What legally needs to be on a website?

Your Website Is a Legal Document, Not Just a Design Project

Attorney Blake Turley frames the common oversight perfectly: most business owners treat their website as a design project and forget that it is also a legal document source. This mindset leaves them exposed to real financial and operational risks the moment they collect a single piece of visitor data.

At its foundation, every website needs two core legal pages: a Privacy Policy and Terms of Service. The Privacy Policy becomes mandatory the instant you gather personal information — which happens far earlier than most owners realize. Simply adding a contact form, enabling Google Analytics, or offering a newsletter signup triggers this obligation, as these tools collect names, emails, IP addresses, or behavioral data source. An inaccurate policy isn’t just ineffective; it’s legally dangerous, constituting an affirmative misrepresentation that can worsen liability source.

Terms of Service, meanwhile, set the rules for using your site and limit your liability. Together, these pages form the baseline legal framework for any website that interacts with visitors — which is to say, all of them.

The financial stakes of getting this wrong are substantial. Under GDPR, fines can reach up to 4% of global annual revenue for serious violations source. For CCPA/CPRA, penalties climb to $7,500 per intentional violation source. Even accessibility missteps carry cost, with ADA lawsuit settlements typically ranging from $5,000 to $25,000 source.

This is where a managed platform like AI Business Sites provides tangible value by handling compliance basics as part of the service. The system automatically generates and maintains essential legal texts — including Privacy Policy and Terms of Service — keeping them current as regulations evolve. For businesses using the platform, this means one less technical burden while ensuring the site meets its legal obligations from day one. You still own the responsibility, but you don’t have to manage the upkeep alone.

Paste the same cookie banner on every website and you'll satisfy exactly no one. That's the uncomfortable reality of the legal patchwork that governs cookies, privacy, and accessibility in 2026.

The problem is that the major frameworks demand opposite things. Under GDPR, visitors must affirmatively opt in before any non-essential cookies load. Under California's CCPA/CPRA, the requirement runs the other direction — businesses must offer an opt-out mechanism, including a "Do Not Sell or Share My Personal Information" link. As Turley Law's analysis puts it bluntly, a generic banner that says "we use cookies" with only an Accept button "does not satisfy any of these" standards. If your visitors span jurisdictions, the practical approach is meeting the strictest applicable rule — real consent choices, not a decorative popup.

The state-by-state picture has exploded, too. In 2020, only California had a comprehensive privacy statute; by 2026, more than 19 states have enacted their own. Each carries its own thresholds and obligations:

• CCPA/CPRA applies to businesses with revenue over $25 million, data on 100,000+ consumers, or 50%+ of revenue from selling data.
• Connecticut's CTDPA covers businesses processing data on 100,000+ consumers, effective since July 2023.
• Penalties reach $7,500 per intentional violation under CCPA/CPRA — and up to 4% of global revenue under GDPR.

Accessibility has quietly become a de facto legal requirement as well. Federal courts have held that websites qualify as places of public accommodation under the ADA, and the DOJ's 2024 rule mandating WCAG 2.1 AA for government sites signals the benchmark private businesses are judged against. ADA website lawsuit settlements typically run $5,000–$25,000 — painful for any small business, and entirely avoidable.

One trap deserves special warning: overlay widgets. Those one-line accessibility toolbar plugins marketed as instant fixes don't hold up. Courts have repeatedly rejected overlays as an insufficient defense, which means substantive WCAG 2.1 AA implementation — proper structure, contrast, keyboard navigation, alt text — is the only reliable path.

This is also where website ownership choices matter. A managed platform like AI Business Sites handles the compliance basics — cookie-free, privacy-first analytics that require no GDPR banner at all, accessibility-conscious builds, and legal pages that get maintained rather than forgotten. The alternative is tracking each of these moving targets yourself, and as the state count keeps climbing, that's a part-time job nobody running a business actually wants.

For e-commerce sites, additional legal pages are non-negotiable: a Refund/Return Policy, Shipping Policy, and Terms of Sale must be clearly posted. The FTC's Mail Order Rule establishes a 30-day default shipping window if no timeframe is specified, meaning businesses must either advertise their actual shipping speed or face the 30-day standard and potential liability for delays. Similarly, failing to disclose a return policy often defaults to full-refund rights in many states, creating unexpected financial exposure. These policies inform customers of their rights before purchase and reduce disputes, chargebacks, and regulatory scrutiny.

Payment processing adds another layer of compliance. Using PCI DSS-compliant processors like Stripe ensures cardholder data is never stored on the business’s servers or website, significantly reducing risk and liability. The platform integrates Stripe Checkout so funds flow directly to the business’s own account—maintaining ownership of the revenue relationship while meeting security standards. This approach satisfies PCI DSS requirements without requiring the business to handle sensitive data directly.

Emerging in 2026 is a heightened focus on AI transparency. The FTC has signaled that failing to disclose AI chatbots constitutes a deceptive practice, especially when users reasonably believe they are interacting with a human. As noted by Turley Law, "The compliance cost is zero. The risk of silence is rising," meaning adding a simple disclosure—such as noting when a chatbot or voice agent is AI-powered—carries minimal effort but mitigates growing legal and reputational risk. For AI Business Sites, this means clearly indicating when the embedded WebRTC voice agent or FAQ bot is generating responses, aligning with both FTC guidance and evolving state AI transparency laws.

Managed platforms increasingly automate these compliance basics, generating and updating legal texts as regulations change. However, ultimate responsibility for accuracy and publication remains with the website owner, reinforcing the need for vigilance even when using a done-for-you service.

How to Get Compliant Without Becoming a Lawyer

Navigating website legal requirements doesn't require a law degree, but it does demand attention to detail. An inaccurate policy is arguably worse than none because it creates an affirmative misrepresentation of your data practices, potentially increasing liability if regulators or users discover discrepancies. Instead of relying on generic templates that may omit jurisdiction-specific obligations, small business owners should focus on implementing the core legal pages and mechanisms their site actually needs based on its functions.

Every small business website requires a Privacy Policy when collecting personal information—including names, emails, IP addresses from analytics, or data from contact forms and newsletter signups. Terms of Service establish user guidelines and liability limits, while a Cookie Consent mechanism must meet jurisdictional standards: GDPR requires affirmative opt-in for non-essential cookies, whereas CCPA/CTDPA mandate opt-out mechanisms including a "Do Not Sell or Share My Personal Information" link. Accessibility compliance aligned with WCAG 2.1 AA is increasingly treated as a legal requirement under ADA Title III, with courts rejecting overlay widgets as insufficient defense. For e-commerce functionality, Refund/Return Policies, Shipping Policies, and Terms of Sale are essential, alongside PCI DSS compliance through vetted processors like Stripe.

Managed platforms like AI Business Sites help by automatically generating and updating these legal texts as regulations evolve, reducing the burden of manual maintenance. However, the website owner retains ultimate responsibility for ensuring accuracy—no platform can guarantee compliance without the business providing truthful information about its actual data practices. Regular review of these pages, particularly after changes to data collection methods or new feature launches, remains a critical owner duty even within a managed system.

Build It Right the First Time: Compliance as Part of a Done-For-You Site

Starting with a legally sound foundation prevents costly fixes later. A custom website built with essential legal pages, privacy-first analytics that avoid cookies and GDPR banners, and Stripe payments processed through the client’s own account addresses multiple compliance requirements from day one. This approach aligns with how managed platforms like AI Business Sites handle compliance basics by generating and maintaining required legal texts automatically, though ultimate responsibility remains with the website owner.

Core legal requirements universally include a Privacy Policy when collecting personal data and Terms of Service. E-commerce sites additionally need Refund/Return Policies, Shipping Policies, and Terms of Sale, while using PCI DSS-compliant processors like Stripe to avoid storing raw card data. Accessibility compliance meeting WCAG 2.1 AA standards is increasingly treated as a legal requirement under ADA Title III, with courts rejecting overlay widgets as insufficient defense. Emerging 2026 trends also include mandatory AI disclosures for chatbots and AI-generated content to address FTC concerns about deceptive practices.

• GDPR fines can reach up to 4% of global annual revenue
• CCPA/CPRA penalties can reach up to $7,500 per intentional violation
• ADA website lawsuit settlements typically range from $5,000–$25,000

By embedding these compliance elements into the build process—such as providing accurate, tailored Privacy Policies and implementing jurisdiction-aware cookie consent mechanisms—businesses reduce legal risk while focusing on operations. This proactive integration ensures the website functions as a lawful storefront rather than a liability.

To review how your site meets these foundational requirements and discuss any additional needs, book a free 30-minute strategy call. This no-obligation conversation covers your specific business context and what your website requires to operate compliantly from launch.