Website Legal Requirements in the EU: What a Business Site Needs in 2026

A business website anywhere in the EU needs five things: an imprint with company details, a privacy policy, cookie consent with a real choice, terms of sale if it sells online and, since June 2025, accessibility for shops and consumer services. The first three apply from the day the site goes live, whatever its traffic.

5 legal requirements for a business website in the EU: an imprint, a privacy policy, cookie consent, terms of sale for online shops, accessibility for shops and consumer services.

The rules are shared because they come from EU law: GDPR, the ePrivacy Directive, the Consumer Rights Directive and the European Accessibility Act. Each country adds small local details, which we point out below for Czechia and Germany.

Imprint: who runs the site

The imprint lists the legal name, registered address, registration number and a contact. In Germany it is the Impressum under § 5 of the Digitale-Dienste-Gesetz (DDG). In Czechia it is the operator details under § 435 of the Civil Code, including the IČO number.

Put the link in the footer so it shows on every page. Visitors often land from search on a service page and never see the homepage.

The mistake we see most: a contact form, an email and a phone number, but no company name or registration number anywhere. The second one is outdated details, such as an old address after an office move.

Privacy policy (GDPR)

The privacy policy explains which personal data the site collects, why, how long it keeps it and who it shares it with. GDPR applies to any site that processes data of people in the EU, wherever the business is registered. A contact form, visitor analytics and a newsletter all count as processing.

Link the policy in the footer and again right under the submit button of every form. One short line is enough: “By sending this form you agree to the processing of your data under our privacy policy.”

The mistake we see most: a policy copied from another site that lists services this site does not use, while the CRM, booking tool or newsletter it really runs are missing.

Cookie consent with a real choice

Under the ePrivacy rules, analytics, advertising and tracking cookies may only be stored after the visitor agrees. Cookies the site needs to work do not require consent.

A banner saying “We use cookies” with a single OK button does not meet the requirement. Rejecting has to be as easy as accepting, ideally with two buttons side by side.

The mistake we see most: analytics and ad scripts load together with the banner, so consent is asked after the fact. Automated scans catch this, and so do data protection authorities.

Terms of sale for online shops

A site that sells goods or services online needs terms of sale: delivery, payment, returns and the 14-day right of withdrawal that EU consumers have for distance purchases. Link them in the footer and again at checkout, where the customer confirms them.

The mistake we see most: terms that describe delivery to one country while the shop already ships across borders, and a missing withdrawal form.

Accessibility since June 2025

From 28 June 2025 the European Accessibility Act applies to online shops, booking, banking and other consumer services across the EU. Microenterprises with fewer than 10 employees and turnover or balance sheet up to €2 million are exempt for services.

In practice that means a site you can operate with a keyboard, images with text alternatives, enough text contrast and forms a screen reader can read. The benchmark is EN 301 549, which builds on WCAG 2.1 level AA.

The mistake we see most: a shop template with icon buttons that have no label and grey text on white that fails contrast.

What does your site need?

Even a landing page without a form almost always runs analytics, so the first three rows apply to it.

What Chronicles studio does by default

An imprint, a privacy policy and a cookie banner with a real choice come with every site we build. You get them ready on handover day, together with a Lighthouse score of 95+ and a mobile version. See what else is included on the websites page, or the e-commerce page for online shops.

Checklist before launch

• The site shows the company name, address and registration number.
• The details are linked from the footer on every page, including inner pages.
• The privacy policy describes exactly the services the site uses.
• The cookie banner offers accept and reject with equal effort.
• Analytics and ad scripts stay off until the visitor consents.
• An online shop has terms of sale with the 14-day withdrawal right and a withdrawal form.
• Every form links to the privacy policy next to the submit button.
• An online shop has checked contrast, keyboard use and image text alternatives.

For a live site, the free website audit checks it against this list and adds load speed and technical health.

FAQ

Does GDPR apply if my business is registered outside the EU?

Yes. GDPR follows the visitor’s data. If the site collects data of people in the EU through a form, analytics or a newsletter, it applies wherever the business is registered.

Do I need an imprint without an online shop?

Yes. Any commercial site needs the operator’s details, including a one-page site. A shop only adds terms of sale on top.

Is a cookie banner with one OK button enough?

No. Visitors must be able to reject non-essential cookies as easily as they accept them, and those cookies must not load before consent.

Does the accessibility law apply to a small online shop?

A microenterprise with fewer than 10 employees and up to €2 million turnover is exempt for services. An accessible site still pays off: it reads better on phones and search engines understand it better.