Privacy Policy, Terms and the Other Legal Pages a Website Needs

Why copied policies fail

It is tempting to copy another site's privacy policy or terms and change the name. The problem is that these pages are statements of fact about your own business. The UK Information Commissioner's Office, in its guidance on drafting privacy information, says to start by working out what personal data you hold, what you do with it, why, where it came from, who you share it with and how long you keep it. A copied policy answers those questions for someone else's business.

An inaccurate policy is a problem in itself. The US Federal Trade Commission's privacy and security guidance tells businesses to reread their privacy policy "to make sure you're honoring the promises you've pledged". If the page promises something your site does not do, that is a claim you can be held to.

Who you are: business details

Visitors, and the law, expect to know who runs a site. In the UK, regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 requires a provider of an online service to make certain information "easily, directly and permanently accessible", including:

• the business name and the geographic address where it is established;
• contact details, including an email address, that allow people to contact it rapidly and directly;
• the register and registration number, if it is on a public trade register such as Companies House;
• details of any regulator, if the service needs authorisation, and of the professional body and rules, for regulated professions;
• the VAT number, if the activity is subject to VAT.

Limited companies have a further duty. GOV.UK's page on company signs, stationery and promotional material says websites must show the registered number, the registered office address, where the company is registered and the fact that it is a limited company. The UK regulations implement an EU directive, so EU countries have similar rules in their own law; check the version where you are established.

These details usually go on a contact or "about" page, in the footer, or both.

The privacy policy

If your site collects personal data, through a contact form, a newsletter sign-up, an account, analytics or advertising tags, you need to tell people about it. In the UK and EU that duty comes from the UK GDPR and the GDPR; our guide to privacy policy and cookie consent basics lists what the information must include. The ICO's drafting advice is practical for any audience:

• Be concise. A layered approach, with a short summary and links to more detail, can meet the need to be both complete and brief.
• Use headings to break the page into separate topics, and keep sentences and paragraphs short.
• Leave out irrelevant information, and write for the people who will actually read it, in clear and plain language.

In the US, California's Online Privacy Protection Act reaches beyond the state. Section 22575 of the California Business and Professions Code requires the operator of a commercial website that collects personally identifiable information about California residents to post its privacy policy conspicuously. The policy must:

• identify the categories of personal information collected and the categories of third parties it may be shared with;
• describe any process for people to review and request changes to their information;
• describe how people will be told about material changes to the policy;
• state its effective date;
• disclose how the site responds to browser "do not track" signals, if it collects information about people's activity across other sites over time, and whether other parties may collect such information through the site.

Larger businesses may also fall under the California Consumer Privacy Act, which our privacy guide covers.

The cookie notice

A cookie banner and a cookie policy do different jobs. The banner asks for consent before non-essential cookies or similar technologies are used; the cookie policy, often a section of the privacy policy, explains what each one does, who sets it and how long it lasts. They must agree with each other and with what the site actually loads. Every time a new analytics, chat, video or advertising tool is added, both need updating. Our guide to cookie consent banners covers the rules and a fair banner design.

Terms and conditions

Terms set the rules of the deal: what you provide, prices and payment, cancellations, liability and how disputes are handled. They matter most when the site sells, takes bookings, runs accounts or lets people post content. A simple brochure site may need little more than terms of use covering the content.

For consumer contracts, the law limits what terms can do. In the UK, section 62 of the Consumer Rights Act 2015 says an unfair term is not binding on the consumer, and defines a term as unfair if, contrary to good faith, it causes a significant imbalance in the parties' rights and obligations to the consumer's detriment. Section 68 requires written terms to be transparent: expressed in plain and intelligible language and legible.

The EU's Your Europe guidance on consumer contracts says the same in its own words: standard terms must be fair, unfair terms are not binding on consumers, terms must be in plain, understandable language so the consumer can understand their economic consequences, and any ambiguity will be interpreted in the consumer's favour. Long, dense terms copied from a much larger company are more likely to fail these tests, not less.

Extra pages for online shops

A site that sells to consumers needs clear delivery, returns and refunds information, and the law gives consumers buying online strong rights. GOV.UK, for example, says UK customers can cancel within 14 days of receiving an item without giving a reason. These rules have their own detail, from what you must tell people before the order to how quickly refunds must be paid. Our ecommerce launch checklist covers them with sources from GOV.UK and the FTC.

Accessibility statement

Under the UK's public sector accessibility regulations, public sector bodies, and some charities and other non-government organisations, must publish an accessibility statement explaining how accessible their website or app is. Most private businesses are outside those regulations, but other laws, such as the European Accessibility Act for some e-commerce and other services, have their own requirements. Our guide to website accessibility laws explains who is covered. Even where it is optional, a short statement saying how the site aims to be accessible and how to report a problem is useful to visitors.

Where to link them and keeping them current

• Link from every page. The footer is the usual place. The UK regulations ask for business information that is easily and permanently accessible, and California asks for a conspicuously posted privacy policy.
• Link at the point of collection. Put a link to the privacy policy next to forms and sign-ups, and to the terms at checkout or account creation.
• Date each page and keep earlier versions, so you can show what applied when.
• Review after changes: a new tool, a new form, a new market or a new way of selling. Our website maintenance checklist includes a yearly check.
• Get advice for anything unusual, such as selling to children, health or financial data, or trading in many countries.

Frequently asked questions

Which legal pages does a business website need?

Usually business details (who you are and how to contact you), a privacy policy if you collect any personal data, a cookie notice if you use non-essential cookies, and terms if you sell, take bookings or run accounts. Shops also need delivery, returns and refunds information. The exact list depends on where you trade.

Can I copy another website's privacy policy?

It is not a good idea. A privacy policy describes what your own business does with personal data. The ICO advises starting by mapping what data you hold, why, who you share it with and how long you keep it, and the FTC warns businesses to make sure they honour what their policy promises.

Do I need a privacy policy if I only have a contact form?

Generally yes. A contact form collects personal data such as names and email addresses, and analytics tools usually collect more. UK and EU law require you to tell people how you use it, and California law requires commercial sites collecting personal information from its residents to post a policy.

What business details must a UK website show?

The UK Electronic Commerce Regulations require the business name, geographic address and contact details including an email address, plus any trade register number, regulator, professional body and VAT number where they apply. Limited companies must also show their registered number, registered office and place of registration.

Are long terms and conditions safer?

Not necessarily. UK and EU consumer law say unfair terms are not binding on consumers and that terms must be in plain, intelligible language. In the EU, ambiguous terms are interpreted in the consumer's favour. This is not legal advice.

Need these pages built into your site, linked from every page and kept in line with the tools you use? See our website development and website maintenance services, or email info@creahive.com.