What is legally required on a small business website?

Does every business website need the same legal pages?

No.

A simple informational website has different requirements from an online store or a patient portal.

A business that collects only basic contact information may have different obligations from one that processes payments or stores sensitive records.

Legal requirements can also vary by jurisdiction. The Federal Trade Commission's advertising guide for small businesses notes, for example, that every state has consumer protection laws that govern ads running in that state.

That means a checklist copied from another website may not apply to your business.

We'd start by understanding what your website actually does.

Does it collect personal information?

Does it use analytics or advertising technology?

Does it sell products?

Does it offer subscriptions?

Does it publish customer photographs or testimonials?

Does it serve customers in places with specific privacy requirements?

Those questions help identify which legal issues deserve attention.

This is general information, not legal advice.

Do you need a privacy policy?

Many businesses need privacy disclosures. The requirements come from several laws and from the services a website uses.

For example, the Federal Trade Commission says the federal children's privacy rule, known as COPPA, applies to websites directed to children under 13 and to general audience websites with actual knowledge that they are collecting personal information from children under 13. It says covered operators must post a clear and comprehensive online privacy policy.

A service can require one too. Google's terms for Google Analytics say a site that uses it must post a privacy policy and "must disclose the use of Google Analytics, and how it collects and processes data."

A privacy policy explains how information is collected, used, shared and handled.

But simply having a page titled Privacy Policy doesn't guarantee compliance.

The content needs to reflect what the website actually does. The FTC says that when companies tell consumers they will safeguard their personal information, it can and does take law enforcement action to make sure they live up to those promises.

For example, a website might collect information through contact forms.

It might also use analytics, advertising tools or third-party booking systems.

Those services can affect what information is processed and by whom.

A generic policy that describes services you don't use may be inaccurate.

A policy that ignores important tools may be incomplete.

We'd document your actual data practices before drafting the policy.

And we'd avoid copying another company's policy without reviewing it.

Are terms and conditions required?

Not every informational website necessarily needs a terms and conditions page.

But terms can be useful when customers purchase products, create accounts or use services through the website.

They may explain payment arrangements, account responsibilities, service limitations and other contractual matters.

Whether particular terms are legally required or enforceable depends on the circumstances and applicable law.

An online store may also need clear information about shipping, returns, cancellations and pricing.

Those details shouldn't be hidden in complicated language.

Customers should understand what they're agreeing to.

We'd focus on making the actual business policies clear before worrying about how impressive the legal wording sounds.

And if the website supports contracts or subscriptions, qualified legal review is worthwhile.

What about cookies and tracking?

Cookies are small pieces of data websites can store through a browser.

They can support functions such as keeping someone signed in or remembering preferences.

Other technologies may help measure website activity or support advertising.

The legal requirements for notices and consent depend on the technologies used and the laws that apply.

The tools themselves can set conditions. Google's terms for Google Analytics, for example, say the site's privacy policy must provide notice of its use of cookies, and that the site will use commercially reasonable efforts to get a visitor's consent to cookies where obtaining that consent is required by law.

Not every website needs the same cookie banner.

And displaying a banner doesn't automatically make the underlying tracking compliant.

We'd first identify which tools the website uses.

Then determine what information they collect and whether consent or additional disclosures are required.

Don't install a complicated consent system simply because another website has one.

But don't ignore privacy obligations because your website is small.

Is website accessibility legally required?

Accessibility can be relevant to a business's obligations under disability rights laws, including the ADA. Title III of the ADA covers businesses open to the public, and the Department of Justice says that includes what those businesses offer on the web.

Accessible websites help people with disabilities use information and services.

That can include keyboard navigation, screen reader support and readable forms.

The specific legal requirements depend on the business and applicable rules. The Department of Justice says businesses have flexibility in how they comply, but must still ensure that the goods and services they provide to the public are accessible.

There isn't one universal technical checklist that automatically resolves every legal issue for every private business website. The Department of Justice says it does not have a regulation setting out detailed standards, and it points to the Web Content Accessibility Guidelines and the federal Section 508 standards as helpful guidance.

We'd treat accessibility as part of responsible website development.

Make important features usable.

Test forms and navigation.

And address barriers when they're identified.

Don't rely on a plugin that promises complete legal compliance without explaining what it actually fixes. Here is how much it costs to make a website ADA compliant.

What if your website sells products?

Online selling introduces additional considerations beyond how much an ecommerce website costs.

Customers need accurate product information.

Pricing and payment terms should be clear.

Refund, cancellation and delivery policies may be subject to consumer protection requirements. For example, the FTC says its Mail, Internet, or Telephone Order Merchandise Rule applies to most goods a customer orders on the internet. Under it, a seller must have a reasonable basis for any shipping time it states, or for believing it can ship within 30 days if it states none.

The FTC's guide to that rule says a seller that can't ship on time must either seek the customer's consent to the delay or cancel the order and make a full refund.

If you sell subscriptions, automatic renewal and cancellation rules may also apply. The FTC describes a federal law, the Restore Online Shoppers' Confidence Act, as requiring an online seller to clearly disclose all material terms before obtaining billing information, get the customer's express informed consent before charging, and provide a simple mechanism for stopping recurring charges.

You may have heard of the FTC's 2024 "click to cancel" rule. The FTC now refers to it as the vacated 2024 rule, and in March 2026 it asked for public comment on whether to amend its Negative Option Rule.

And if you collect payment information, you need to consider the security and contractual requirements associated with your payment provider. The FTC's guide Protecting Personal Information says laws including the Federal Trade Commission Act may require a business to provide reasonable security for sensitive information.

We'd use an established payment system rather than attempting to handle sensitive card information through a homemade process.

But using a third-party provider doesn't eliminate every responsibility.

Your business still needs to describe what customers are purchasing and handle transactions appropriately.

What about photographs, logos and testimonials?

You should have appropriate rights or permission to use content on your website.

That includes photographs, illustrations, music, written material and other creative work, and it is a separate question from who owns your website.

Copyright and licensing requirements can apply even when content is easy to find online. The U.S. Copyright Office says copyright exists automatically in an original work of authorship once it is fixed, and it lists photographs, illustrations and musical compositions among the works covered.

Don't assume a photograph is free to use because it appears in search results. In cases of doubt, the Copyright Office recommends that permission be obtained.

The same applies to customer testimonials.

Make sure testimonials are genuine. The FTC's Consumer Reviews and Testimonials Rule went into effect on October 21, 2024. The FTC says it prohibits businesses from creating or selling fake reviews and testimonials, and from buying fake reviews or disseminating fake testimonials when the business knew or should have known they were fake.

The FTC's Endorsement Guides also say an endorsement must reflect the honest opinion of the endorser.

Avoid inventing reviews or making unsupported claims. The FTC says ad claims on the internet must be truthful and substantiated.

If your website describes professional qualifications, licenses or certifications, verify that information before publishing it.

Accurate content is part of protecting your business.

How do you approach website compliance practically?

Start with an inventory.

Write down what the website does and which tools it uses.

Identify the information collected from visitors.

Review how customers make purchases or submit inquiries.

Then determine which requirements apply to those activities.

A useful review might cover:

• Privacy and data collection.
• Cookies and analytics.
• Payment and refund information.
• Accessibility.
• Content ownership and permissions.
• Industry-specific disclosures.
• Customer accounts and subscriptions.
• Security and information handling.

Don't treat this as a one-time exercise.

New features can introduce new obligations.

You can read ours as an example of the format, not as a template to copy: privacy policy, terms and accessibility page.

At Veshtera, our accessibility audit costs $600 to $1,200. An audit is a technical evaluation, not a guarantee of legal compliance. We don't give legal advice.

This is general information, not legal advice.