The legal pages every UK online shop needs

A UK online shop selling to consumers needs, at minimum: terms and conditions of sale, a returns and refunds policy that reflects the 14-day cancellation right, a privacy notice, cookie information with a way to consent to non-essential cookies, delivery information, and clear business and contact details (including company details if you’re a limited company). Here’s what each page should cover.

1. Your business details

Shoppers must be able to see who they’re buying from. Under UK rules for online selling, you should show:

• Your business name (and trading name, if different).
• A geographic postal address, not just a PO box.
• An email address and ideally a phone number.
• Your VAT number, if you’re VAT registered.

Limited companies must also show their registered company name, company number, the part of the UK it’s registered in (for example, England and Wales) and the registered office address. Many shops put this in the footer and on the contact or about page.

2. Terms and conditions of sale

Your terms set out the contract between you and your customer. Before someone orders, the Consumer Contracts Regulations require you to give certain information clearly. Your terms (and product and checkout pages) should cover:

• The main features of the products.
• The total price including VAT, and all delivery charges.
• How payment works and when you take it.
• Delivery arrangements and timescales.
• How the customer can cancel, and any costs they’ll pay for returning goods.
• The customer’s legal rights if goods are faulty.
• How you handle complaints.

Make sure your terms match what actually happens. If your delivery page says two days and your terms say five, you’ve created confusion and possibly a complaint.

You also need to send an order confirmation, by email, with the key information, after the sale and no later than when the goods are delivered.

3. Returns and refunds policy

This is the page shoppers read most, and the one most often written wrongly. Under the Consumer Contracts Regulations, when you sell online to consumers:

• Customers can cancel within 14 days, starting the day after they receive the goods, without giving a reason.
• You must refund within 14 days of getting the goods back, or of the customer providing evidence they’ve sent them, whichever is sooner.
• The refund includes the original standard delivery charge (not the extra for a premium option they chose, like next-day).
• You can ask the customer to pay for returning the goods, but only if you told them before they bought. Otherwise you pay.
• You can reduce the refund if the goods have been handled more than was needed to check them.

Some items are exempt from the 14-day right, including goods made to the customer’s specifications or clearly personalised, goods that go off quickly, and sealed goods not suitable for return for health or hygiene reasons once unsealed. If any of your products fall into these groups, say so clearly.

Separately, the Consumer Rights Act 2015 says goods must be of satisfactory quality, fit for purpose and as described. That applies whatever your returns policy says, and you can’t take those rights away. For faulty goods, customers generally have 30 days to reject them for a full refund.

4. Privacy notice

Under UK GDPR, if you collect personal information (names, addresses, emails, order details), you must explain how you use it. Your privacy notice should cover:

• Who you are and how to contact you about privacy.
• What information you collect and why.
• Your lawful basis for each use (for example, to fulfil an order, or with consent for marketing).
• Who you share it with: payment providers, couriers, warehouses, email and advertising tools.
• Whether data leaves the UK, and how it’s protected.
• How long you keep it.
• People’s rights, including access, correction and deletion, and how to complain to the ICO.

Most businesses that handle personal data also need to pay the ICO’s data protection fee. As of October 2026 the lowest tier is £52 a year (£47 by direct debit). The ICO has a short online checker to see whether you need to pay.

5. Cookies

Cookies and similar tracking tools are covered by the Privacy and Electronic Communications Regulations (PECR). In general:

• Cookies strictly needed for the shop to work (like the basket) don’t need consent.
• Non-essential cookies, such as advertising and many analytics cookies, generally need the visitor’s consent first.
• You need to explain what cookies you use and why, in a cookie notice or as part of your privacy notice.
• Consent must be a real choice: rejecting should be as easy as accepting.

The rules on some low-risk cookies have been updated recently, so check the ICO’s current cookie guidance for exactly what needs consent.

6. Delivery information

Not strictly a “legal page”, but it carries legal weight because it forms part of what you’ve promised. Include your delivery options and prices, dispatch cut-off times, expected delivery times, the countries you deliver to, and what happens if a parcel is late, lost or damaged.

Under the Consumer Rights Act, unless you agree otherwise, goods must be delivered without undue delay and within 30 days, and they’re your responsibility until they reach the customer.

7. Contact and complaints

A simple contact page with your email, phone (if you offer it) and address, plus a short note on how you handle complaints. Keeping all customer messages in one place, next to the order, makes it far easier to reply quickly and consistently. Merchella’s customer inbox, for example, puts emails and contact-form messages together with the customer’s order beside them.

Other rules to know about

• Fake reviews: the Digital Markets, Competition and Consumers Act 2024 bans fake reviews and hiding or misleading people about reviews. Its consumer rules came into force on 6 April 2025.
• Hidden fees: show the full price, including unavoidable charges, from the start rather than adding them at the end.
• Marketing emails: you generally need consent to send marketing emails to consumers, with an easy way to unsubscribe in every email.
• Selling abroad: if you sell to Ireland, the US or elsewhere, their consumer and privacy rules may apply too.

A quick checklist

1. 1Business and company details in the footer.
2. 2Terms and conditions linked from the footer and checkout.
3. 3Returns policy with the 14-day right, refund timings and exceptions.
4. 4Privacy notice, and the ICO fee paid if you need to.
5. 5Cookie notice and a working consent banner.
6. 6Clear delivery page and order confirmation emails.
7. 7Contact details and a complaints process.

In short

Legal pages aren’t just box-ticking. Clear, honest terms, returns and privacy information build trust and cut down on disputes. Get the basics in place before you launch, keep them in line with how you actually run the shop, and review them whenever the rules or your processes change.