Why your website needs legal pages, and which ones

In 2025 California's privacy agency fined Tractor Supply $1,350,000 under the California Consumer Privacy Act. One of its findings was simple: the company's privacy policy didn't tell customers what rights they had. The investigation started with a complaint from a single consumer.

Legal pages are easy to treat as boilerplate you paste into a footer and forget. They aren't. Some are required by law, some by the tools you've already signed up for, and the rest decide whether your rules actually hold when a customer disputes a charge or sues. This guide explains which pages you need, why, and what has happened to businesses that got them wrong.

This is not legal advice

Chykalophia is a growth partner for B2B companies and manufacturers, not a law firm. This guide explains what laws, regulators, courts and platforms say about website legal pages. It is not a substitute for legal advice. The rules differ by state and country and keep changing. Please consult a qualified attorney about your own obligations.

In short

Privacy policy: almost every business website needs one. California and Delaware require one even from small businesses that collect personal information from their residents, and Google Analytics' terms require one too.
Refund and returns policy: publish one if you sell online. PayPal requires it if you accept PayPal, and Stripe expects it.
Terms of service: not required by law in general, but if you sell online we strongly recommend them, agreed to at checkout.
Cookie banner: you'll likely need one if you market to, sell to or track people in the EU or UK and use analytics, advertising or other non-essential cookies.
Disclaimer: no law we found requires a generic one. Specific disclosures are required if you use affiliate links, pay or gift influencers, show testimonials with results most people won't get, or make claims about how a supplement affects the body's structure or function.

The short version

Page	Required by law?	Required by a platform you use?	Why have it anyway
Privacy policy	Yes, for most sites: Delaware requires one from any commercial site collecting personal information from its residents, and California from any collecting it from California consumers. Larger businesses face the CCPA and other state laws; selling to or tracking people in the EU or UK can bring GDPR.	Yes, if you use Google Analytics. Also Google Ads remarketing or customer lists, the Meta pixel (a notice linking to an explanation), and app stores.	It's the promise regulators hold you to, and customers read it.
Terms of service	Not as a document, in general. Specific information is required for subscriptions and for EU and UK consumer sales.	Not as a general rule.	Sets prices, refunds, acceptable use and dispute rules, but only binds people who agreed to it.
Refund and returns policy	EU and UK consumers must be told their cancellation rights.	PayPal requires one if you accept PayPal. Stripe says most businesses must explain refund, shipping, return and cancellation policies.	It's your evidence when a customer disputes a charge.
Cookie banner and cookie notice	EU rules require consent for non-essential cookies; if you market to, sell to or track people there, plan on them applying to you. The UK has allowed some analytics and preference cookies without consent since February 2026, if you explain them and offer an easy way to object; advertising cookies still need consent.	For visitors in the EEA, UK and Switzerland, Google requires consent for cookies where the law does, and for ad personalisation; Meta requires it where the law does.	See cookie consent law.
Disclaimer	No general requirement. Specific disclosures are required for endorsements, affiliate links, reviews, supplement claims and some professions.	No.	Sets expectations, but can't fix a misleading claim.

Privacy policy: required more often than people think

The law

Most business owners assume privacy law is for big companies. For the privacy policy itself, it isn't.

California's Online Privacy Protection Act (CalOPPA) requires a commercial website that collects personal information about California consumers to post a privacy policy. There's no size threshold, and a name and email from a contact form is enough. Once it's posted, you have to follow it. The California Attorney General has said violations may bring penalties of up to $2,500 each. Our privacy policy guide covers who counts as a consumer and what the policy must say.

Delaware has a near-identical law, also with no size threshold, and it's broader: it covers any individual who uses your site, not only consumers. Nevada requires a similar notice for consumers, with a small-business exception that only covers businesses located in Nevada.

Larger businesses face more. California's CCPA applies above $26,625,000 in annual revenue (or if you buy, sell or share the data of 100,000 or more consumers or households, or earn half your revenue from selling or sharing it). Congress's research service counted at least 23 states with comprehensive privacy laws by July 2026. Most have their own thresholds. Offering goods or services to people in the EU or UK, or monitoring their behaviour there, can bring GDPR into play even for a US business (GDPR basics).

There's no general federal law requiring every website to have a privacy policy. But the FTC's position is that when companies tell consumers they'll safeguard their personal information, it "can and does take law enforcement action to make sure that companies live up" to those promises. Whatever your policy says, it has to be true.

The platforms

Even if no law reached you, your tools would:

Google Analytics. Its terms say: "You must post a Privacy Policy", and it must disclose your use of cookies and of Google Analytics.
Google Ads. If you use remarketing ("your data segments") or upload customer lists (Customer Match), Google requires specific privacy-policy disclosures.
Meta pixel. Meta's Business Tools terms require a clear and prominent notice on each page where the pixel runs, linking to an explanation of the tracking, how to opt out, and where to do it. Many sites point a clearly labelled link on every page to a privacy section that covers this, opt-out links included. Meta's wording asks for a "clear and prominent" notice, so check that yours is.
Google's EU user consent policy. For visitors in the EEA, UK and Switzerland, you must get valid consent for cookies where the law requires it and for personalised ads, keep records of it and explain how to withdraw it. Google says it may limit or suspend your use of its products if you don't.
App stores. Apple and Google Play both require a privacy policy for every app.

What went wrong for others

One complaint, $1.35 million. Tractor Supply's 2025 fine from California's privacy agency included failing to keep a privacy policy that told consumers their rights. A consumer's complaint started the investigation. (California Privacy Protection Agency)
The policy didn't mention where data went. DoorDash agreed in 2024 to pay a $375,000 civil penalty to California. Among the state's complaints: its posted privacy policy didn't say it disclosed customers' personal information to marketing co-operatives. (California Attorney General)
Tracking tags counted as selling data. Sephora paid $1.2 million in 2022. The state said the third-party trackers on its site amounted to a "sale" of customer information, which Sephora neither disclosed nor let customers opt out of. (California Attorney General)
The promise and the pixels disagreed. The FTC alleged in 2023 that GoodRx "deceptively promised its users that it would never share personal health information with advertisers", then shared it with Facebook, Google and Criteo. The proposed order would ban GoodRx from sharing health data for advertising, and GoodRx agreed to a $1.5 million civil penalty under the FTC's Health Breach Notification Rule for failing to report those disclosures. (FTC)

These are big names, and three of the cases were brought under the CCPA, which only applies above its thresholds (DoorDash was also charged under CalOPPA, which has none). But none of the mistakes needed a big company to make them: a policy that skipped people's rights, a policy that didn't mention a data partner, ad tags nobody had thought of as a "sale", and a promise the site's own pixels broke.

Next step: How to write a privacy policy that's actually true.

Terms of service: not required, but they only work if people agree

No general US law requires a website to publish terms of service. They're how you write down your prices, refunds, acceptable use, who owns what, and how disputes are handled. Their weak spot is that a court will only hold customers to terms they were actually shown and agreed to.

Barnes & Noble learned this in 2014. It linked its Terms of Use at the bottom of every page and near the checkout buttons, and when a customer sued over a cancelled order, it tried to send the case to arbitration under those terms. The federal appeals court refused: a link on every page, even close to the buttons, wasn't enough without a prompt to agree, and "the onus must be on website owners to put users on notice of the terms to which they wish to bind consumers." (Nguyen v. Barnes & Noble, 9th Circuit)

If you sell subscriptions, or sell to consumers in the EU or UK, specific rules say what buyers must be told before they pay, and terms are where most of it goes.

Next step: How to write terms of service that will actually hold up.

Refund, returns and shipping policies

If you take payments online, your payment provider and consumer law expect these:

PayPal's US user agreement, if you accept PayPal: "You must publish a refunds and returns policy", along with customer service contact details.
Stripe's website checklist: "For most businesses, you must clearly explain your order fulfillment policies to your customers", listing refund, shipping, return and cancellation policies.
EU and UK consumer law gives buyers 14 days to cancel most online purchases. If you don't tell them about that right, the period is extended by up to 12 months.
Shopify generates templates for these in your store admin and links them in your checkout footer, and reminds you that you're responsible for following what you publish.

A clear refund policy that the customer saw at checkout is also your best evidence when someone disputes a charge.

Disclaimers and disclosures: when the law requires one

A generic disclaimer isn't required

We found no law requiring a general business website to carry a generic "website disclaimer" (the "information on this site is not professional advice and comes with no warranty" kind). It can be a sensible way to set expectations, especially if you publish advice-style content. But don't count on it as protection. How much it limits your liability depends on contract and consumer law where you and your customers are, and a lawyer is the right person to answer that.

What a disclaimer certainly can't do is fix a misleading claim. The FTC's Endorsement Guides say a disclosure only works if it changes the overall impression of an ad, and that a line such as "Results not typical" is "insufficient" to stop a misleading testimonial ad from being deceptive.

Specific disclosures are required, depending on what you do

If you...	You need to...	The rule
Pay or gift influencers, use affiliate links, or give free products in exchange for reviews	Clearly and conspicuously disclose the connection	FTC Endorsement Guides, enforced under the FTC Act
Show customer reviews or testimonials	Never write, buy or sell fake reviews or testimonials; never offer anything for reviews on condition they're positive (or negative); never hide negative reviews while implying you show them all; have officers and managers clearly disclose their connection if they review your business	FTC Consumer Reviews and Testimonials Rule, in force since October 2024, with civil penalties of up to $53,088 per violation
Use testimonials about results (weight lost, money made, leads won)	Be able to show those results are typical, or clearly state what people can generally expect	FTC Endorsement Guides
Make claims about how a dietary supplement affects the body's structure or function	Use the FDA's prescribed disclaimer, prominently and in bold, next to the claim or linked to it with a symbol such as an asterisk. The manufacturer must be able to back up the claim, and the manufacturer, packer or distributor must notify the FDA within 30 days of first marketing it	21 U.S.C. 343(r)(6) and 21 CFR 101.93
Advertise legal services	Follow your state's attorney-advertising rules, which vary by state	State rules of professional conduct
Give investment advice as a registered adviser or broker-dealer	Follow SEC and FINRA advertising rules	Federal securities rules

The FDA's wording, for the record, is: "This statement has not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease." (There's a plural version for more than one claim.) It doesn't permit disease claims, and whether a particular web page counts as product "labeling" is a question for a lawyer.

Disclosure cases: what went wrong for others

Paid influencers, no disclosure. In 2016 the FTC charged that Lord & Taylor paid 50 fashion influencers between $1,000 and $4,000 each, plus a free dress, to post photos of it on Instagram, without requiring them to disclose the payment. The settlement required Lord & Taylor to make sure its influencers clearly disclose when they're compensated. (FTC)
The review widget hid the bad reviews. In 2022 Fashion Nova agreed to pay $4.2 million after the FTC alleged it "suppressed reviews with ratings lower than four stars out of five" and never posted hundreds of thousands of more negative reviews. Since October 2024, the FTC's reviews rule makes it a violation in its own right to suppress reviews for their rating or negative tone while implying the ones you show are all or most of them. (FTC)
Warning letters have started. In December 2025 the FTC warned 10 companies about possible violations of the reviews rule, noting civil penalties of up to $53,088 per violation. The letters weren't findings that the companies had broken the rule. (FTC)

Who's responsible: you or us?

You are. California's privacy law, for example, puts the duty on the business that owns the site and collects the information, and specifically excludes a company that hosts or manages the site on the owner's behalf. That matches how we work: we can tell you what your site collects and which tools on it send data elsewhere, set up the cookie banner, put the links where the law and the platforms expect them, and build the "you agree" step into your checkout. The policies themselves are your promises to your customers, and a lawyer should review them.

Common questions

I'm a small business. Do these laws really apply to me?

The privacy-policy duty in California and Delaware has no size threshold, so a small business that collects names or emails from Delaware residents, or from California consumers, is covered. Many of the broader state privacy laws, including the CCPA, only apply above revenue or volume thresholds. The FTC's reviews rule and its endorsement guidance have no size threshold.

We only sell to other businesses. Do we still need a privacy policy?

In practice, yes. California's CalOPPA covers consumers, so a purely business-to-business site may fall outside it. But Delaware's law covers any Delaware resident whose personal information your site collects, business buyer or not. If you use Google Analytics, its terms require a privacy policy whatever you sell. And if your business is big enough for the CCPA, its exemption for business contacts' information ended on 31 December 2022, according to the California Attorney General.

Do I need all of these on launch day?

We'd put a privacy policy, linked from every page, in place before you collect any information. If you sell online, we'd add terms of service, a refund and returns policy and a shipping policy before you take your first order. If you market to, sell to or track people in the EU or UK, set up a cookie banner before analytics or ad tags load for them. Not all of these are legal requirements, but each is far easier to get right before launch than after.

Can I copy another company's pages?

You'd be publishing promises about their tools and their data flows, not yours, and you'd be held to them. Use a generator or a lawyer, and check every sentence against what your site actually does.

Do I need a separate disclaimer page?

Only if your content calls for one. If you publish advice-style content in a sensitive area (health, money, law), a short "general information, not professional advice" note sets expectations. If you use affiliate links or paid endorsements, the FTC expects the connection to be disclosed clearly and conspicuously, and a note tucked away on a separate page is unlikely to meet that.