If you run a small business and you have been asking yourself "what legal pages does my website need," the short answer is that most sites need fewer than people fear, but a few pages really are worth having. The longer answer depends on what your site actually does: whether you collect email addresses, take payments, use analytics, or give advice that people might act on.
This guide walks through the legal pages that matter for a typical small business website, plainly and without the scare tactics. You will see which pages nearly everyone should have, which ones depend on your situation, and where a done-for-you service like Arbor simply adds them so you never have to think about it. A quick note first: this is general information, not legal advice. If your situation is unusual or you handle sensitive data, talk to a lawyer.
The short list: what most small business sites need
For the vast majority of local and service businesses, the legal side of a website comes down to three or four pages. Here is the core set.
| Page | Who needs it | Why it matters |
|---|---|---|
| Privacy Policy | Almost every site | Explains what data you collect (contact forms, analytics, cookies) and how you use it. Often required by law and by tools like Google. |
| Terms of Service (or Terms of Use) | Most sites, especially with bookings or sales | Sets the rules for using your site and your services, and limits your liability. |
| Cookie notice | Sites using analytics or ads | Tells visitors about tracking and, in some regions, asks consent. |
| Accessibility statement | Recommended for all | Shows you take accessibility seriously and gives visitors a way to report issues. |
If you only remember one, make it the Privacy Policy. Even a simple site with a contact form is collecting a name and email, and that alone is usually enough to warrant one. We cover this in more depth in do I need a privacy policy on my small business website and the narrower case of a website with only a contact form.
Privacy Policy: the one almost everyone needs
A privacy policy is a page that explains, in plain terms, what personal information your website gathers and what you do with it. That includes obvious things like contact form submissions and less obvious things like Google Analytics, Facebook pixels, and embedded maps.
Why does it matter so much? A few reasons stack up:
- Privacy laws in many states and countries expect it once you collect any personal data.
- Google and Facebook require one if you run ads or use their tracking tools.
- It builds trust. Visitors are more comfortable filling out a form when they can see how their information is handled.
You can technically be fined for not having one in some jurisdictions, though enforcement against small local businesses is rare. We break the real risk down in can you get fined for not having a privacy policy. The practical takeaway: it is cheap peace of mind, so add it.
Terms of Service: setting the rules
Terms of Service (sometimes called Terms of Use or Terms and Conditions) is the page that lays out the ground rules for using your website and, often, your services. It typically covers things like acceptable use, intellectual property, payment and refund terms if you sell, and a limitation of liability.
A brochure-style site that just shows your services and a phone number can often get by without formal terms. But the moment you take bookings, sell products, or let people create accounts, terms become genuinely useful. They protect you if a dispute comes up and clarify what customers can expect. If you are building out an online store, terms plus a clear refund policy are close to essential.
Cookie notices and consent
If your website uses analytics or advertising tools, it is placing cookies on visitors' devices. In some regions, most notably the EU and UK, you need to tell people and, for non-essential cookies, get their consent before those cookies load.
For a US-only local business, a simple cookie notice inside or alongside your privacy policy is usually enough. If you serve customers abroad, a consent banner is the safer route. Either way, keep it honest and specific rather than vague. If you use Google Analytics, our guides on setting up Google Analytics 4 and small business website analytics explain what you are actually collecting.
Rule of thumb: if a tool on your site can identify or track a visitor (analytics, ad pixels, chat widgets, embedded videos), your privacy policy should name it and your cookie notice should mention it. When in doubt, disclose it.
Pages that depend on your business
Beyond the core set, a few legal pages matter only for certain businesses. Skip the ones that do not apply to you.
Disclaimers
If you give advice that people could act on, a disclaimer protects you. Health coaches, fitness trainers, financial and legal information sites, and similar businesses often add a "not professional advice" line. We cover two common cases: the medical disclaimer for a health coach website and the broader not-professional-advice disclaimer.
Accessibility statement
An accessibility statement signals that your site aims to be usable by people with disabilities and gives visitors a way to flag problems. It is not a magic shield against lawsuits, and overlay widgets are not either (see do accessibility overlay widgets protect you). The better path is building an accessible site in the first place, which we walk through in the website accessibility guide. Whether you strictly need the statement itself is covered in do I need an accessibility statement.
Refund, shipping, and return policies
Selling physical products online means customers expect clear shipping and return terms, and payment processors often require them. Our small business shipping guide and notes on setting up online payments go deeper here.
Where to put your legal pages
Legal pages do not belong in your main navigation. The standard, expected place for them is the website footer, in small text near your copyright line. That keeps them out of the way while remaining easy to find, which is exactly what visitors and regulators expect. Our guide on what to put in a website footer shows a clean layout, and the broader essential pages for a small business website guide puts these legal pages in context with the rest of your site.
How to actually create them (without overthinking it)
You have a few options for producing these pages:
- A reputable policy generator. Fine for a straightforward local business. Read what it produces and edit anything that does not match how you operate.
- A lawyer. Worth it if you handle sensitive data, operate in regulated industries, or sell across borders.
- A done-for-you website service. The pages get added for you as part of the build, in the right place, and kept consistent with the rest of the site.
Whichever route you choose, the two mistakes to avoid are copying a competitor's policy word for word (it may not describe your business, and it is their content) and writing terms that promise things you do not actually do. Accuracy beats length every time.
Frequently asked questions
Do I legally need a privacy policy for a simple contact-form website?
In most cases, yes. A contact form collects personal information (a name and email at minimum), and many privacy laws are triggered by collecting any personal data at all. A short, honest privacy policy covers you. We look at this exact scenario in do I need a privacy policy if my website only has a contact form.
Can I just copy legal pages from another business?
It is not a good idea. Their policy describes their data practices and their services, not yours, so it may claim things that are untrue for you or miss things you actually do. It is also their content. Use a generator or have the pages written for your specific business instead.
Where should legal pages appear on my site?
In the footer, in small text, on every page. That is where visitors, search engines, and payment processors all look for them. Keep your primary navigation focused on the pages that help customers hire or buy from you.
Let Arbor handle the legal pages for you
Figuring out what legal pages your website needs is the kind of small, nagging task that is easy to put off. With Arbor, you do not have to. We build your site for you and add the standard legal pages (privacy policy, terms, cookie notice, accessibility statement) automatically, in the footer where they belong, so your site launches complete. Need to change something later? Just ask Sage, our built-in AI editor, in plain English.
If you would rather start by seeing where your current site stands, run the free SEO & AI Score to get a quick, honest read on how your website looks to Google and AI answer engines. And if you are still deciding whether to build it yourself or hand it off, our guide on DIY website vs hiring a web designer is a good next read.