Business website legal requirements: the 2026 compliance checklist

Most small businesses don't need a lawyer to launch a website — but they do need to cover a short list of legal basics that apply almost everywhere in the United States. This checklist collects the federal rules and the most common state rules in one place, explains who each one applies to, and links to deeper guides. Use it before launch and again once a year.

1. Business identity and registration

• Register the business you name on the site. If your website uses a business name, that name should match a registered entity (LLC, corporation) or a registered assumed name / "doing business as" (DBA). Rules and fees vary by state — see your state guide.
• Show who you are and how to reach you. A clear business name, contact method, and (for local businesses) service area builds trust and supports local SEO. Several laws — including CAN-SPAM for marketing email — require a valid physical postal address in certain communications.
• Check professional licensing rules. Licensed trades and professions (contractors, real estate, healthcare, legal, financial services) often have state rules about advertising, license numbers, and required disclosures on websites.

2. Privacy policy

There is no single federal law that requires every website to have a privacy policy, but in practice nearly every business site needs one:

• California's CalOPPA requires any commercial website or online service that collects personally identifiable information from California residents to post a conspicuous privacy policy with specific contents — which, in practice, covers most US sites with a contact form, newsletter signup, or checkout.
• Comprehensive state privacy laws (California, Virginia, Colorado, Texas, and many more) add detailed notice requirements and consumer rights for businesses that meet their thresholds. See state privacy laws compared.
• The FTC Act lets the Federal Trade Commission act against privacy statements that are false or misleading — so your policy must describe what you actually do.
• Third-party tools such as Google Analytics, advertising pixels, and payment processors require you to disclose their use under their own terms.

A useful privacy policy says what you collect (form entries, cookies, analytics data, order details), why, who you share it with (hosting, email, payment, analytics providers), how long you keep it, how people can contact you about their data, and — if a state law applies — how to exercise their rights.

3. Cookies, tracking, and opt-outs

The US has no general cookie-consent law like the EU's, but tracking is regulated in other ways:

• Under several state privacy laws, using cookies or pixels for targeted advertising or "selling/sharing" data triggers an opt-out right, and a growing number of states require covered businesses to honor browser-based opt-out signals such as Global Privacy Control (GPC).
• If you target visitors in the EU or UK, the GDPR and ePrivacy rules generally require consent before non-essential cookies are set.
• Session-replay and chat tools have been the subject of wiretapping-style lawsuits in some states, notably California. Disclose them and configure them to mask form inputs.

4. Accessibility

Title III of the Americans with Disabilities Act applies to businesses open to the public, and courts have repeatedly allowed website-accessibility claims to proceed. There is no federal technical standard for private-business websites, but WCAG 2.1 Level AA is the benchmark used in most settlements and in the Department of Justice's own rule for state and local governments. Some states add their own exposure — California's Unruh Civil Rights Act allows statutory damages of at least $4,000 per violation. Read the full website accessibility guide.

5. Email and text marketing

• CAN-SPAM Act (email): no misleading headers or subject lines, identify the message as an advertisement where required, include a valid physical postal address, provide a working opt-out, and honor opt-outs within 10 business days. Penalties can exceed $50,000 per violating email.
• TCPA (texts and calls): marketing texts sent with an autodialer generally require the recipient's prior express written consent. Several states (for example Florida and Oklahoma) have their own "mini-TCPA" laws.

6. Reviews, testimonials, and endorsements

• The FTC's Endorsement Guides require clear disclosure of material connections — free products, payments, affiliate commissions, or family relationships — in endorsements and influencer posts.
• The FTC's rule on consumer reviews and testimonials (in effect since October 2024) prohibits fake reviews, buying positive or negative reviews, undisclosed insider reviews, and suppressing negative reviews, and allows civil penalties.
• Google and Bing business listings separately prohibit incentivized or selectively solicited ("gated") reviews.

7. Selling online

• Sales tax: since the Supreme Court's 2018 South Dakota v. Wayfair decision, states can require remote sellers to collect sales tax once they pass an economic-nexus threshold (commonly $100,000 in annual sales into the state). Check each state where you sell.
• Shipping promises: the FTC's Mail, Internet, or Telephone Order Merchandise Rule requires you to ship within the time you state — or within 30 days if you state none — and to notify buyers of delays.
• Prices and fees: several states require "all-in" pricing that includes mandatory fees; California's law (SB 478) has applied since July 2024. A federal FTC rule on unfair or deceptive fees, effective May 2025, covers live-event tickets and short-term lodging.
• Subscriptions: many states have automatic-renewal laws requiring clear terms, affirmative consent, and an easy way to cancel online. California's law was strengthened effective July 1, 2025.
• Product warnings: if you sell to California consumers, check whether your products need Proposition 65 warnings.

8. Children's data

If your site is directed to children under 13, or you know you are collecting personal information from them, the federal COPPA Rule requires verifiable parental consent and other safeguards. The FTC amended the rule in 2025, with most new obligations taking effect in April 2026. Several states have also passed laws on minors' social-media and online data; some have been blocked in court, so check current status.

9. Security and data breaches

• All 50 states have data-breach notification laws. Know which data you hold, where it is stored, and who you would need to notify.
• Use HTTPS everywhere, keep your CMS, themes, and plugins updated, use strong unique passwords with multi-factor authentication, and never store full card numbers — let a PCI-compliant payment processor handle them.

10. Content, copyright, and terms

• Only use images, fonts, and text you have the right to use; keep license records for stock assets.
• If users can post content on your site, register a designated agent with the U.S. Copyright Office to qualify for the DMCA safe harbor (registrations must be renewed every three years).
• Terms of service aren't legally required, but they set expectations on payment, refunds, acceptable use, and liability — especially for stores, memberships, and SaaS.

Quick pre-launch checklist

1. Business name on the site matches a registered entity or DBA.
2. Privacy policy published, linked from every page, and accurate.
3. Terms of service (and refund/shipping policies for stores) published.
4. Opt-out link and Global Privacy Control handling, if a state privacy law applies.
5. Accessibility checked against WCAG 2.1 AA; accessibility statement with a contact method.
6. Email signup forms record consent; every marketing email has an address and unsubscribe link.
7. Reviews are genuine; endorsements and affiliate links are disclosed.
8. Sales-tax registration in every state where you have nexus.
9. HTTPS, updates, backups, and multi-factor authentication in place.
10. Licensed-profession disclosures (license numbers, required statements) included.

Related guides

Frequently asked questions