Do I need a cookie banner?

In the UK and EU, yes, if you use non-essential cookies such as most analytics and advertising tags. Elsewhere it depends on local law, but asking first is good practice everywhere.

Does my website have to be accessible?

In many markets, yes or effectively yes: the European Accessibility Act, the ADA in the US, the Equality Act in the UK and AODA in Ontario all point towards WCAG. Building to WCAG 2.2 AA covers most of them.

Is this legal advice?

No. It is the checklist we build to. Your lawyer has the final word on your own obligations.

Insights Compliance

Website legal checklist for the UK, EU, US, Canada, Australia, UAE, Saudi Arabia and India

What a business website needs to get right on privacy, cookies, accessibility and company details in each market: UK GDPR and PECR, EU GDPR and the European Accessibility Act, ADA and state privacy laws, PDPL in the UAE and Saudi Arabia, India's DPDP Act.

Updated 20 October 2026 · 3 min read · By Burax

Every market has its own rules for websites, and most businesses only find out about them when something goes wrong. This is the checklist we build to for clients in the markets we serve.

It is a starting point, not legal advice. Laws change, and your own obligations depend on your business, so check the details with a lawyer.

What applies almost everywhere

Whatever the country, a professional website should have:

A clear privacy notice: what you collect, why, who processes it and how long you keep it.
Consent before tracking: analytics and ads switched off until the visitor agrees.
Forms that ask only for what they need, sent over HTTPS.
Accessible design: readable contrast, keyboard use, alt text and labelled forms, built to WCAG 2.2 AA.
Honest marketing sign-ups: clear opt-in and an easy way to unsubscribe.
Who you are: your business name and a way to contact you.

United Kingdom

UK GDPR and the Data Protection Act 2018 for personal data.
PECR for cookies and electronic marketing: non-essential cookies need consent. The Data (Use and Access) Act 2025 relaxes some rules for basic analytics as its provisions come into force; follow the ICO’s current guidance.
Company details: a limited company must show its registered name, number and registered office address on its website.
Equality Act 2010: reasonable adjustments for disabled users.

More: websites for UK businesses.

European Union

GDPR for personal data, and ePrivacy rules for cookies: consent first.
European Accessibility Act, in force since 28 June 2025 for many online shops and consumer services. Microenterprises providing services are exempt.
Prices with VAT for consumers, and the right information before checkout.
Separate URLs per language, with hreflang, if you serve several countries.

More: websites for European businesses.

United States

No single federal privacy law, but a growing list of state laws, led by California (CCPA and CPRA), give visitors rights over their data, including opting out of its sale or sharing.
ADA: courts and the Department of Justice look to WCAG for website accessibility, and lawsuits are common.
CAN-SPAM for email and TCPA for texts and calls.

More: websites for US businesses.

Canada

PIPEDA, plus Quebec’s Law 25, which sets stricter consent rules.
AODA in Ontario: larger organisations’ public websites must meet WCAG 2.0 AA.
Bill 96: businesses serving Quebec need their site available in French.
CASL: express consent for commercial email.

More: websites for Canadian businesses.

Australia

Privacy Act 1988 and the Australian Privacy Principles. Many small businesses are exempt today, but reforms are under way.
Spam Act 2003 for marketing messages.
Total prices including GST for consumers.
Disability Discrimination Act for accessibility.

More: websites for Australian businesses.

United Arab Emirates

Federal Decree-Law No. 45 of 2021 (PDPL) for personal data across most of the UAE.
DIFC and ADGM have their own data protection laws for businesses registered there.
Arabic alongside English is expected in many sectors.

More: websites for UAE businesses.

Saudi Arabia and the Gulf

Saudi PDPL, enforced since September 2024 and overseen by SDAIA, with rules on consent, notices and sending data abroad.
Qatar’s Law No. 13 of 2016, and data protection laws in Bahrain, Oman and Kuwait.
Arabic-first content for many audiences, with right-to-left layouts.

More: websites for Saudi Arabia and the Gulf.

India

Digital Personal Data Protection Act 2023, with its rules notified in 2025 and obligations phasing in: notice, consent and data rights.
GST shown and invoiced correctly for online sales.
Accessibility guidance pointing to WCAG.

More: websites for businesses in India.

How we handle it

On every build we set up Google Consent Mode v2 with tracking denied by default, a privacy notice to suit your market, accessible design to WCAG 2.2 AA, and the company details your country requires. If you serve several markets, we build to the strictest rules that apply, so one site works everywhere.

Start a project and tell us where your customers are.