Every website collects some data. A contact form, an analytics script, a newsletter box, a checkout. Each one comes with legal duties.
Missing legal pages can get your ads rejected, delay your payment account approval, or put you in breach of privacy laws like the GDPR and the CCPA.
Here’s the tl;dr:
- Must-have: privacy policy, terms and conditions, cookie policy, disclaimer, refund and return policy (if you sell).
- Recommended: affiliate disclosure, copyright notice, comment policy, About Us, contact page, shipping policy.
- Link them in your footer and next to every form that collects data.
Why legal pages matter
Legal pages tell visitors what you collect, why, and what rules apply on your site.
They do 3 jobs:
- Meet the law. Most privacy laws require you to explain how you handle personal data.
- Unlock platforms. Ad networks, app stores, and payment providers check for them before they approve you.
- Build trust. Visitors are more likely to sign up or buy when they can see the rules.
5 essential legal pages every website needs
1. Privacy policy
A privacy policy explains how your website collects, uses, stores, and protects visitors’ personal data. That covers forms, cookies, analytics, accounts, and purchases.
It’s the most important legal page you have. If you collect even an email address, you need one.
What to include:
- Types of personal data collected (name, email, IP address, cookies, device data)
- Purpose and legal basis for processing (consent, contract, legitimate interest)
- Third-party services that access data (for example, Mailchimp, Stripe, Google Analytics)
- How you store and secure data
- Contact details for privacy requests
- User rights: access, correction, deletion, and data portability
For a step-by-step setup, see how to create a privacy policy for your website.
2. Terms and conditions (terms of service)
Terms and conditions set the rules for using your website. They form an agreement between you and your users.
No law says every site needs them. They’re still worth having. Terms protect your content and branding, limit your liability, and give you grounds to act when someone misuses your site.
What to include:
- Intellectual property ownership (your content, logos, and branding)
- Acceptable use and prohibited behavior
- Account suspension or termination rules
- Limitation of liability
- Disclaimer of warranties
- Governing law and dispute resolution
Need a starting point? See these terms and conditions examples and how to add terms and conditions in WordPress.
3. Cookie policy
A cookie policy explains which cookies and tracking tools your site uses, what they do, and how visitors can control them.
The EU’s ePrivacy Directive requires clear information about cookies and consent before you set non-essential ones. Pair your cookie policy with a cookie consent banner so visitors can accept or reject them.
What to include:
- Types of cookies used (essential, analytics, marketing, preference)
- Purpose of each category
- How long each cookie lasts
- How to manage or block cookies in the browser
- Links to third-party providers’ policies (Google, Meta, and others)
Not sure how a cookie policy differs from a banner notice? Read cookie notice vs cookie policy.
4. Disclaimer
A disclaimer sets the limits of your liability for your content. It tells visitors the content is general information and doesn’t promise any result.
You need one if you give advice, write reviews, or cover health, legal, financial, or fitness topics.
What to include:
- “Not professional advice” notice for medical, legal, financial, or fitness content (see these medical disclaimer examples)
- Accuracy and errors notice (information may change)
- External links disclaimer
- Earnings or results disclaimer, if you talk about income or outcomes
Want the details? Here’s how legal disclaimers work.
5. Refund and return policy (for ecommerce)
A refund and return policy explains when and how customers can return, exchange, or get money back for a purchase.
Payment providers check for it. Stripe’s website checklist lists refund, return, shipping, and cancellation policies as required for most businesses that sell online.
What to include:
- Return window (for example, 14 or 30 days)
- Conditions for accepting returns (unused, original packaging)
- Refund processing time
- Who pays return shipping
- What happens if an item arrives damaged
- Non-refundable items or exceptions
- Steps to request a return or refund
Read more: how to write a return policy, or the WooCommerce returns and refund policy guide if you run a WooCommerce store.
Recommended pages: not always required, still worth adding
These pages make your site look like a real business and close gaps the 5 essentials don’t cover.
Affiliate disclosure
If you earn money from links, sponsorships, or free products, tell your readers. In the US, the FTC’s Endorsement Guides require it.
Sample wording from the FTC’s own guidance:
I get commissions for purchases made through links in this post.
Put the disclosure close to the link or recommendation. The FTC says one disclosure on your home page isn’t enough, and readers may miss one at the bottom of a page. Also disclose sponsorships and any other financial ties that could affect what you recommend.
See why your site needs an affiliate disclosure and how to add a disclosure to your website. Amazon Associates? Use the Amazon affiliate disclosure guide.
Copyright notice
A copyright notice shows who owns your content. The format is the © symbol, the year of first publication, and the owner’s name (for example, “© 2026 Your Business Name”).
In the US, a notice has been optional since March 1, 1989. Adding one still helps. It stops an infringer from claiming they didn’t know the work was protected (U.S. Copyright Office, Circular 3). More in our copyright notice guide.
Comment policy
If visitors can comment, set the rules up front. Say which comments you remove (spam, abuse, off-topic links), who decides, and how someone can appeal a removal. Comments are also personal data, so check how you handle user-generated content.
About Us page
Tells visitors who runs the site and why. People trust businesses they can put a face and a story to.
Contact page
List an email address and, if you have one, a business address. A real contact route shows you’re a legitimate business. Payment providers look for it too.
Terms of use
Often used interchangeably with terms and conditions. Terms of use focus on how people may use your site and content. See terms of use policy.
Shipping policy
For online stores. Delivery times, costs, and international limits. Clear shipping terms cut support tickets. Here’s how to create a shipping policy.
EU business? You may also need an Impressum.
Which legal pages are required by major privacy laws?
Each privacy law asks for slightly different pages. Most of them focus on transparency and user rights.
| Privacy law | Region | Required legal pages | Purpose |
|---|---|---|---|
| GDPR | European Union | Privacy policy, cookie policy, cookie consent notice, data request page | Transparency, lawful processing, and user control over their data |
| CCPA / CPRA | California, USA | Privacy policy, “Do Not Sell or Share My Personal Information” page, notice at collection | Tells users how data is used and lets them opt out of sale or sharing |
| UK Data Protection Act 2018 | United Kingdom | Privacy policy, cookie policy, user rights information | Clear disclosure of data use and privacy rights |
| LGPD | Brazil | Privacy policy, cookie policy, data subject rights page, DPO contact details | Transparency and user rights similar to GDPR |
| DPDP Act | India | Privacy policy, consent notice, grievance or contact page | Tells people their rights and gives them a way to complain |
In the US, more states pass their own privacy laws every year. See the complete guide to US state privacy laws.
What happens if your website doesn’t have legal pages?
- Fines and legal action. Privacy laws like the GDPR and the CCPA require clear data disclosures. No policy means you’re out of compliance.
- Rejected ads and integrations. Google Ads, Meta Ads, and app stores usually require a privacy policy. Without one, ads can be rejected and accounts suspended.
- Payment delays. Payment providers like Stripe review your site for a privacy policy and fulfillment policies. Missing pages can delay or block approval.
- Lost trust. Visitors who can’t find privacy information often leave or won’t fill in your forms.
- Weaker credibility. A store, SaaS, or lead-generation site without legal pages looks unsafe.
Where to display your legal pages
A legal page only works if people can find it.
- Footer. Link every legal page here so it shows on every page. Use clear labels like “Privacy Policy”, not “Legal” or “Info”.
- Data collection points. Put a privacy policy link next to every form that asks for personal data.
- Checkout and registration. Add a notice or checkbox saying the user agrees to your terms and privacy policy.
- Cookie banner. Link your cookie policy or privacy policy in the banner, so visitors know what they’re agreeing to.
- App store listings. Apple’s App Store and Google Play both require a privacy policy link on your app’s listing.
How to create legal pages for your website
WPLP Legal Pages builds your legal pages from your answers about your site, then publishes them in WordPress. You don’t copy and paste anything, and you don’t start from a blank page.
How it works:
- Install the plugin. In WordPress, go to Plugins > Add New, search for “WPLegalPages”, then install and activate it.
- Add your business details once. Business name, address, domain, and niche. Every page you create uses them, so your pages stay consistent.
- Pick a page. Choose the template you need from 30+ legal page templates.
- Answer the questionnaire. Tell it what your site does: contact forms, analytics, newsletter sign-ups, checkout, affiliate links. The page covers what you selected.
- Review and publish. Edit the page in Gutenberg, Elementor, or Divi like any other page, then publish.
- Add it to your footer. Use WPLP’s footer option to link your legal pages on every page of your site.
Pages you can create include:
- Privacy policy (including GDPR and CCPA versions)
- Terms and conditions, and terms of use
- Cookie policy
- Disclaimers: general, medical, and earnings
- Returns and refunds policy
- Affiliate disclosure
- DMCA notice
- Impressum
Templates are available in 7 languages: English, German, Spanish, French, Italian, Dutch, and Portuguese.
When laws change: WPLP drafts the updated text for you. Nothing goes live on your site until you approve it.
Managing more than one site? The WPLP web app lets you see and manage every site’s legal pages from one login.
Best practices for drafting legal policies
Whichever way you create them, these rules apply.
| Good practice | Bad practice |
|---|---|
| Clear, plain language | Heavy legal or technical jargon |
| Specific list of data you collect | Vague, broad collection statements |
| Clear consent before collecting data | Consent assumed or hidden |
| Easy opt-out options | No way to opt out |
| Regular updates with a “last updated” date | Outdated policies |
| Third-party sharing named | Hidden third-party sharing |
| Security measures described | No mention of security |
| User rights and how to use them | No user rights information |
8 rules to follow:
- Write in plain language. If a visitor needs a lawyer to read it, rewrite it.
- Keep it unique. Your policy has to describe your site, not someone else’s.
- Update it. Change it when you add a tool, a form, or a new data use, and when a law that applies to you changes.
- Follow it. A policy you don’t follow is worse than none. It’s a false statement.
- Make it easy to find. Footer link, plus links at every data collection point.
- Protect the data you collect. HTTPS, limited access, secure storage.
- Collect only what you need. Skip sensitive data (health, ID numbers, financial details) unless you need it.
- Check FTC and state rules. US sites have duties beyond privacy, such as disclosures and state privacy laws.
For more, see internet privacy policy best practices and privacy policy issues to avoid.
FAQ
Almost every site needs a privacy policy. If you use cookies or tracking for EU visitors, you need cookie information and consent, usually in a cookie policy plus a banner. If you sell online, add a refund and return policy.
No law requires them for every site. They’re still worth having: they protect your content, limit your liability, and set the rules for users.
Some do. The GDPR applies if you offer goods or services to people in the EU or track their behavior, whatever your size. The CCPA applies only to businesses that meet its thresholds, such as more than $26,625,000 in annual revenue. California’s CalOPPA requires a posted privacy policy on any commercial site that collects personal data from California residents.
What data you collect, why, who you share it with, how long you keep it, and how users can use their rights.
No. You need one anywhere you share affiliate links: YouTube, social media, podcasts, and email newsletters.
Yes. The FTC sets no minimum amount. If you get paid when someone buys, disclose it.
Yes. Terms set rules against spam, abusive content, and misuse. They give you clear grounds to remove content or ban users who break them.
Conclusion
Start with the 5 essentials: privacy policy, terms and conditions, cookie policy, disclaimer, and a refund policy if you sell. Then add the pages your site’s activities call for: an affiliate disclosure if you earn from links, a comment policy if visitors can comment, a copyright notice for your content.
Link them in your footer and at every form. Update them when your site changes.
Need them done fast? WPLP Legal Pages builds them from your answers and publishes them in WordPress.
This article is for information only and is not legal advice.
Related reads:
