The legal pages a website needs, and the ones it does not

Short answer: if your site has a contact form or analytics, you need a privacy policy. If it sets any non-essential cookies and anyone from Europe or the UK visits, you need consent before those cookies load — not a banner that announces them. If you sell, host accounts or take user content, you need terms. If you publish advice, you probably want a disclaimer. Everything beyond that is optional.

I build websites, I am not a lawyer, and this is not legal advice. Which laws apply to you depends on where you are, where your visitors are, and what you collect — and those rules move. Use this to know what to look at and what to ask; use a lawyer for anything unusual, and definitely for health, children’s or biometric data.

What actually triggers each document

• Privacy policy — triggered by collecting anything personal. A contact form, a newsletter box, analytics, an embedded map or video that sets identifiers, server logs with IP addresses. In practice: almost every site.
• Cookie consent — triggered by non-essential cookies and similar tracking: analytics, advertising pixels, embedded players, chat widgets. Session cookies that keep a cart working are not in this group.
• Terms of service — triggered by a transaction or a relationship: selling, subscriptions, user accounts, user-submitted content, anything with a refund or cancellation rule.
• Disclaimer — triggered by advice or results: legal, medical, financial, fitness, "how to" content, or any page where someone might act on what you wrote.

The pattern is worth internalising, because it tells you when the documents stop matching reality: they follow what your site does, not what it looked like on launch day.

The privacy policy, in plain terms

Its job is to say what you collect, why, who else sees it and what a visitor can do about it. In most places that means naming the parts people never think of: your analytics provider, your hosting company, your email tool, your payment processor. Each of those receives data about your visitors, and each belongs in the document.

• What you collect and how — forms, cookies, logs.
• Why, and on what legal basis, if you are in scope of GDPR or a similar regime.
• Who it is shared with — by category or by name, and where they are.
• How long you keep it.
• What rights people have and how to exercise them, with a real contact address.
• When it was last updated. Some regimes expect an annual review; all of them make an ancient date look like neglect.

Two geography facts worth knowing even if you are nowhere near Europe or California. GDPR follows the visitor, not the business. And California’s older online privacy law obliges any site collecting personal information from California residents to post a policy conspicuously, wherever the business itself sits. A "we are a small company in a small country" defence does not hold on a public website.

Cookie banners: what regulators actually check

This is the most enforced corner of the whole subject, and the requirements are more specific than most banners assume. Rejecting must be as easy as accepting — same layer, same number of clicks, comparable prominence. A screen where "Accept all" is a bright button and "Reject" is a grey link three clicks deep behind "Manage preferences" is the exact pattern authorities have been fining.

• Consent comes before the cookies are set, not while they are already loading. A banner that says "by continuing to browse you agree" is not consent.
• No pre-ticked boxes. Silence is not agreement.
• Refusing must be possible on the first layer, in one action.
• Withdrawing consent later must be as easy as giving it — usually a small persistent link.
• No re-asking every page load until someone gives in.
• Analytics counts. It is the most common thing loaded before consent on small sites, usually because it was installed once and never revisited.

The practical test takes two minutes: open your own site in a private window, decline everything, and look at what the browser still loaded. Whatever appears in the network panel after a refusal is the part that would be a finding.

Website security for people who are not security people

Terms of service: when they are worth writing

A brochure site with a phone number does not need terms, whatever the internet says. They start earning their place when something can go wrong in a way that needs a rule: what a customer gets, when a refund applies, what happens to an account that breaks the rules, what content people may upload, whose fault it is when a delivery is late.

That is also the reason a copied set of terms is close to useless. Terms describe your process — your delivery times, your refund window, your cancellation rules. Borrowed from another business, they describe someone else’s promises, and you are the one who has to keep them.

Ecommerce website: platform or custom build

Where generated documents quietly stop being true

Generators are genuinely useful for structure: they produce the right sections in the right order, in language a regulator recognises. What they cannot do is know your site. The generated policy describes a generic website — and then you add a chat widget, a booking platform, a pixel for an ad campaign, a font loaded from a third party, and none of them appear in the document you published.

That gap matters more than a missing paragraph, because an inaccurate policy is a statement you made and did not keep. Two habits fix most of it: list every third-party thing your site loads before you generate anything, and re-read the document whenever you add a tool. Both take minutes; neither is anyone’s job by default, which is why it does not happen.

The other quiet failure: copying a competitor’s policy. You are then publishing a description of their data flows, their processors and their contact address, over your own name.

Disclaimers

A short one is honest and useful on any site that gives advice: what you publish is general information, not personal advice, and the reader should get professional help before acting. Where a regulator governs your trade — medicine, law, finance — the wording is not a matter of taste and belongs to that regulator’s rules, not to a template site.

What a disclaimer does not do is turn a promise into a suggestion. "Prices subject to change" does not cover a wrong price shown to a consumer, and "results not typical" does not license a claim you cannot support.

A five-minute audit of your own site

1. Open a private window and load your homepage. Note every third-party request before you accept anything.
2. Decline the banner, reload, and check what still loads. That is your real consent implementation.
3. Open your privacy policy and compare it against the list from step one. Anything missing is now the priority.
4. Check the footer: policy, terms if you sell, cookie settings link, and a way to contact a human — on every page, not just the homepage.
5. Look at the last-updated date. If it predates your current analytics or booking tool, the document is describing a site that no longer exists.
6. Put a yearly reminder in the calendar to repeat this. It is the cheapest item on any maintenance list.

Website maintenance: what it is and what it should cost

None of this needs a lawyer for an ordinary small business site. A lawyer becomes necessary when the answer is genuinely unclear: unusual data, children, health, biometrics, selling at scale into a jurisdiction you have never read about, or a complaint that has already arrived.