What a privacy policy on a small business website needs
When your website needs a privacy policy, and what it must say in the US and the EU.
Privacy, accessibility and AI rules
Terms and conditions matter once your website takes money or commitments: sales, deposits, bookings, memberships, quotes accepted online. This guide shows when you need them, what European consumer law asks of online sales, and what generated templates get wrong.
Updated 29 October 2026, about 9 minutes to read
The short answer
If your site only describes your business and takes enquiries, no law requires terms and conditions, though EU and UK sites must still say who runs them. Once customers pay, book, leave a deposit or sign up online, you need terms they see and accept before they pay. For consumers in the EU and the UK that includes the 14-day right to cancel, which applies to most online sales.
Two different documents get called terms. Terms of use set the rules for visiting the site. Terms of sale are the contract when someone buys or books. A brochure site needs neither in most places. The moment the site takes money or a commitment, it needs the second.
Terms of sale matter when your website handles:
A site that lists your services and has a contact form does none of these. It can skip terms and conditions, as long as it shows who runs it where the law asks for that, and has a privacy notice, which a separate guide covers.
In the EU, the e-Commerce Directive requires anyone providing an online service to make some information easily, directly and permanently accessible: your name, your geographic address, an email address and other details that let people reach you quickly, your trade register and number if you are registered, the supervisory authority if your work needs a licence, your professional body and title if you are in a regulated profession, and your VAT number. The UK kept the same list in its own e-commerce regulations. A footer and a short contact page usually carry all of it.
A terms of use page is optional. If you want one, keep it short: what the site is, who owns its content, what visitors must not do, the limits of your responsibility within what the law allows, and which law applies.
Our own terms of use are the short kind. They say the site is general information and not an offer that can be accepted, that prices, timelines and deliverables are only binding when agreed in writing for a specific project, and that nothing in them limits rights a visitor has as a consumer. The middle line does real work. It stops a price on a page, or an answer from the site's assistant, being read as a contract. If you publish prices and then quote, say the same.
A link in the footer is not agreement. In Nguyen v. Barnes & Noble, decided in 2014, the US Court of Appeals for the Ninth Circuit held that a shopper was not bound by the arbitration clause in a site's terms of use, linked from every page, because the site gave him no notice and asked for no action to show he agreed. Placing the link close to the buttons he clicked was not enough on its own.
So put the terms where the decision is made. Next to the pay or book button, show a line such as "By booking you agree to our booking terms", with the words linked, or better, an unticked box the customer has to tick. Then send the terms with the confirmation.
That last step is a legal point in the EU too. The e-Commerce Directive says contract terms and general conditions given to a customer must be available in a way that lets them store and reproduce them. The text in the confirmation email, or a PDF attached to it, does that. A link to a page you may change next month does not do it alone, so keep a dated copy of every version.
The EU's Consumer Rights Directive lists what a consumer must be told before a distance contract binds them, and much of it ends up in your terms. In plain words, before the order:
Right before the order, the directive asks you to show the main characteristics, the total price, the duration and the minimum term again, and to label the button "order with obligation to pay" or an equally clear phrase. If you do not, the consumer is not bound by the order.
A consumer in the EU has 14 days to withdraw from a distance contract without giving a reason. The UK's rules are the same in outline: for a service, the cancellation period ends 14 days after the day the contract is made, and for goods, 14 days after they arrive. If you never tell the consumer about the right, the EU period runs for an extra 12 months.
From 19 June 2026, EU sales made through a website or app also need a withdrawal function. It must be labelled "withdraw from contract here" or something equally clear, stay available for the whole withdrawal period and be easy to find. It leads to a short online statement where the customer gives their name, the contract and where to send the confirmation, then a button labelled "confirm withdrawal". You then send an acknowledgement on a durable medium, such as an email, with its content and the date and time it was sent. This is an EU rule, not a UK one.
Some sales have no withdrawal right. The exceptions that matter most to small businesses are:
If a customer wants a service to start inside the 14 days, they have to ask for it expressly. If they then withdraw, they pay for the part already provided, in proportion to the whole.
No single federal law sets what website terms must say. Terms of sale are a contract, governed by state law. Several rules still reach into them:
Courts also look at how the customer agreed, as the Nguyen case shows. Clauses that take something away from the customer, such as arbitration or a waiver of class actions, are the ones most worth a clear tick box.
Write them from how you really work. A checklist:
A template is a reasonable first draft. Rewrite every line until it describes your business, then delete what is left over.
On a website that takes bookings or payments, each of these is a small piece of the build that is easy to forget, and the confirmation email is the one most often missed.
A careful template, rewritten to fit, can be enough for a small shop selling one kind of product in one country. Pay an adviser to write or check your terms when you take large deposits, sell subscriptions, sell to consumers in several countries, sign contracts with businesses that carry real liability, or work in a regulated trade such as health, law or finance.
Bring screenshots of your booking or checkout on a phone, your price list, what you do today when someone cancels, and the complaints you have had. An adviser who sees the real flow writes terms that fit it.
This is general information, not legal advice. Consumer law differs between the US states, the UK and each EU country, and it changes. Have your terms checked where your customers are.
Not for a site that only describes your business and takes enquiries, in most places. If you sell online to consumers in the EU or the UK, the information consumer law requires before a sale, including the withdrawal right, usually lives in your terms. EU and UK sites must also show who runs them, whether or not they sell.
Only if the customer had a fair chance to see them and agreed. A US federal appeals court held in 2014 that terms linked from every page of a site did not bind a shopper who was never asked to agree. Put a link or a box to tick next to the pay button, and send a copy with the confirmation.
You should not. The text is someone else's copyright, and it describes their business, their prices and their refund rules, not yours. Use a template as a first draft, rewrite it to match what you actually do, and have it checked if you take deposits or sell subscriptions.
Usually not. A brochure site can do without them, though a short terms of use page can still say that the site is information rather than an offer and who owns its content. In the EU and the UK the site still has to show your business name, address and contact details.
Terms of use set the rules for visiting the site: what visitors may do, who owns the content and the limits of your responsibility. Terms of sale are the contract when someone buys or books: price, payment, delivery, cancellation and refunds. A brochure site might have the first. A site that takes money needs the second.
If you sell to consumers in the EU or the UK, you must tell them before they order about their 14-day right to withdraw and how to use it. From 19 June 2026, EU shops also need an online withdrawal function. In the US the rules vary by state, and whatever policy you show has to match what you do.