People building a first online store usually think about products, photos and payment. The legal side gets pushed to the week before launch and then done badly, which is a shame because most of it is straightforward. None of what follows is legal advice. It is the list we work through with clients so nothing obvious is missing on launch day. For anything unusual, talk to a solicitor. Say who you are A business selling online has to be identifiable. That means your trading name, your legal entity name if different, a geographic address, and a way to contact you electronically. If you are a limited company, the company number and place of registration belong there too, along with the VAT number if you are registered. The usual home for this is the footer plus a contact page. Burying it two clicks deep in a terms document is not the point of the requirement. Sole traders sometimes leave the address off because they work from home. You still need a geographic address where you can be contacted. A service address is a normal solution to this. The right to change their mind For most distance sales to consumers, the buyer can cancel within a set period after delivery and get their money back, without giving a reason. This is not a returns policy you invent, it is a statutory right. Two things follow from it. You must tell people the right exists before they buy, and you must make cancelling practical rather than obstructive. There are exceptions. Made to measure goods, perishables, sealed items unsealed after delivery, digital content the customer agreed to receive immediately. If you sell in any of these categories, know which exception applies to you and say so clearly on the product page. The most common mistake is publishing a fourteen day returns window and then requiring original packaging, a receipt and a reason. That converts a legal right into a negotiation and it is exactly what generates complaints. Delivery and who pays for the return Set out delivery costs and timescales before checkout, not after. A cost that appears only on the final screen is the single largest cause of abandoned baskets and it is also the thing regulators look at first. Be specific about who pays return postage on a cancellation. You can require the customer to pay it, but only if you told them beforehand. If you did not, it falls to you. Refunds have a deadline too. Do not let it drift because someone is on holiday. Build it into the process. Faulty goods are a different thing Cancellation and faults are separate regimes and people mix them up constantly. Cancellation is a change of mind and time limited. A fault is a fault, and the remedies available depend on how long the customer has had the item, not on your returns window. Write them as two sections. A single blended policy will be wrong for one of the two cases. Terms and conditions that describe your actual business A downloaded template is better than nothing and worse than it looks. Templates describe a generic shop, and the moment there is a dispute, the paragraph that matters is the one about your specific situation. At minimum your terms should cover when the contract is formed, pricing and what happens if a price is displayed incorrectly, delivery, cancellation and returns, faults, limits on liability, and which law applies. The pricing error clause earns its place. Someone will eventually order at a price that was wrong, and without a clause you are arguing from scratch. Data protection is not just a privacy page A store collects names, addresses, emails, order history and possibly more. That triggers real obligations, and a privacy notice is the visible part rather than the whole thing. Your notice needs to say what you collect, why, on what lawful basis, who else sees it, how long you keep it, and what rights people have. Written so an ordinary customer can follow it. The part people skip is the retention period. Publishing a period and then keeping everything forever makes the notice a false statement. Pick a period you can actually apply and build the deletion into the process. Also list your processors. Payment provider, courier, email platform, hosting. Each of them handles customer data on your behalf and each should be under a contract that says so. Marketing consent is separate from everything else Somebody buying from you has not agreed to receive marketing. Those are two different permissions. There is a narrow allowance for emailing existing customers about similar products, with an opt out on every message and an opt out offered at the point of collection. Everything else needs consent that was actively given. A pre-ticked box is not consent. Neither is a checkout that bundles marketing agreement into the purchase. Keep a record of when and how each person consented. If it is ever questioned, the record is the only thing that helps you. Cookies and anything stored on the visitor's device The rule is wider than cookies. It covers storing anything on someone's device or reading what is already there, which includes local storage and similar techniques. Strictly necessary items, such as the one that keeps a basket working, do not need consent. Analytics and advertising do, and consent has to be given before they run rather than assumed while they already are. The honest alternative is to not store anything at all. Measurement that works without writing to the visitor's device sidesteps the whole regime. We took that route on our own site, which is why there is no consent banner on it. Accessibility is not optional in spirit Discrimination law applies to services provided online. A store that a screen reader user cannot check out on is a service they cannot use. The practical version is unglamorous. Real alt text on images, a heading structure that makes sense, forms with labels, adequate colour contrast, and every interactive element reachable by keyboard. These are also the things that help search engines understand the page, so the work pays twice. Taxes and the boring infrastructure Know your VAT position before launch, not after the first quarter. Whether you are registered changes your pricing display, your invoices and your checkout. If you sell across borders, the rules on where VAT is due depend on what you sell and to whom. This is the area where getting proper advice early is cheapest. Keep invoices and order records for the period your tax authority requires, and make sure the store can produce them. A pre-launch checklist Company details and contact address visible in the footer Delivery costs and timescales shown before checkout Cancellation rights explained, with any exceptions stated on the product page Returns and faults written as two separate sections Terms and conditions that describe your business, including a pricing error clause Privacy notice with a retention period you actually apply Processor list and contracts in place Marketing consent collected separately, with records Consent handled before any non-essential storage runs, or nothing stored at all Keyboard access, labels, alt text and contrast checked VAT position confirmed and reflected in prices and invoices Working through this before launch takes a couple of days. Doing it after the first complaint takes considerably longer and costs more.