide information about how to place an order and correct any input errors before confirming it. Buttons that confirm an order must be clearly labelled - for example, 'Confirm Your Order and Pay'.
Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, you must provide consumers with certain pre-contract information, such as pricing, payment and cancellation terms.
Under the Price Marking Order 2004, the retail prices of items offered for sale to consumers must be clearly displayed and must include VAT, where applicable.
Under a range of product-specific regulations, you may be required to make online age-verification checks before selling restricted items such as alcohol, knives, tobacco and lottery tickets.
Website security
Under the Payment Card Industry Data Security Standard (PCI DSS) and the GDPR, if your website collects and processes payment card details or other personal data, you must have adequate security measures in place to prevent unauthorised access to that data.
Accessibility
Under the Equality Act 2010, you must make 'reasonable adjustments' to ensure that your website is accessible to people with disabilities. The FSB (Federation of Small Businesses) publishes guidance about how to make your website accessible at www.fsb.org.uk/resources-page/seven-best-practices-for-website-accessibility.html.
Passing off
'Passing off' means deliberately or accidentally misrepresenting your goods and services as being those of another trader or associated with another trader. For example, if your website makes multiple links to the web pages of another business, this may amount to passing off because it could mislead website users into thinking that the two businesses are associated.
Similarly, if you use a domain name or website design features that are misleadingly similar to those of another business this could constitute passing off. In some cases it may also amount to an infringement of the other business's trade mark.
Copyright
Under the Copyright, Designs and Patents Act, you must not use copyright-protected material, such as text and images, on your website without the permission of the copyright holder.
Software and coding used to build websites are also protected by the Act and must not be used without permission.
Contact Ashored for help and support with your business.
