What legal documents does my website or app need in 2026?

Which legal documents are actually mandatory?

Start with one question: does your website or app collect any personal data? ‘Personal data’ means anything that identifies a person, directly or indirectly. A contact form, a newsletter sign-up, a login, an analytics script or an IP address in your server logs all count. If the answer is yes, and it almost always is, you need a privacy policy.

Then ask whether you use trackers, sell to consumers and who your users are. Each answer adds documents, as the table shows for a typical website, app or software-as-a-service (SaaS) product.

What must a privacy policy say in each market?

The core content is similar everywhere: who you are, what you collect, why, who receives it, how long you keep it and how people exercise their rights. One global policy with regional sections works for most small businesses.

In the EU and UK, Articles 13 and 14 of the GDPR list what you must tell people, including your ‘lawful basis’, meaning the legal reason you rely on for each use of data, and any transfers outside the region. In California, the CCPA (as amended by the CPRA) requires a ‘notice at collection’ at or before the point you collect data, a detailed policy updated every 12 months, and a “Do Not Sell or Share My Personal Information” link if you sell data or share it for cross-context advertising. California’s older CalOPPA law also requires commercial websites to post a policy and say how they respond to ‘Do Not Track’ signals.

India’s DPDP Rules, 2025, notified on 13 November 2025, set out what a notice must contain: an itemised list of the data, the specific purpose, and a link for withdrawing consent and exercising rights. Those notice rules apply from 13 May 2027, so build them now. Australia is also changing: from 10 December 2026, privacy policies under APP 1 must explain certain automated decisions that significantly affect people.

Do I really need a cookie banner?

In the EU, usually yes. The ePrivacy Directive requires consent before you store or read information on someone’s device, unless it is strictly necessary for the service they asked for. Analytics, advertising pixels, session replay tools and many chat widgets are not strictly necessary. Refusing must be as easy as accepting.

The UK changed course this year. Section 112 of the Data (Use and Access) Act 2025, in force since 5 February 2026, lets you use cookies purely to produce statistics that improve your own site or app without consent, provided you explain them clearly and give users a simple way to object. Advertising and cross-site tracking still need consent. The same reform raised the maximum fine for cookie and marketing breaches from £500,000 to the UK GDPR level of £17.5 million or 4% of global turnover.

The US works the other way round. You can usually set cookies first, but California and a growing list of states require you to let people opt out of ‘sale’ or ‘sharing’, and to treat a Global Privacy Control (GPC) browser signal as a valid opt-out. GPC is a setting in some browsers that automatically tells every site “do not sell or share my data”.

Selling online: terms, refunds and the imprint

Terms and conditions (also called terms of service) are not strictly required by law in most places. But if you sell anything, consumer law requires you to give certain information before purchase, and your terms are the natural home for it. Without them you also have no agreed limit on your liability.

Refund and cancellation information is mandatory in most consumer markets. Under the EU Consumer Rights Directive, consumers who buy online generally have 14 days to cancel without giving a reason. If you fail to tell them about this right, it can stretch to 12 months and 14 days. The UK has an equivalent rule. India’s Consumer Protection (E-Commerce) Rules, 2020 require online sellers and marketplaces to display return, refund, exchange, warranty and grievance information clearly.

If you target Germany, you need an imprint, known as an ‘Impressum’. Section 5 of Germany’s Digital Services Act, the Digitale-Dienste-Gesetz (DDG), which replaced the old Telemediengesetz in May 2024, keeps the duty to show your legal name, address, email, register number and VAT number. Article 5 of the EU e-Commerce Directive requires similar contact details across the EU, so a simple ‘Legal information’ page covers most markets.

Disclaimers, affiliate links and reviews

A disclaimer says what your content is not: medical, financial, legal or other professional advice. It is rarely mandatory, but it helps if a reader later claims they relied on you. It cannot cure misleading content, and doctors and financial advisers often have their own advertising rules.

Affiliate and sponsorship disclosures are a different matter. They are required. The US Federal Trade Commission’s Endorsement Guides, revised in 2023, expect clear disclosure of any material connection, close to the claim, not buried in a footer. Since 21 October 2024 the FTC’s rule on fake reviews and testimonials lets it seek civil penalties for fake or AI-generated reviews, undisclosed insider reviews and review suppression. In the UK, fake reviews have been banned under the Digital Markets, Competition and Consumers Act 2024 since April 2025, and the Competition and Markets Authority can fine directly.

New in 2025–2026: accessibility, AI and children

The European Accessibility Act has applied since 28 June 2025. It covers many consumer-facing digital services, including e-commerce, online banking, e-books and passenger transport apps. Covered businesses must make the service accessible and publish information on how it meets the requirements, usually as an accessibility statement. Micro-enterprises providing services, meaning fewer than 10 staff and turnover or balance sheet of €2 million or less, are exempt.

If your product includes a chatbot or generates content with AI, Article 50 of the EU AI Act has applied since 2 August 2026. People must be told when they are talking to an AI system unless it is obvious, and deepfakes must be disclosed. Your customer terms should also explain who owns AI outputs and who is responsible for checking them, and an acceptable use policy should set out what users must not do with your AI features.

Children need separate attention. In the US, the FTC’s amended COPPA Rule had a compliance date of 22 April 2026 for most changes, including separate parental consent before disclosing children’s data to third parties and a written information security programme. Under India’s DPDP Act, anyone under 18 is a child, and verifiable parental consent will be required from May 2027.

B2B, platforms and app stores

If you sell software to businesses and handle their customers’ data, Article 28 of the GDPR requires a data processing agreement (DPA). It sets out what you may do with the data, your security duties and how you help with breaches. Enterprise buyers will ask for one, plus your list of sub-processors.

In India, platforms that host user content must publish the name and contact details of a grievance officer under the IT Rules, 2021, and e-commerce businesses must do the same under the E-Commerce Rules. From May 2027 the DPDP Rules also require business contact details for someone who can answer privacy questions.

App stores add their own rules, and they enforce them faster than most regulators. Apple requires a privacy policy link, accurate ‘privacy nutrition labels’ and, since 30 June 2022, in-app account deletion for any app that lets people create accounts. Google Play requires a privacy policy, a Data safety form and a way to request account deletion, including from outside the app.

Can I just use ChatGPT to write my privacy policy?

You can use it to draft, but not to decide. A chatbot does not know which tools run on your site or where your vendors store data. It writes a plausible policy for an imaginary business. If yours works differently, you have published a false statement about your data practices.

That is the real risk. In the US, the FTC treats broken privacy promises as deceptive practices: it took action against BetterHelp and GoodRx in 2023 for sharing health data with advertisers despite reassuring privacy statements. California’s first CCPA fine, against Sephora in 2022 for $1.2 million, began with trackers the company had not disclosed as a ‘sale’. In September 2025 California fined Tractor Supply $1.35 million, partly because its privacy notices were inadequate.

What regulators are doing right now

The trend in 2025 and 2026 is clear. Regulators are auditing the gap between what policies say and what websites do. They load pages, refuse cookies, send opt-out signals and watch the traffic.

France’s CNIL fined Google €325 million and Shein €150 million in September 2025, largely for placing advertising cookies without valid consent. In California, the privacy regulator fined Honda $632,500 in March 2025 for making opt-outs harder than opt-ins, and Todd Snyder $345,178 in May 2025 after its cookie preference tool failed for 40 days. In September 2025 California, Colorado and Connecticut announced a joint sweep of businesses not honouring GPC. In May 2026 General Motors agreed to pay $12.75 million over undisclosed sales of driving data.

The lesson is not panic. Check that your legal pages describe your real setup, and re-check whenever you add a tool.