A UK ecommerce legal checklist for small shops

1. Show who you are

Customers must be able to see who they are buying from. Display your business name and address clearly. If you trade as a limited company, also show your registered company name, registered number and registered office address. Your contact page and footer are the natural places for this, along with an email address customers can actually use.

2. Give clear information before the sale

Under the Consumer Contracts Regulations 2013, you must give buyers clear information before they place an order. In practice that means:

• Who you are and how to contact you.
• The main features of what you are selling.
• The total price, including VAT and delivery charges, so there are no surprises at checkout.
• Delivery times and any delivery restrictions.
• Cancellation rights, how to use them and who pays for returns.

Put this information where customers will see it: on product pages, in the basket and checkout, and on dedicated delivery and returns pages. After the sale, confirm the order in writing, usually by email.

3. Respect the 14-day cancellation period

For most goods bought online, consumers have 14 days to cancel. The period starts the day after the goods are delivered. They do not need to give a reason. Once they cancel, they return the goods and you refund them. Explain the process clearly so there is no confusion on either side.

Exceptions

Some goods are exempt from the cancellation right. Common examples for small shops are:

• Personalised goods or items made to the customer's own specification.
• Perishable goods, such as fresh food or flowers.

If you rely on an exception, say so clearly before the customer buys. Makers who personalise items should state this on the product page.

Write a clear returns page

Explain how to cancel, where to send items, who pays return postage and how quickly refunds are made. A simple cancellation form or email address makes it easy for customers and for you.

4. Publish a privacy notice under UK GDPR

Every online shop collects personal data: names, addresses, emails and order histories. UK GDPR requires a privacy notice that explains:

• What data you collect and why.
• Your lawful basis for using it, such as fulfilling an order.
• Who you share it with, such as couriers, payment providers and your hosting company.
• How long you keep it.
• How customers can access, correct or delete their data.

Keep marketing separate. Sending newsletters to customers needs its own proper basis and an easy way to unsubscribe, so do not treat a purchase as permission for marketing.

5. Get consent for non-essential cookies

Under PECR, you need consent before setting cookies that are not strictly necessary, such as analytics and advertising cookies. Cookies needed for the basket and checkout to work do not need consent. A good cookie banner lets visitors accept or refuse non-essential cookies just as easily, and does not load them until a choice is made.

6. Have clear terms and conditions

Terms set out how orders are accepted, what happens if an item is out of stock, delivery and returns, and how complaints are handled. They should match how you actually run the shop and sit comfortably alongside the rights described above.

7. Check it all regularly

Laws change and so does your shop. Once a year, read through your pages, test the checkout as a customer would and update anything that has drifted. If you are moving platforms, rebuild these pages carefully rather than copying them blindly. Our guide on moving from Shopify to WooCommerce covers the wider move, and what a webshop costs helps you budget for setting things up properly.

This is general information, not legal advice.

A host that keeps the foundations sound

Retail Web Hosting runs managed WooCommerce hosting for UK small retailers, with an SSL certificate, regular backups and updates done for you, so the technical basics are covered while you focus on your shop. See our WooCommerce hosting or ask us a question.

Frequently asked