Most legal advice for websites is written for companies with a legal team. This is for the other case: you built something, it has a login or a form, and you’d like to launch without guessing. Here’s what applies to small sites, in the order it tends to get checked.
This is a practical guide, not legal advice. If real money, health data, children or a regulator’s letter is involved, talk to a lawyer.
1. A privacy policy people can find
If you collect anything about visitors (emails, accounts, analytics, payments), you need one. In the EU and UK that comes from the GDPR. In the US, California’s CalOPPA requires a posted policy from any commercial site that collects personal information from Californians, with no minimum size. The CCPA, which people often quote, only applies to large businesses. In practice the first to ask are platforms: app stores, Stripe and Google sign-in all want a link. What goes in it.
2. Consent before tracking
For visitors in the EU and UK, cookies and trackers that aren’t strictly necessary need a yes first. That covers Google Analytics, ad pixels and most session-recording tools. Whether you need a banner, and what to do about Google Analytics.
3. Terms of service
Rarely required by law, nearly always worth having: they’re your rules for accounts, payments, refunds and liability. What a small product’s terms should cover.
4. A way to reach you
Privacy laws need a contact for data requests, and several countries require commercial sites to identify their operator. Germany is the strictest: a commercial site aimed at German customers needs an Impressum with a name and address. Everywhere else, an email in the footer is the floor. Why it matters.
5. Accessibility basics
In the US, website accessibility lawsuits under the ADA are routine, and the European Accessibility Act has applied to many consumer services since June 2025. Small teams are often exempt from the EU rules, but the basics cost minutes. What the law says, and the five-minute fixes.
6. Honest outside services
Every outside company your page contacts, from fonts to embedded video, sees your visitors’ IP addresses. Your policy should name them. Most founders have never counted: here’s how to.
What this looks like on your site
A vibeliq scanopens your site in a real browser and checks the visible half of this list: whether a policy and terms are linked from every page, which trackers and cookies fire before consent, which outside companies get contacted, and the accessibility basics. It can’t read your policy for accuracy, and it isn’t a lawyer. It tells you what’s missing and hands you a prompt to fix it.