What UK law actually asks of a London business website
Trading disclosures, cookie rules after the DUAA, drip pricing, accessibility and sector regulators. The legal surface that reaches a London website, and what it costs to build in.
Most conversations about building a website in London are about design, speed and Google. Those matter. But if you run a company registered at Companies House and you sell to people in the UK, a good deal of your site is not a design decision at all. It is a legal obligation with a named regulator behind it, and that surface has moved a lot in the last two years.
This is the part of a build that agencies quietly skip and that lands on your desk eighteen months later as a complaint, a CMA letter, or a solicitor asking why your terms page contradicts your checkout. Here is what actually applies.
The disclosures that have to be on the site itself
If you trade through a limited company, the Companies Act 2006 and the Company, Limited Liability Partnerships and Business (Names and Trading Disclosures) Regulations 2015 require your registered company name, company number, place of registration and registered office address to appear on your website. Not in a PDF. On the site. A Shoreditch studio trading under a brand name that appears nowhere near its registered name is the single most common version of this failure.
On top of that, the Electronic Commerce (EC Directive) Regulations 2002 still apply in the UK and require your geographic address, an email address that works, your VAT number if you are registered, and the details of any supervisory body or professional register you belong to. If you are a member of RICS, ARLA, the FCA register or a redress scheme, that goes on the site with the registration number.
A footer that says the brand name and a contact form is not compliant. Registered name, number, registered office and VAT number belong in the footer or a clearly linked legal page.
Cookies changed in February 2026, and not in the direction you think
The Data (Use and Access) Act 2025 amended PECR with effect from 5 February 2026, and the ICO finalised its guidance on storage and access technologies in April 2026. The headline is that a narrow set of low risk purposes, including first party analytics and remembering display preferences, no longer needs consent. The exemptions are purpose limited, so the moment your analytics tag is also feeding an advertising audience, you are back in consent territory.
Two practical consequences for a build. First, your consent banner should now be configured around purposes, not around a blanket accept or reject, because lumping exempt analytics in with Meta and Google Ads pixels loses you data you are entitled to collect. Second, the ICO's maximum PECR penalty is now aligned with UK GDPR at £17.5 million or 4% of worldwide turnover, which is a different order of risk from the old £500,000 cap. The ICO has been running public sweeps of the most visited UK sites for several years, and a pre ticked box or a reject button hidden two clicks deep is exactly what those sweeps look for.
Pricing pages and review widgets are now regulated
The consumer provisions of the Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025 and gave the Competition and Markets Authority direct enforcement powers, meaning it can now fine businesses itself rather than going to court first. Two of the banned practices are built into websites rather than into marketing copy.
Drip pricing
Mandatory charges have to be in the headline price. Booking fees, compulsory service charges, unavoidable delivery, admin fees. If the number in your product card is not the number a customer can actually pay, that is a build problem, because the fee is usually calculated in a later checkout step by design. Fixing it after launch means touching pricing logic across listing, cart and checkout at once.
Reviews
Publishing fake reviews, or failing to take reasonable steps to check the reviews you display, is now prohibited. If you are pulling a widget onto your homepage, you need to be able to say where those reviews came from and what verification sits behind them. The CMA has already looked at a large number of businesses on exactly this point.
If you sell to consumers online, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 also govern your checkout: the pre contract information, the 14 day cancellation right, and the requirement that the final button is labelled so it is obvious an obligation to pay is being accepted. The wording on that button is a legal requirement, not a conversion experiment.
Accessibility: two different regimes
Public sector organisations in the UK, which in London includes borough councils, NHS trusts, universities and TfL, are covered by the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. That means WCAG 2.2 AA and a published accessibility statement in a specified format. If you are bidding for public sector work in London, expect to be asked for that statement as part of procurement.
Private businesses are not covered by those regulations, but they are covered by the Equality Act 2010, which requires service providers to make reasonable adjustments for disabled people. There is no certificate and no audit, which is why so many London businesses assume it does not apply. It does, it is enforced through individual claims, and WCAG 2.2 AA is the standard a court or the Equality and Human Rights Commission would reach for. If you also sell into the EU, the European Accessibility Act has applied since June 2025 regardless of where you are based.
Your regulator probably has rules about your website specifically
London's economy is concentrated in exactly the sectors that carry the heaviest web specific rules, and generic agencies routinely miss them.
- Financial services in the City and Canary Wharf: anything on your site that invites investment or credit is a financial promotion under the FCA's rules, must be fair, clear and not misleading, and has to be approved and recorded. Consumer Duty means your site is judged on whether customers actually understood it.
- Law firms: the SRA Transparency Rules require published price and service information in a prominent, signposted place for conveyancing, probate, immigration, employment tribunal work, motoring offences, debt recovery and licensing, plus complaints information and the SRA digital badge.
- Estate and letting agents: redress scheme membership, client money protection and the tenant fee position must be displayed, and property listings carry material information duties enforced by Trading Standards.
- Healthcare and clinics, including the Harley Street cluster: CQC registration details, MHRA rules on advertising prescription only medicines, and the ASA's CAP Code, which polices claims on your own website, not just your ads.
- Gambling and anything with user generated content: Gambling Commission licence conditions, or the Online Safety Act 2023 if your site lets users post to each other. Ofcom has begun issuing fines, and duties are proportionate to size rather than reserved for large platforms.
What this means for the build, and the budget
None of the above requires a bigger design. It requires decisions made before code, because the expensive version is retrofitting. Pricing logic, consent architecture, the CMS fields that hold your registered details and your regulator numbers, and an accessible component library are all cheap at the start and painful later.
- 01Name your regulator in the brief. It changes what pages exist.
- 02Decide the consent model before any tag goes in, and keep a record of what was set and when.
- 03Build price display so the total is assembled once and reused, not recalculated per template.
- 04Ship accessibility in the component library rather than as a pre launch audit.
- 05Put the legal footer in the CMS so a change of registered office does not need a developer.
We work with London clients from Dubai, which means the overlap is roughly three hours in British Summer Time and four in winter, and we plan reviews inside your Monday to Friday morning rather than ours. Compliance detail like this is the part we want settled in the brief, not discovered in week nine.
Nothing here is legal advice. It is the list of questions we ask before we quote, because each one changes the shape of the site.— The FuturByte team
If you are planning a rebuild and you are not sure which of these reach you, tell us what you do and we will tell you honestly what your site has to carry.
