The Shopfront Behind the Screen: A Director’s Annual Review of Website Terms and Online Sales

Most UK companies now trade through a website that nobody on the board has read end to end. The site is refreshed by marketing, rebuilt by an agency every few years, hosted by a supplier nobody can name and paid for on a card that renews quietly. It is also, in law, the shopfront: the place where the contract is formed, the price is quoted and the statutory disclosures are made.

The temptation is to treat the website as a marketing asset and the legal pages as a formality buried in the footer. The more useful discipline is to treat it as a regulated sales environment with a fixed set of obligations, reviewed once a year by someone with authority to change it.

A shopfront, not a brochure

A brochure makes claims. A shopfront makes offers. Once a site takes an order, quotes a price inclusive of VAT, collects a deposit or books an appointment, it is doing the second of those things, and the obligations that follow are contractual rather than editorial.

Those obligations do not sit neatly in one statute. Company disclosure comes from the Companies Act 2006 and the associated trading disclosures regulations. Consumer sales sit under the Consumer Contracts Regulations 2013 and the Consumer Rights Act 2015. Cookie consent falls to the Privacy and Electronic Communications Regulations. Accessibility engages the Equality Act 2010 as a service-provider duty. Copyright and licensing live in the Copyright, Designs and Patents Act 1988. Each is owned by a different part of the business, which is precisely why nobody reviews them together.

The details that must appear

The trading disclosures regulations require a company’s registered name, place of registration, registered number and registered office address to be available on its website. Where the site offers goods or services and the company is VAT registered, the VAT number should be shown as well.

These are not optional niceties. They are the cheapest items on the list to get right and among the most conspicuous when missing. A trading name used on the homepage without the registered name anywhere on the site is a common and easily corrected fault.

The contract you think you have

Many companies believe their terms and conditions are binding because a link sits in the footer. They are not, unless the customer had a realistic opportunity to read them before committing. A court will ask whether the terms were drawn to the customer’s attention at the point of sale, not whether they existed somewhere on the site.

For consumer sales the requirements are more prescriptive. Before the order is placed, the customer must receive specified information: the total price inclusive of VAT and delivery, the arrangements for payment and delivery, the duration of any ongoing contract, and — where a cancellation right applies — the conditions, time limits and procedures for exercising it, together with the model cancellation form.

The checkout itself matters. Where a button commits the customer to payment, it must be labelled unambiguously — “Pay now” or “Order with obligation to pay”, not “Continue” or “Submit”. Any optional extra, such as gift wrapping or enhanced delivery, must be actively selected rather than pre-ticked; otherwise the customer is entitled to a refund of that charge. Order confirmation should follow on a durable medium, and the 14-day cancellation period runs from delivery of the goods.

Business-to-business sales sit on a different footing. There is no statutory cancellation right, and the risks are contractual: whether the terms were incorporated, whether the liability cap is enforceable, and whose terms prevail when two sets of purchase conditions collide. One set of terms trying to do both jobs is one of the most reliable sources of dispute in a growing company.

Cookies, consent and the record you keep

The use of cookies and similar technologies is governed by the Privacy and Electronic Communications Regulations, not the UK GDPR alone. Strictly necessary cookies can be set without consent; everything else — analytics, advertising, embedded video, live chat, heat mapping — generally cannot.

The regulator’s expectations are well established: consent must be a positive act, refusal must be as straightforward as acceptance, and banners that offer an easy “Accept” alongside a buried “Manage preferences” are the classic failure. Reform has been signalled for certain low-risk analytics uses, but until commencement and updated regulatory guidance are fully bedded in, the prudent position is to treat non-essential cookies as consent-based.

For the board, the practical question is evidential. Can the company show what the banner said, when it changed, and that consent was captured before any non-essential tag fired? A screenshot filed once a year answers that far better than a supplier’s assurance.

Accessibility: the door that should open

Service providers have a duty under the Equality Act to make reasonable adjustments, and for a website the recognised benchmark is WCAG 2.2 at level AA. The public sector accessibility regulations do not bind private companies, but the underlying duty does, and it is increasingly tested by complaints rather than litigation.

The director-level questions are modest: has the site been tested with a keyboard and a screen reader, is there an accessibility statement naming a contact for problems, and are PDFs and forms usable? Companies selling into the EU should also note that accessibility requirements for in-scope consumer products and services have applied since June 2025, which brings more UK suppliers into scope than many realise.

Who owns the website

Ownership is where governance and procurement meet. Unless copyright has been assigned in writing, an agency retains it — commissioning work does not transfer it. Stock images are licensed for defined uses, fonts are licensed per user or per site, and plugins carry their own terms.

Equally, ask who holds the domain registration, the hosting account, the content management administrator rights and the analytics property. A supplier holding all four in its own name is a continuity risk dressed as a service.

The 60-minute director’s review

1. Load the homepage as a first-time visitor and find the registered company name, number, registered office and VAT number.
2. Open the terms and confirm a version date, an owner and a change log.
3. Place a test order and check the payment button wording and the absence of pre-ticked extras.
4. Confirm the pre-contract information is delivered before, not after, the order.
5. Check the cancellation page names the 14-day period, the refund timing and the model form.
6. Read the cookie banner: is refusal as easy as acceptance, and is consent logged?
7. Test the site with the keyboard only, and read the accessibility statement.
8. Confirm who owns the copyright in copy, images and code, and whether licences cover current use.
9. Verify domain, hosting and admin access are in the company’s name.
10. Minute the review, note the fixes, and set a date for the next one.

Red flags worth fixing this quarter

A footer that names no company. Terms dated three years ago with no record of what changed. A checkout button that says “Continue”. A cookie banner with no reject option. An accessibility statement written by an agency and never tested. Copyright lines naming the agency rather than the company. Hosting paid on a departed employee’s card.

None of these is dramatic on its own. Together they describe a shopfront that nobody is actually running — and that is a governance finding long before it becomes a legal one.