What every website must have: legal requirements and essentials

"What must a website have?" is a question with two very different answers. One comes from the law — certain details have to be on a company's site whether anyone reads them or not. The other comes from practice: there are things without which the site technically works but brings in no enquiries at all.

This article covers both. The first half is a checklist of what is mandatory; the second half is what separates a website from a business card.

What follows is a general overview, not legal advice. If your field is regulated (finance, healthcare, food, alcohol), review the requirements separately.

Mandatory: company details

A company's website must make it possible to identify who you are dealing with. In practice that means the following appear on the site — usually in the footer and on the contact page:

• the registered business name, exactly as it appears in the business register;
• the registry code;
• the address (place of business or postal address);
• contact details — an email address and/or phone number allowing direct and effective contact;
• the VAT number, if the company is VAT-registered;
• the licence and supervisory authority, if the activity is licensed.

These details must not exist only as an image (contacts baked into a designed banner) — they need to be text, so they can be copied and read by search engines.

Mandatory: a privacy policy

If the site collects personal data — and a contact form, a newsletter sign-up, a store account or analytics all do — it needs a privacy policy. This follows from the General Data Protection Regulation (GDPR).

A privacy policy that works states specifically:

• who the data controller is (company name, registry code, contact);
• what data is collected (name, email, phone, IP address, device data);
• for what purpose and on what legal basis;
• how long the data is kept;
• who it is shared with — hosting provider, email service, analytics, payment provider;
• what rights the individual has (access, rectification, erasure, objection) and how to exercise them;
• the right to complain to the supervisory authority (in Estonia, the Data Protection Inspectorate).

The most common mistake is copying someone else's privacy policy. That produces a document naming services you do not use and omitting the ones you do — which is worse than having none, because it is misleading.

Mandatory: the cookie notice — and how to do it right

If the site uses cookies that are not strictly necessary (analytics, advertising, embedded social content), you need prior consent.

The key requirements:

• Consent must be obtained before the scripts run, not after. A banner saying "by continuing you agree" while analytics loads immediately is not consent.
• Refusing must be as easy as accepting — two equal buttons, not a large green "Accept" and a hidden text link to "settings".
• Consent must be withdrawable.
• Strictly necessary cookies (login, cart, security) do not require consent.

In practice this means the cookie banner is not a design element but part of the site's technical logic: the scripts have to be wired to the choice. On our sites the consent bar and analytics are connected so that refusing genuinely prevents tracking.

Mandatory for online stores: terms and the right of withdrawal

Consumer law places a considerably longer list on online stores. Before purchase, the following must be clearly shown:

• an accurate description of the goods or service;
• the total price including VAT, plus delivery costs and any additional charges;
• delivery methods and delivery time;
• payment methods;
• the 14-day right of withdrawal, how to use it, and a model withdrawal form;
• exceptions to the right of withdrawal (custom-made goods, opened hygiene products, digital content under certain conditions);
• the complaints procedure and the terms of any commercial guarantee offered;
• dispute resolution options, including the consumer disputes committee.

The order button must be unambiguous — it should say "Buy" or "Pay for order", not "Confirm". Order confirmation must be sent by email.

Thinking these through is part of every proper online store project — see also our guide to building an online store.

Accessibility — decreasingly optional

Accessibility (WCAG) means the site can be used by someone who does not see well, does not use a mouse, or uses a screen reader. It is mandatory for public sector sites, and European accessibility requirements are extending to an ever-widening range of e-services and online stores.

Even if the requirement does not apply to you yet, the basics are cheap to do and benefit everyone:

• sufficient colour contrast between text and background;
• alt text on all images;
• labels on form fields (not just a grey placeholder inside the field);
• the site is usable with a keyboard and the focus is visible;
• a logical heading hierarchy (one H1, then H2, H3).

Many of these are the same things that help SEO.

And then the part that makes the site actually work

The mandatory part keeps you out of trouble. What follows brings in customers.

A clear message in the first screenful. The visitor must understand within three seconds what you do, who for, and what the next step is. "Welcome to our website" says nothing.

A separate page for each service. One page listing eight services will not rank for any of them. Eight pages might.

Prices, or at least a price range. The most common reason a visitor leaves without writing. If you cannot state an exact price, say "from" and explain what it depends on — that is how we handle it on our pricing page.

Proof. Completed work, client names, reviews, certifications. Without them every claim is just self-praise.

A visible call to action. Every page must make clear what to do next — call, write, order an audit.

A contact form that works. A broken form is more common than people think. Test it for real at least once a quarter, and check that the emails do not land in spam.

A proper 404 page. Not a blank white screen, but a link home and to search.

An FAQ. Answers to the questions you get on the phone anyway. These pages are often the best traffic sources from search.

Speed and mobile. See the article on website speed — most visitors are on a phone.

HTTPS. The certificate is free these days, and without it the browser flags the site as insecure.

Quick checklist

Mandatory

1. Business name, registry code, address, contacts, VAT number — as text.
2. A privacy policy that genuinely matches what you collect.
3. Cookie consent before scripts run; refusing as easy as accepting.
4. For stores: terms of sale, total price, delivery information, 14-day right of withdrawal.
5. HTTPS.

Essential for the site to work at all

6. A clear message and call to action in the first screenful.
7. A separate page for each service.
8. Prices or a price range.
9. Proof — completed work and reviews.
10. A working contact form and visible contacts on every page.
11. An FAQ.
12. Speed and mobile in order.

Summary

The mandatory part is short and a one-off job — a couple of hours, not a project. The practical part is where most sites struggle: the details are in place, but the visitor cannot tell what is expected of them.

If you want to know what your site is missing, order a free website audit — we go through the site and tell you which mandatory items are absent and what is blocking enquiries. For a new site, see the website development page.