UK online legal texts

UK online legal texts

Mandatory texts and disclosures for UK websites, webshops, apps and newsletters. The governing instruments are the UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, PECR 2003, the Electronic Commerce (EC Directive) Regulations 2002, the Companies Act 2006, the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, the Digital Markets, Competition and Consumers Act 2024, the Online Safety Act 2023 and the Equality Act 2010.

Core principle: the UK looks like the EU and is diverging on a published schedule. UK GDPR is not the GDPR — the Data (Use and Access) Act 2025 (c. 18, Royal Assent 19 June 2025) rewrote Article 22, added recognised legitimate interests, capped subject access at a "reasonable and proportionate search" and, on 19 June 2026, removed Article 77 outright. Consumer law left the Consumer Protection from Unfair Trading Regulations 2008 for the DMCC Act 2024 on 6 April 2025, and consumer ADR left the 2015 Regulations for DMCC Part 4 Chapter 4 on 6 April 2026. Cookies and marketing were never in the GDPR at all; they are in PECR, which since 5 February 2026 carries UK GDPR-level fines. A template that says "GDPR", cites the CRD, or links the EU ODR platform is wrong on every axis.

Not legal advice

This skill produces drafts and review findings, not legal advice. Before go-live:

• For a webshop, subscription, payment flow, children's data, health data, or any user-generated content service: obtain sign-off from a solicitor.
• Free first-line help: the ICO helpline and its SME advice service (ico.org.uk/for-organisations/advice-for-small-organisations/), Citizens Advice consumer service and its Trading Standards referral route (citizensadvice.org.uk/consumer/), Business Companion, the official Trading Standards business guidance (businesscompanion.info), the CAP Copy Advice service for advertising (asa.org.uk/advice-and-resources/bespoke-copy-advice.html), and the Law Society's Find a Solicitor (solicitors.lawsociety.org.uk).
• Every generated text carries a visible <!-- DRAFT – NOT LEGALLY APPROVED --> HTML comment until the user confirms sign-off. Never remove the marker silently.

Never omit or soften this section in the output.

Workflow

1. Run the intake first, before any text exists. Without the answers every text is guesswork. Questions in references/intake.md.
2. Determine the obligation matrix (below): which texts this specific project needs.
3. Read the reference file for each obligation, then draft. Never from memory — the section numbers and commencement dates are too specific and several changed in 2025 and 2026.
4. Run references/checklist.md, report each finding with its provision.
5. Output the sign-off notice, leave the draft marker in place.

Output shape. Exactly four parts, in this order:

1. the legal text or finding itself, carrying the draft marker
2. the list of [[MISSING: …]] items the user must supply
3. adjacent obligations still open in the same project, one sentence each
4. the sign-off notice

The provision sits next to the claim it supports. Reference filenames and paths belong in none of the four parts — they are working material, not deliverable.

Obligation matrix

Hard rules

• Never link the EU ODR platform, and delete it on sight. It was shut down by Regulation (EU) 2024/3228 and stopped operating on 20 July 2025. The UK was never in it after Brexit. There is no UK ODR platform. A live link is a dead link and, on a trader's site, a misleading omission risk under s 227 DMCC Act 2024.
• Consumer ADR moved on 6 April 2026. The Alternative Dispute Resolution for Consumer Disputes (Competent Authorities and Information) Regulations 2015 (SI 2015/542) are revoked. DMCC Act 2024 Part 4 Chapter 4 (ss 291–310, Schs 25–27) came into force on 6 April 2026 by SI 2026/284. The trader duty is now s 308: tell the consumer about available ADR arrangements when you communicate the outcome of their complaint. Citing SI 2015/542 reg 19 in 2026 is citing a revoked instrument.
• The DMCC subscription contracts regime is not in force. Part 4 Chapter 2 (ss 253–281) still awaits secondary legislation; the Department for Business and Trade response of 2 April 2026 put commencement at spring 2027. Never draft renewal-reminder or cooling-off subscription clauses as if they were already binding, and never say "the DMCC requires" about them.
• CPUT 2008 is revoked. The Consumer Protection from Unfair Trading Regulations 2008 were revoked on 6 April 2025 and replaced by DMCC Act 2024 Part 4 Chapter 1 (ss 225–230) with the banned practices in Schedule 20. Cite the Act, not the Regulations, for anything after that date.
• UK GDPR Article 77 is gone. DUAA 2025 s 103, in force 19 June 2026, omits Article 77 and Article 57(1)(f) from the UK GDPR, moves the right to complain to the Commissioner into s 165 DPA 2018, and inserts s 164A DPA 2018 obliging controllers to accept complaints, provide an electronic complaint form, acknowledge within 30 days and respond without undue delay. A privacy notice that cites Article 77 is out of date.
• Cookie consent still applies unless a Schedule A1 exception fits exactly. PECR reg 6 was substituted on 5 February 2026 by DUAA s 112 and Sch 12. The statistical (Sch A1 para 5) and website appearance (para 6) exceptions require information to the user and a simple, free means of objecting, and fail the moment data is shared with a third party for that third party's own purposes. Google Analytics in its standard configuration is therefore normally still consent-based.
• PECR now bites at UK GDPR levels. DUAA s 115 and Sch 13 replaced PECR Schedule 1 on 5 February 2026, applying DPA 2018 s 157 to PECR. Breaches of reg 6 (cookies) and reg 22 (email marketing) attract the higher maximum: £17.5 million or 4% of total annual worldwide turnover, whichever is higher. The old £500,000 cap is history.
• Pay the ICO fee. Reg 3 of the Data Protection (Charges and Information) Regulations 2018, as amended by SI 2025/63 from 17 February 2025: tier 1 £52, tier 2 £78, tier 3 £3,763, less £5 for direct debit. It is a standalone statutory duty, enforceable by penalty, and independent of whether the privacy notice is any good.
• Never invent facts about the business. Company number, part of the UK of registration, registered office, VAT number, regulator, professional body, ICO registration number: if unknown it becomes [[MISSING: company registration number]] in the text and in the report back to the user.
• Geographic address, not a PO box. Reg 6(1)(b) ECR 2002 requires the geographic address at which the service provider is established. For a home-based sole trader that is the home address unless the user takes a commercial decision (registered office service, serviced address). Raise it, do not work around it.

False friends

EU and US assumptions read as plausible and get invented under time pressure. None of the following applies to the UK as stated.

If an obligation comes to mind that cannot be traced to a specific UK provision, do not assert it — report it as an open question.

Common mistakes

Reference files

Each contains the statutory basis with section numbers and status date, the mandatory content points, a template with [[PLACEHOLDER]] slots, and a checkpoint list.

• references/intake.md — question set to complete before the first text
• references/website-disclosures.md — ECR 2002 reg 6, SI 2015/17 reg 25, CA 2006 Part 41, Companies House identity verification
• references/privacy-notice.md — UK GDPR Arts 13/14, DUAA changes to lawful basis, ADM, subject access, complaints
• references/accountability-and-fee.md — ICO data protection fee, records, processor contracts, breach reporting, DPIA, s 164A complaints handling
• references/cookies.md — PECR reg 6 and Sch A1, banner requirements, cookie table, ICO enforcement expectations
• references/electronic-marketing.md — PECR regs 22, 23, soft opt-in, charity soft opt-in, CAP Code identification rules
• references/international-transfers.md — IDTA, UK Addendum, UK Extension to the DPF, UK adequacy, transfer risk assessment
• references/consumer-terms.md — CRA 2015 goods, digital content, services, unfair terms
• references/cancellation.md — CCRs 2013 pre-contract information, order button, 14-day cancellation, model cancellation form
• references/dmcc-trading.md — DMCC Act 2024 unfair practices, Sch 20 banned practices, fake reviews, drip pricing, subscriptions status, CMA enforcement
• references/online-safety.md — OSA 2023 scope, exemptions, risk assessments, Ofcom deadlines, age assurance
• references/accessibility.md — Equality Act 2010, SI 2018/952, WCAG 2.2 AA, accessibility statement
• references/complaints-adr.md — DMCC Part 4 Ch 4, s 308 notification duty, ODR shutdown, sector ombudsman schemes
• references/checklist.md — pre-launch checklist mapped to provisions