What legally needs to be on a small business website

Most small business owners never think about the legal side of their website until someone sends a letter. The good news is that for a typical local business, the list of real requirements is short, and most of it is easy to get right once you know what it is.

1. A privacy policy, if you collect anything

If your site has a contact form, a booking tool, a newsletter signup, or analytics, it collects personal information. In California, the California Online Privacy Protection Act requires any commercial website that collects personally identifiable information from California residents to post a privacy policy conspicuously. Because that covers visitors, not just businesses located in California, it reaches a lot of sites.

Under that law, the policy has to say, among other things:

• What categories of personal information you collect, and what kinds of third parties you share it with.
• How visitors can review or change their information, if you offer that.
• How you will tell visitors about material changes, and the policy's effective date.
• How your site responds to browser "do not track" signals, and whether other parties, such as analytics or ad tools, can track visitors across sites.

The practical point: your policy has to match what your site actually does. If you add an analytics tool, an ad pixel, or a chat widget, update the policy to name it.

2. The bigger California privacy law probably does not apply, yet

The California Consumer Privacy Act is the law people usually mean when they talk about California privacy. It applies to for-profit businesses that meet at least one of three thresholds: annual gross revenue above a set amount, which the California Privacy Protection Agency adjusted to $26,625,000 starting in 2025; buying, selling, or sharing the personal information of 100,000 or more California residents or households; or earning half or more of annual revenue from selling or sharing personal information. Most local service businesses are below all three. If you are growing toward any of them, plan ahead.

3. Accessibility

The Department of Justice's guidance on web accessibility and the ADA says Title III of the Americans with Disabilities Act "prohibits discrimination against people with disabilities by businesses open to the public," and applies that to what businesses offer online. The same guidance says businesses can currently choose how they make their sites accessible, and points to the Web Content Accessibility Guidelines as helpful guidance rather than a mandated standard.

In practice, the basics go a long way and also make the site better for everyone:

• Text alternatives on meaningful images.
• Enough contrast between text and background, and text that can be enlarged.
• Forms with clear labels, and a site that works with a keyboard alone.
• Captions on videos.
• An accessibility statement with a way to contact you if something does not work.

Be cautious about "one-line fix" accessibility overlays. They do not change the underlying site, and they are not a substitute for building it properly.

4. Consent before you text or call

If a form on your site leads to marketing texts or calls, the consent language matters. Federal rules under the Telephone Consumer Protection Act require prior express written consent for telemarketing calls and texts made with automated systems to cell phones, and the person must be told that agreeing is not a condition of buying anything. The form should say plainly what they are agreeing to receive and how to stop. Carriers also require business numbers to be registered before they will reliably deliver texts, which we covered in our post on missed calls.

5. Email rules

If you send marketing email, the federal CAN-SPAM Act applies. The FTC's compliance guide lists the key requirements:

• Include your valid physical postal address.
• Give a clear way to opt out, and honor opt-outs within 10 business days.
• Identify the message as an advertisement, and do not use misleading subject lines or sender information.

Penalties are assessed per email and run into the tens of thousands of dollars each, so this is worth getting right in your email tool's settings once.

6. License and professional disclosures

Some professions have their own website rules. California real estate licensees must show their license number and responsible broker's name on their websites under 10 CCR 2773, which we covered in our post on real estate websites. Mortgage, legal, medical, and contracting licenses carry their own advertising rules. Check with your licensing board.

7. Reviews and testimonials

Federal rules now cover how businesses use reviews and testimonials, including a ban on fake reviews and on incentives tied to positive ones. Health care practices also need patients' written authorization before posting their names, photos, or stories. Our reviews post covers the details.

What about cookie banners?

There is no general federal law in the United States that requires the cookie consent banners common on European sites. State privacy laws, such as the CCPA for businesses it covers, carry their own notice and opt-out duties. For most small local businesses, an accurate privacy policy that names the tools you use is the more important step.

Terms of use: helpful, usually not required

Terms of use are generally not required by law for a simple business website, but they are useful. They can set expectations about how visitors may use your content, limit your liability for information on the site, and say which state's law applies.

A short checklist

1. Does your site collect names, emails, or phone numbers? Then post a privacy policy, link it in the footer, and make sure it names the tools you use.
2. Do your forms lead to texts or calls? Check the consent wording.
3. Does your marketing email include your postal address and a working unsubscribe link?
4. Can someone use your site with a keyboard and a screen reader? Is there an accessibility contact?
5. Does your profession require license numbers or disclosures on your site?