Your website is the face of your business. It is how you tell the world what your company stands for and what makes it unique. The font and color scheme signal not only your company values, but the value of your product. You likely use Google Analytics or other services to monitor the traffic to your website so you can understand which marketing efforts were successful and make strategic decisions about where to put your money and energy. People may sign up for newsletters, create accounts, or even purchase from your site directly.
In this day and age, tailoring your web presence to the specific personality and needs of your company can be done without extensive technical knowledge. However, while your website is the backbone of your company, it is also one of its largest liabilities. If you run a SaaS company, it may be obvious to you that your web presence is highly regulated. However, companies that are brick and mortar or nomadic retail or even selling their products primarily through third-party vendors such as TikTok or Amazon may not think about the legal implications of the information on their website.
Below are some legal disclosures that apply to websites for small businesses. Depending on the nature of your business, some of them may be legally required, some may reduce liability, and others are a way to distinguish your company and value signal to your target audience.
A. Cookie Consent Banner
Cookie consent banners are commonplace, but not always legally necessary. If your website uses a login, shopping cart, contact form, analytics, embedded third-party content, maps, or social media share buttons, your website uses cookies and may require a disclosure. Even a basic informational site hosted on a privacy-focused platform with nothing tracking visitors may still be at risk of needing a cookie consent banner if it connects to any third-party features.
The primary factors indicating whether a cookie consent banner is needed, and what it needs to say, are whether your site uses essential or non-essential cookies and the location of your audience.
- Essential (or “strictly necessary”) cookies are the ones a site needs to function, such as keeping items in a shopping cart, holding a login session, security and fraud protection, and load balancing. These generally require no consent and no warning anywhere. Non-essential cookies are everything else: analytics (including Google Analytics), advertising and retargeting pixels (Meta, Google Ads), embedded social media and video, and preference or personalization trackers. These are the cookies that trigger legal duties.
- What kind of cookie consent banner you need depends on where your audience is. In the EU and UK, the ePrivacy Directive requires prior consent before any non-essential cookie is placed or read. The United States, on the other hand, does not have a federal law that applies and instead relies on state laws, which vary. Many companies detect the location of the user and display a legally compliant banner. Some companies choose instead to apply a global banner that meets all the strictest requirements.
Depending on where your audience is located, not having the proper banner can lead to significant administrative fines and penalties or leave your company vulnerable to lawsuits.
B. Privacy Policy
Data privacy is a hot-button issue and one of the quickest expanding areas of website regulation in the world. The average consumer is becoming increasingly aware of the concept of data privacy. It is a topic that spans political lines, income brackets, education levels, and geographic boundaries. If your company collects personal data such as names, emails, addresses, payment information, or IP addresses, you may need to post a privacy policy.
Around 20 states in the United States currently have broad consumer privacy laws on the books. New data privacy bills are enacted, discussed publicly, and adopted every year. That said, many of those laws either exempt small businesses categorically or have thresholds that small businesses do not meet.
By way of example, the Texas Data Privacy and Security Act (TDPSA) excludes small businesses unless they are selling sensitive consumer data. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, only applies to companies meeting high revenue or consumer data thresholds and therefore functionally excludes small businesses. However, those gaps are closing. The Alabama Personal Data Protection Act (APDPA) has a consumer reach minimum of 25,000, which is one quarter of the CCPA’s 100,000 consumer minimum.
All of this begs the question: if I have a small business, what benefit do I get from having a privacy policy? First and foremost, having a privacy policy protects you from your success. If you have third-party advertising on your website, you may find yourself reaching the consumer reach limits under the APDPA and CCPA faster than you realized. It also may not be clear to you, as a business owner and not a data privacy lawyer, what types of data sharing may trigger the obligation. Second, the laws are changing regularly. To avoid potential liability from new laws, many companies are choosing to simply have policies that comply with the strictest regulations, the EU and CCPA.
Wait, you said some of these were strategic value signals to my consumer base?
Yes. Having clear and comprehensible signals that your company recognizes its duty to protect data privacy is becoming a value signal. The vast majority of people are not making decisions based on data privacy. In fact, most users are not going to read the details of the cookie consent banner or privacy policies that you post. However, many people report having strong feelings about data privacy. For those who are not privacy minded, the banner and policies are barely noticed. For those who are privacy focused, the presentation of the banner and policies with plain, easy-to-understand language sends a signal to users that your company is more trustworthy.
C. E-Commerce Policies
Another requirement that commonly impacts small businesses is e-commerce policies. The policies themselves are not required. What is required is compliance with certain time frames and disclosure of certain information. The easiest way to meet those obligations is by posting e-commerce policies.
Unlike the privacy laws previously discussed, the commerce laws within the Federal Trade Commission Act (FTC Act) apply to most for-profit companies engaged in commerce within the United States, regardless of size. There are also a host of state laws on issues such as return policies that impact small businesses. For ease of compliance, many companies choose to draft policies that apply broadly, once again complying with the strictest state laws.
In practice, a small online store needs four documents, plus a fifth if it sells subscriptions:
- A terms of sale or terms of service covering who you are, what you sell, price and currency, payment and order-acceptance terms, warranties or disclaimers, limitation of liability, and how disputes are resolved and under which state’s law.
- A shipping policy stating processing and delivery times, costs, methods, and destinations. This is also where you satisfy the 30-day shipping rule by setting expectations accurately.
- A return and refund policy stating whether you accept returns, the time window, the condition required, who pays return shipping, and how and when refunds are issued, including any “all sales final” terms. It has to be conspicuous, not buried.
- A privacy policy, as covered above, because checkout collects names, addresses, and payment data.
- If you sell subscriptions, you also need an auto-renewal disclosure presenting the renewal frequency, the price, and the cancellation method clearly and close to the point of purchase, with the customer affirmatively agreeing before the first charge.
D. Terms of Service
All of the disclosures addressed herein function similarly to a contract between the company and its users. Similarly, terms of service, also called terms of use, are the contract between your company and the people who use your site. They often cover terms traditionally found in contracts such as acceptable use, disclaimers, limits on your liability, and how disputes are resolved. Terms of service create rights and set behavioral expectations for the business and its users. Without them, your company is susceptible to the ambiguity within the legal system. You may be left to battle in court what could be resolved in a less expensive manner, exposed to damages that you could have limited, or required to prove that your actions were commercially reasonable instead of proving that you complied with the specific terms of your policy.
The e-commerce policies previously described are often found in the terms of service, except that privacy policies are often kept separate to require users to agree to them specifically.
Unlike in more traditional forms of contracts, the users do not have to physically sign the terms for them to be in effect. Courts enforce terms a user actively agrees to, often called clickwrap, far more reliably than terms left in a footer link, called browsewrap. Best practice, if your website involves users creating an account, is to have them take an action such as checking a box at signup.
These are by no means an exhaustive list of disclosure considerations for small business websites. Industry and professional disclaimers can also apply, such as if you provide medical or legal advice, hold certain licenses, provide educational materials, or provide other services catered to children. It is important to understand what disclosures apply to your company and make a plan to comply with them.