---
title: "Which legal pages does your business website need? Legal notice, privacy and cookies without the jargon"
description: "Which legal pages a small business website needs: legal notice, privacy policy and cookies, the details that are mandatory and the myths you can skip."
date: "2026-10-26"
category: "Websites for business"
keywords: "legal pages website, mandatory legal notice, privacy policy small business, cookie policy, Spanish LSSI GDPR website"
portada: "/portadas/portada-aviso-legal-privacidad-y-cookies-de-tu-web.webp"
---

Almost every small business website I review has its legal pages done wrong. Not because they're missing — the three are usually there — but because they were copied from another website: another company's name appears, a tax ID that isn't yours, a contact email that doesn't exist, and a cookie policy talking about tools you don't use. And then there's the opposite: businesses that do collect data through a form and don't have a single line of privacy information.

You don't need a law degree: you need three pages that tell the truth about what your website actually does.

**A note before we start:** I'm not a lawyer and this isn't legal advice. It's what I apply on the websites I build and what I've learned reviewing other people's. If you sell online, work with health data or operate in a regulated sector, it's worth having a professional look at it.

## The usual three pages and the fourth almost nobody adds

1. **Legal notice.** Who is behind the website. Spanish law (the LSSI) requires it for any website with commercial activity, whether it has one page or fifty.
2. **Privacy policy.** What you do with the data of anyone who writes to you. Mandatory as soon as there's a form, a contact email, a booking or analytics.
3. **Cookie policy.** What you store in the visitor's browser and why. Mandatory if you use cookies that aren't strictly technical.
4. **Terms of sale.** The fourth one, the one almost nobody adds until they sell online. If you charge through the website you need terms, delivery times, the right of withdrawal and a purchase button that makes it clear the customer is paying.

## Legal notice: the specific details that must appear

The LSSI asks for at least this:

- Full name if you're self-employed, or company name if it's a company.
- Tax ID (NIF or CIF).
- Address (your premises or your tax address; it doesn't have to be an office).
- A real contact email that someone actually reads.
- A phone number, if you publish one on the website.
- Companies Registry details if it's a company: volume, folio, sheet and registration number.
- Professional association or health registry number if you work in a regulated profession: law, medicine, dentistry, psychology, insurance broking, estate agency…

The mistake I see every week: putting only the trading name ("Smile Clinic") without saying who the owner is. It has to be the natural or legal person who is responsible, not the brand.

## Privacy policy: the key is that it matches reality

A generic 40-page text is useless here. The policy has to answer six questions and answer them with your real tools:

1. **Who is the data controller**: your name or your company's, with tax ID and email.
2. **What for**: answering enquiries, sending quotes, managing bookings, sending news.
3. **On what legal basis**: usually your consent when you submit the form, or legitimate interest if it's data from customers you already have a relationship with.
4. **Who you pass it to**: your email provider, your hosting provider, the payment gateway, the analytics tool, the booking tool. Even if they're only processors, they have to be named.
5. **How long you keep it**: "until you ask me to delete it" is not an answer. Give a period (for example, for the duration of the commercial relationship plus the years tax law requires).
6. **How rights are exercised**: access, rectification, erasure, objection, portability and restriction, with an email to request it and the option to complain to the Spanish Data Protection Agency.

The most common mistake: the policy says "we don't share your data with third parties" and then the website runs Google Analytics, a WhatsApp chat, Google Fonts and a newsletter service. All of that "shares" data, even if only technically.

And a detail that always gets forgotten: the form needs an unticked consent box. A form that only says "Send" doesn't collect valid consent.

## Cookies: consent comes first, and rejecting has to be just as easy

The rule here is article 22.2 of the LSSI, and since the 2024 Spanish DPA guidance it's fairly clear:

- Only **technical or necessary** cookies are exempt: session, cart, security, language preference. Those don't need permission, but they do need an explanation.
- **Analytics and advertising** need prior consent. Yes, Google Analytics too, even if it's "just to see how many people come in".
- The **reject** button has to be at the same visual level as accept. No button hidden on a second layer and no tiny grey text.
- No pre-ticked boxes.
- The visitor has to be able to **change their mind** whenever they want, with a permanent "Cookie settings" link in the footer.
- "By continuing to browse you accept" no longer works.

| Type of cookie | Needs permission? | Example |
|---|---|---|
| Technical | No | Session, cart, language |
| Preferences | No, if they're yours | Light/dark theme |
| Analytics | Yes | Google Analytics, hosting metrics |
| Advertising | Yes | Meta pixel, remarketing |
| Embedded third parties | Yes | Google map, YouTube video, external font |

A practical tip: if you want to avoid half a banner, embed the map as an image linking to Google Maps and don't load fonts from other people's servers. Fewer cookies to manage and the website loads faster.

## The myths that cost money and achieve nothing

- **"You have to register the website with the Ministry."** That registry doesn't exist. Not at the Ministry, not anywhere official. They sell it to you with a pretty certificate.
- **"You need a secure site or trust seal."** Those seals are advertising for private companies. What visitors really look at is the browser padlock, and that's the SSL certificate. If the "not secure" warning shows up, that's the problem.

## What it costs to do it properly

- **Adapting templates yourself:** €0 and two hours across the three pages, if you know what to put in them.
- **Asking whoever built the website:** normally it's part of the project. If they charge separately, €50 to €150 is fair.
- **Lawyer or adviser:** €150 to €400 if there's an online store, health data or a regulated sector.

## What you can check this afternoon

1. Open your website on your phone, scroll to the footer and check the legal links are on **every** page, not just the home page.
2. Look for your tax ID in the legal notice. Is it yours? Does your name or your company's appear?
3. Read the privacy policy and cross out what you don't use. If it mentions a chat you no longer have, it's surplus.
4. Open the website in a private window and look at the cookie banner: can you reject without hunting? Can you change your mind later?
5. Send your own form and check the consent box wasn't already ticked.

Once that's sorted you're ahead of 90% of your competitors, who usually have all three pages copied from a six-year-old template.

If you'd rather not wrestle with this, the websites I build include the legal pages, filled in with your real details and with a cookie banner that genuinely rejects: you can [request a free design proposal](/solicita-web/en) and I'll tell you what your business would need, with no commitment.

You may also find these useful:

- [What to do if your website says "not secure"](/blog/en/web-dice-no-es-seguro-certificado-ssl) — the warning that really scares customers away.
- [The essential sections of a business website](/blog/en/secciones-imprescindibles-de-una-web-para-negocio) — where the legal pages fit without getting in the way.

In the end, legal pages are like car insurance: they don't bring you customers, but the day something happens, they're the only thing covering you. And doing them properly costs less than a lost afternoon copying someone else's.