Practical website compliance starts with a simple question: who visits your site, and where are they when they use it? A local shop site, a store selling across borders, and a service firm taking enquiries from three countries face different duties for the same pages. Privacy notices, cookie choices, terms, email and accessibility cannot be copied safely from another business or from a template written for another market. This checklist works through a business website item by item, separating United States, United Kingdom and European Union duties into labelled sections, so an owner, marketing manager or operations lead can find gaps, assign an owner for each fix, and record when it was last checked.
In short: business website compliance checklist
In short, website compliance is decided by market, and each item on this checklist carries the label of the regime it belongs to.
- Every site: an accurate privacy notice, terms that match how the business actually trades, and honest business details.
- UK facing sites: agreement before non-essential cookies, with no pre-ticked boxes.
- EU facing sites: agreement before non-essential cookies, with no pre-ticked boxes.
- US facing sites: keep the privacy promises the site makes, and follow the FTC email and children’s data rules where they apply.
- Every site: check the site against WCAG for accessibility, as the common benchmark.
Start with where your customers are: why the market decides the rules
A business website does not face one single set of website rules. It faces the rules of the markets it sells to or takes enquiries from. A firm that only trades locally still needs honest identity details, matching terms, and a privacy notice describing what it really does with personal data. Selling into the United Kingdom adds the UK duties below, selling into the European Union adds the separate EU facing duties, and selling to the United States adds the US facing duties, including the Federal Trade Commission approach to privacy promises, commercial email, and children’s data where in scope.
That is why this article is split by regime. A statement accurate for a UK facing site may be wrong if copied into a section about a US facing site. When you work through your own site, write the market next to each item, name its owner, and record the date it was last checked. Our guide to the key essentials of a small business website covers what a site needs to work for customers. This article covers what the same site must contain, promise, and avoid in each market it serves.
Every business website, whatever the market
Some duties apply as good practice in every market, before any regime specific rule is added. They are stated here in general terms only. The regime sections that follow add the specific requirements for UK facing, EU facing, and US facing sites, and nothing in this shared section should be read as a statement of any one country’s law.
Accurate business identity, contact details and honest claims
Start with identity. A visitor should be able to tell, without hunting, who runs the site, what the business is called, where it can be contacted, and how a complaint reaches a real person. Check the business name, address, and contact details against the details the business uses everywhere else. Out of date addresses and contact forms that go nowhere are compliance problems as well as service problems, because a customer who cannot identify or reach the business cannot exercise any other right the site promises.
Honest claims sit in the same check. Prices, qualifications, certifications, review scores, and delivery promises must be claims the business can support; a claim that cannot be evidenced should come off the site until it can. Explore Insiders applies the same discipline to its own pages: its Editorial Policy sets out how content is produced and corrected, and its Privacy Policy is where visitors are pointed for how this site handles personal data. Naming those pages is an example of the practice, not a claim that any site is certified compliant. No checklist can certify a site as compliant.
Terms of sale or service that match how the business actually trades
Terms and the privacy notice do different jobs, and a site needs both. Terms describe the deal: what is being sold, what it costs, when payment is taken, how delivery or performance happens, what happens when something goes wrong, and how cancellation, refunds, or ending a service work. A privacy notice describes what happens to personal data. Merging the two into one long document, or copying terms written for a different trading model, leaves gaps that only appear when a customer disputes an order.
Check your terms against real practice. If the checkout takes payment before dispatch, the terms should say so. If a service renews automatically, the renewal and the way to stop it should be stated before a customer signs up. Where marketing pages promise something the terms then take away, that conflict is itself a finding to fix.
A privacy notice that describes real practice, not a template
Every site that collects personal data, through orders, accounts, enquiry forms, newsletters, analytics, or embedded tools, needs a privacy notice that describes its real practice: the data the site actually collects today, through the tools it actually runs today, shared with the suppliers it actually uses today. A notice copied at launch and never updated will drift out of truth each time a new tracker, booking tool, payment provider, or mailing platform is added.
Build the notice from an inventory, not from memory: each collection point, each tool, each supplier, and each purpose, compared with the notice sentence by sentence. Anything the business does that the notice does not mention is a gap, and so is anything the notice promises that the business does not do. Our guides to website security attacks to watch out for and to cyber security measures for businesses cover the protective side of the same duty.
If you sell to the UK: UK facing duties
This section is only about UK facing sites. The authority used here is the UK Information Commissioner’s Office, known as the ICO. Do not read the US section’s FTC material as UK law, and do not read this section as a statement of EU or US duties. Where your site serves both the UK and the EU, work through this section and the EU section separately.
UK: what a privacy notice must contain
The ICO guide, How to write a privacy notice and what goes in it, tells a small organisation to have key information ready before it writes: its full contact details, the types of personal data it collects, where people’s data came from if it was not collected from them directly, why it holds the information and what it does with it, its lawful basis and its legitimate interests where relevant, who it shares information with, and how long it holds information before getting rid of it securely. The notice also needs to cover people’s information rights, including the right to withdraw consent where consent is the lawful basis, and to tell people how they can complain.
The ICO’s detailed page, Cookies and privacy notices in detail, adds that everything in the notice needs to be simple to read and easy to access, in plain language, from the pages where data is collected.
For UK facing sites, the ICO guide to the Privacy and Electronic Communications Regulations, Cookies and similar technologies, states the basic rule in three parts: tell people the cookies are there, explain what the cookies do and why, and get the user’s consent. Consent must be actively and clearly given. The same rules apply to similar technologies that store or access information on someone’s device, not only to files called cookies.
The ICO wording a UK facing site must carry exactly is this. Non-essential cookies need clear information and the user’s agreement first, before they are set. Consent needs a clear positive action. Continued browsing is not valid consent. Pre-ticked boxes and default-on sliders are not valid. Third parties behind cookies must be named specifically, so a visitor can tell which third parties will store or access information, or receive it, and what they will do with it. Consent sits separately from terms and from the privacy notice: it is not bundled into acceptance of terms, and it is not buried inside the privacy notice.
Run the UK cookie check in this order. List every cookie and similar technology the site sets, including those set by analytics, advertising, video, chat, and social tools. Separate strictly necessary items from non-essential items honestly. Confirm that no non-essential item is set before a visitor has taken a clear positive action to agree, that there are no pre-ticked boxes or default-on sliders, and that refusing is as usable as accepting. A banner tool on its own does not make a site compliant: it must be configured so this behaviour is what actually happens on the live site.
If you sell to the EU: EU facing duties
This section is only about EU facing sites, and it is kept separate from the UK section on purpose. The United Kingdom and the European Union now operate separate regimes, and a business that serves both must check each one separately rather than treating a UK check as an EU check, or the other way round.
For EU facing sites, the load bearing points are the ones in this article’s summary, labelled as EU facing duties. EU facing sites need agreement before non-essential cookies, with no pre-ticked boxes, plus an accurate privacy notice, matching terms, and honest business details, as the shared section describes. Those statements are deliberately narrow: detailed EU requirements vary, and member state guidance differs, so a business selling seriously into the EU should have its notice, consent setup, and terms checked by a qualified adviser for those markets. Do not fill gaps here with UK wording: the ICO is a UK authority. If your EU check cannot be completed from an EU source you trust, record it as an open item below, with an owner and a review date.
If you sell to the US: US facing duties
This section is only about US facing sites. The authority used here is the Federal Trade Commission, known as the FTC. The United States does not have one single federal website privacy code of the kind a reader might expect from the UK section, so the US duties here are stated exactly as the FTC frames them: keep the privacy promises you make, follow the FTC commercial email rules if you send commercial email, and follow the FTC children’s data rule where it is in scope.
US: FTC expectations on privacy promises and data practices
For a US facing site, the starting duty is honesty about data practice. If your privacy notice, checkout pages, or marketing copy tell visitors that data will be kept private, used only for a stated purpose, or never shared, the business must actually do that. The FTC acts against unfair and deceptive practices, and a privacy promise the business does not keep is exactly the kind of statement that creates exposure. The check is a promise audit: read every privacy claim on the site, not only the formal notice, and test each claim against what the business’s tools and suppliers really do, especially sharing by analytics, advertising, and embedded services.
US: commercial email, the CAN-SPAM basics for business senders
If a US facing business sends commercial email, the FTC guide, CAN-SPAM Act: A Compliance Guide for Business, is the source to work from. The FTC states that the CAN-SPAM Act covers all commercial messages, meaning any electronic mail message whose primary purpose is the commercial advertisement or promotion of a commercial product or service, including email that promotes content on commercial websites, and that the law makes no exception for business to business email.
The FTC lists the main requirements as follows. Do not use false or misleading header information, and do not use deceptive subject lines. Identify the message as an advertisement, clearly and conspicuously. Include a valid physical postal address. Tell recipients how to opt out, with a clear explanation and an easy internet based method, including an option to stop all marketing messages. Honour opt-out requests promptly: the FTC states that the opt-out mechanism must work for at least 30 days after the message is sent, that a request must be honoured within 10 business days, that no fee may be charged, and that opted out addresses may not be sold or transferred except to a company hired to help comply with the Act. Finally, monitor what others do on your behalf: hiring another company does not contract away your legal responsibility.
The website connection is direct: signup forms and preference pages create the mailing list these duties govern. Check that an opt-out given on the site is honoured by the mailing platform and by any agency sending on the business’s behalf, and keep the signup wording and opt-out process as evidence.
US: children’s data, when COPPA is in scope
Children’s data is a separate US check, because the rule is narrower than many owners assume and stricter than they expect where it does apply. The FTC page, Children’s Online Privacy Protection Rule: Not Just for Kids’ Sites, and the FTC’s Children’s Online Privacy Protection Rule (COPPA) page, state the scope in the FTC’s current wording. COPPA imposes requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.
Test a US facing business against both limbs. First, is any part of the site or service child-directed, meaning directed to children under 13? Second, even on a general audience site, does the operator have actual knowledge that it is collecting personal information from children under 13, for example because a registration form receives information showing a user is under 13? If either answer is yes, COPPA is in scope for that collection. The FTC also states that third party services collecting information through a child-directed site can be covered where they have that knowledge. Most ordinary business sites will answer no to both limbs, but it must be a considered no, recorded on the checklist.
One currency point must be kept with this section. The COPPA Rule was amended on 22 April 2025, so older summaries of COPPA may be out of date. Use the current FTC COPPA guidance, as linked above, and record which guidance you checked and on what date. If your service is child-directed, or you discover actual knowledge collection from children under 13, take qualified US advice before changing forms or notices on your own, because the parental notice and verifiable parental consent duties that follow are specific.
Accessibility: the section every site needs
Accessibility is a shared section in this article, because the benchmark is shared even though the legal duties sit in different regimes. That benchmark is WCAG, the Web Content Accessibility Guidelines. The sections below state the WCAG benchmark first, then the US position exactly as the Department of Justice states it, then the UK position in the limited terms an official UK source supports, and close with practical checks any site can run. The benchmark being common does not make the legal duties identical.
What WCAG requires in plain terms: perceivable, operable, understandable, robust
The W3C Web Content Accessibility Guidelines (WCAG) page describes WCAG as the guidelines published by the Web Accessibility Initiative of the World Wide Web Consortium. WCAG is organised around four principles. Perceivable means information and user interface components must be presentable to users in ways they can perceive. Operable means user interface components and navigation must be operable. Understandable means information and the operation of the user interface must be understandable. Robust means content must be robust enough to be interpreted reliably by a wide variety of user agents, including assistive technologies.
For a compliance owner, those four words become practical questions. Perceivable: are there text alternatives for images and captions for video? Operable: can every task be completed with a keyboard alone? Understandable: is the language plain, and do forms explain errors in words rather than colour alone? Robust: does the site work with assistive technologies as they change? Using WCAG as a benchmark is good practice for every site. It must not be converted into a legal claim the sources do not support.
The US position: ADA duties for businesses open to the public
For US facing sites, the source is the Department of Justice guidance on ADA.gov, Guidance on Web Accessibility and the ADA. The position to keep exact is this. ADA Title III covers businesses open to the public. The DOJ’s Title II web rule sets WCAG 2.1 Level AA for state and local government web content and mobile apps. For private businesses, the DOJ has set no detailed technical regulation. Its guidance says the ADA’s general nondiscrimination and effective communication duties apply to websites, and that WCAG and Section 508 standards are helpful guidance businesses can use.
The ADA.gov guidance adds that businesses have flexibility in how they comply with the ADA’s general requirements of nondiscrimination and effective communication, but they must comply. That is why this article never presents WCAG 2.1 AA as a legal requirement for private businesses: it is the Title II technical standard for state and local government web content and mobile apps, and helpful guidance for a private business meeting its general ADA duties.
The UK position: reasonable adjustments and the WCAG benchmark
For UK facing sites, this article limits itself to what an official UK source supports, and invents no Equality Act specifics beyond it. The GOV.UK guidance, Understanding accessibility requirements for public sector bodies, explains that the public sector accessibility regulations build on existing obligations under the Equality Act 2010, that all UK service providers have a legal obligation to make reasonable adjustments under the Equality Act 2010 or, in Northern Ireland, the Disability Discrimination Act 1995, and that a service provider must still make reasonable adjustments for disabled people when they are needed, for example by providing information in another, more accessible format.
For a private business with a UK facing site, the safe framing supported by that source is this: treat reasonable adjustments as a live duty, treat WCAG as the benchmark you check the site against, and publish a clear way for a visitor who hits a barrier to ask for the information or service in another format. This article does not set out detailed Equality Act tests or thresholds for private businesses, because those specifics were not verified from an official UK source in a form a checklist can safely carry.
The practical checks: contrast, alt text, captions, labelled forms, keyboard use, and a way to report problems
Whatever the market, run the same practical checks. Check colour contrast, and that colour is never the only way information is given: a required field marked only in red needs a text cue too. Check text alternatives for images, video captions, and online forms for labels, clear instructions, keyboard access, and an understandable error message. Check headings and keyboard navigation by completing the site’s key tasks without a mouse. Close the loop with a reporting route, such as a telephone number or email address for accessibility problems, owned by a named person. Record each check with a date and a page list.
The walkthrough checklist: page by page, item by item
Use this table to walk your own site. For each row, write the market, the owner, the evidence you checked, and the review date. A row with no owner or no date is not done.
| Page or item | Regime label | What to check | Owner and review date |
|---|---|---|---|
| Business identity and contact details | Every site | Name, address, and contact route match real practice | Name the owner; record the date checked |
| Claims, badges, prices, and review scores | Every site | Every claim can be evidenced; remove any claim that cannot be supported | Name the owner; record the date checked |
| Terms of sale or service | Every site | Terms match how the business trades, including payment, delivery, renewal, and refunds | Name the owner; record the date checked |
| Privacy notice contents | UK facing | ICO contents present: data types, source, purposes, lawful basis, sharing, retention, rights, and complaints | Name the owner; record the date checked |
| Cookie information and consent | UK facing | Agreement before non-essential cookies; clear positive action; no pre-ticked boxes; third parties named specifically; consent separate from terms and notice | Name the owner; record the date checked |
| Cookie information and consent | EU facing | Agreement before non-essential cookies; no pre-ticked boxes; EU source check recorded, or item left open with an owner | Name the owner; record the date checked |
| Privacy promises across the site | US facing | Every privacy claim on every page matches real tool and supplier practice | Name the owner; record the date checked |
| Commercial email | US facing | CAN-SPAM basics met: accurate headers, honest subject lines, ad identification, postal address, opt-out honoured within 10 business days | Name the owner; record the date checked |
| Children’s data | US facing | Both COPPA limbs tested: child-directed service, or actual knowledge of collection from children under 13; current FTC guidance used | Name the owner; record the date checked |
| Accessibility checks | Every site, WCAG benchmark | Contrast, alt text, captions, labelled forms, keyboard use, headings, zoom, and a route to report problems | Name the owner; record the date checked |
| Accessibility position statement | US facing and UK facing, stated separately | US ADA position stated exactly as sourced; UK reasonable adjustments framing used; WCAG 2.1 AA never stated as a legal requirement for private businesses | Name the owner; record the date checked |
Work the table in the order customers meet the site: home page, product pages, checkout or enquiry form, signup pages, help pages, then the policy pages. Many failures hide in the joins, such as a checkout tracker the notice never mentions. The table is a finding tool, not a certificate, and honest open items are worth more than rows ticked without evidence.
Keeping it true: reviewing the notice and consent setup whenever tools, trackers or suppliers change
Website compliance decays each time a marketer adds a tracker, a developer installs a plugin, or a team changes a booking or payment supplier without telling the page owner. Each change can make the privacy notice untrue, set a non-essential cookie before agreement on a UK or EU facing site, break a privacy promise on a US facing site, or remove an accessibility feature.
The defence is a trigger list and a scheduled review together. Triggers that force an immediate check: a new tool or tracker, a new supplier receiving personal data, a new market, a new signup or checkout feature, a change to email practice, and any new content aimed at children, which forces the US COPPA question again. The scheduled review works the walkthrough table at a set interval and retests accessibility after any redesign. Assign one named owner, with a deputy, and keep dated evidence: the notice and terms at each review, the tool inventory, and the consent wording as a visitor saw it.
A note before you act: this guide is general information, not legal advice
This article is general information for business readers, not legal advice. Deadlines, tests and duties depend on your jurisdiction, your business structure and your industry, so a qualified local adviser should check anything you are about to act on, especially anything involving a new market, a contested accessibility complaint, a child-directed service, or a change to how personal data is collected, shared, or used for email marketing.
With that qualification in place, the working message is plain. Label every duty by regime and never merge regimes into one statement about the law. Keep identity, terms, and the privacy notice true to real practice. For UK facing and EU facing sites, get agreement before non-essential cookies, with no pre-ticked boxes. For US facing sites, keep every privacy promise, run commercial email to the FTC CAN-SPAM basics, and test the COPPA question honestly using current FTC guidance. For every site, check accessibility against WCAG as the common benchmark, state the ADA position exactly as sourced, and never present WCAG 2.1 AA as a legal requirement for private businesses.
Sources used for this article
- UK Information Commissioner’s Office, “How to write a privacy notice and what goes in it”: https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/how-to-write-a-privacy-notice-and-what-goes-in-it/
- UK Information Commissioner’s Office, “Cookies and similar technologies” (PECR guide): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/
- UK Information Commissioner’s Office, “Cookies and privacy notices in detail”: https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/cookies-and-privacy-notices-in-detail/
- ADA.gov, “Guidance on Web Accessibility and the ADA”: https://www.ada.gov/resources/web-guidance/
- W3C, Web Content Accessibility Guidelines (WCAG): https://www.w3.org/WAI/standards-guidelines/wcag/
- Federal Trade Commission, “CAN-SPAM Act: A Compliance Guide for Business”: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
- Federal Trade Commission, “Children’s Online Privacy Protection Rule: Not Just for Kids’ Sites” and “Children’s Online Privacy Protection Rule (COPPA)”, for the current FTC COPPA scope wording following the COPPA Rule amendment of 22 April 2025.
- GOV.UK, “Understanding accessibility requirements for public sector bodies”, for the UK reasonable adjustments framing for service providers.
Frequently asked questions
Does every business website need a privacy notice?
Every site that collects personal data needs an accurate privacy notice that describes its real practice. For UK facing sites, the ICO expects the notice to cover data types, purposes, lawful basis, sharing, retention, people’s rights and how to complain. For US facing sites, the notice and every other privacy promise on the site must be kept in practice.
It depends on the regime and the cookie. For UK facing sites and EU facing sites, non-essential cookies need the user’s agreement first, before they are set. For US facing sites, this article states no single federal cookie consent rule, and the US check is whether the site keeps the privacy promises it makes about cookies and data.
No, not for UK facing sites. The ICO states that continued browsing is not valid consent, that consent needs a clear positive action, and that pre-ticked boxes and default-on sliders are not valid. The same agreement first approach is stated for EU facing sites in this article, with no pre-ticked boxes.
What accessibility standard should a small business website aim for?
Aim to check the site against WCAG, the common benchmark, whose principles are perceivable, operable, understandable and robust. For US facing sites, WCAG 2.1 Level AA is the standard in the DOJ’s Title II rule for state and local government web content and mobile apps, and it is not stated in this article as a legal requirement for private businesses, for whom the DOJ has set no detailed technical regulation.
Do website terms and the privacy notice do the same job?
No. Terms describe the deal, including what is sold, payment, delivery, renewal and refunds, while a privacy notice describes what happens to personal data, including why it is collected, who it is shared with and how long it is kept. A site needs both, and for UK facing sites cookie consent sits separately from both terms and the privacy notice.
How often should a business review its website compliance?
Review whenever tools, trackers, suppliers or practices change, and on a scheduled cycle as well. A new tracker can affect a UK facing or EU facing cookie consent setup and a US facing privacy promise on the same day, so the review should work through every regime label that applies to the site, with an owner and a date recorded for each item.
