Europe · 9 laws · 45 requirements
United Kingdom: the laws your website or app must follow
If your customers are in United Kingdom, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
Coming up in United Kingdom
- 2027-01-01 · DMCC Act 2024 (consumer protection): Unfair commercial practices rules and CMA direct fines (up to 10% of global turnover) since 6 Apr 2025; the subscription contract rules apply to contracts made from 1 Jan 2027 (draft regulations laid Oct 2026, awaiting Parliament's approval).
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
UK GDPR
In force; amended by the Data (Use and Access) Act 2025 (main provisions from 5 Feb 2026; complaints procedure from 19 June 2026).
Who it covers: Anyone established in the UK or targeting or monitoring people in the UK.
What it requires of a website or app (11)
- Be able to show who consented, to what and when (consent records) (if if you rely on consent)CheckedArt. 7(1)
- A lawful basis for each use; DUAA adds 'recognised legitimate interests' (no balancing test) for listed purposesAI reviewArt. 6
- A privacy notice with identity, purposes and basis, recipients, retention, rights, complaints and transfersCheckedArt. 13–14
- People can access, correct and delete their data; searches for access requests must be reasonable and proportionateCheckedArt. 15–17
- A complaints procedure, with complaints acknowledged within 30 daysPreparedDPA 2018 s. 164A (DUAA)
- Security appropriate to the riskCheckedArt. 32
- Breach notification to the ICO within 72 hoursCheckedArt. 33
- Automated decisions: significant decisions on special-category data need consent or another basis; others need safeguards (information, human review, contest)AI reviewArt. 22A–22D (DUAA)
- International transfers: the destination's protection is 'not materially lower'CheckedCh. V (DUAA)
- A UK representative if not established in the UK (if if not established in the UK)CheckedArt. 27
- Pay the ICO data protection feePreparedDP (Charges and Information) Regs 2018
Data Protection Act 2018
In force; amended by DUAA 2025.
Who it covers: Supplements UK GDPR (conditions for special-category data, exemptions, ICO powers).
What it requires of a website or app (2)
- An appropriate policy document when processing special-category data under Schedule 1 conditions (if if you handle special-category data)PreparedSch. 1 Part 4
- Criminal-offence data only under a Schedule 1 conditionAI reviews. 10–11
Sources:Data Protection Act 2018
PECR
In force; DUAA 2025 added consent exemptions (from 5 Feb 2026) and raised fines to UK GDPR levels.
Who it covers: Cookies and similar technologies, and electronic marketing, for UK users.
What it requires of a website or app (4)
- Consent before non-essential cookies; analytics used only for statistics may run without consent if users are told and can opt outCheckedReg. 6 (as amended)
- Advertising and session-replay cookies always need consentCheckedReg. 6
- Consent for marketing emails and texts to individuals (soft opt-in for customers; now also charities) (if if you send marketing emails)Your answersReg. 22
- Every marketing message identifies the sender and offers a simple opt-out (if if you send marketing emails)Your answersReg. 22–23
Sources:ICO guide to PECR
Age Appropriate Design Code
In force since 2 Sept 2021.
Who it covers: Online services likely to be accessed by children under 18 in the UK.
What it requires of a website or app (6)
- Assess whether children are likely to use the service, and their ageYour answersStd 3
- High privacy by default; geolocation and profiling off by default (if if children use the product)Your answersStd 7, 10, 12
- No nudge techniques that weaken children's privacy (if if children use the product)AI reviewStd 13
- Design choices take children's higher protection into account: protect and support children at their age and stage of development (if if children use the product)AI reviewUK GDPR Art. 25(1A) (Data (Use and Access) Act 2025 s. 81, in force 5 Feb 2026)
- Child-friendly privacy information (if if children use the product)Your answersStd 4
- A DPIA covering children's risks (if if children use the product)PreparedStd 2
Sources:ICO Children's code
Online Safety Act
Illegal-content duties from 17 Mar 2025; children's duties from 25 July 2025.
Who it covers: User-to-user services (users can share content with each other) and search services with links to the UK.
What it requires of a website or app (8)
- An illegal content risk assessment, kept up to date (if if users can share content)Your answerss. 9
- A children's access assessment; if children are likely to access, a children's risk assessment (if if users can share content)Your answerss. 35–36, 11
- Highly effective age assurance for pornographic or other primary priority content (if if such content is possible)AI reviews. 12, 81
- Easy ways to report content and complain (if if users can share content)Your answerss. 20–21
- Terms of service that explain how users are protected (if if users can share content)Your answerss. 10(5)
- Highly effective age assurance before anyone sees pornographic content the service publishes itself (if if you publish pornographic content)CheckedPart 5, s. 81
- Children are protected from harmful content (violence, self-harm, dangerous challenges) on services they are likely to access (if if children can access the service)Checkeds. 11–12
- Terms say what content is not allowed and how users are protected (if if users can share content)Checkeds. 10(5) & 71–72
Sources:Ofcom online safety documents
Consumer Rights Act 2015 & Consumer Contracts Regulations 2013
In force.
Who it covers: Businesses selling goods, services or digital content to UK consumers.
What it requires of a website or app (4)
- Before purchase: who you are, your address, total price, how to cancel and the 14-day cancellation right (if if you sell to consumers)CheckedCCR 2013 reg. 13 & Sch. 2
- Subscriptions: duration, renewal and how to end the contract are clear before purchase (if if you sell subscriptions)CheckedCCR 2013 Sch. 2 (s), (t)
- Terms are fair and transparent; no excluding liability for negligence causing death or injury, or statutory rights (if if you sell to consumers)CheckedCRA 2015 s. 31, 57, 62, 65 & Sch. 2
- Digital content is of satisfactory quality, fit for purpose and as described, with a repair, replacement or refund remedy (if if you sell digital content)AI reviewCRA 2015 s. 34–36, 42–45
Sources:Consumer Rights Act 2015 (legislation.gov.uk) Consumer Contracts Regulations 2013
DMCC Act 2024 (consumer protection)
Unfair commercial practices rules and CMA direct fines (up to 10% of global turnover) since 6 Apr 2025; the subscription contract rules apply to contracts made from 1 Jan 2027 (draft regulations laid Oct 2026, awaiting Parliament's approval).
Who it covers: Businesses dealing with UK consumers.
What it requires of a website or app (4)
- No fake reviews, and reasonable steps to prevent and remove them (if if you show reviews)AI reviewSch. 20 (banned practices)
- Prices include unavoidable fees up front (no drip pricing) (if if you show prices)AI reviews. 230
- No misleading claims or omissionsCheckeds. 226–227
- Subscriptions: pre-contract information, reminders and easy online exit (if if you sell subscriptions)CheckedPart 4 Ch. 2 (planned for 1 Jan 2027)
Sources:Digital Markets, Competition and Consumers Act 2024 GOV.UK: subscription contracts rules and draft guidance
Gambling Act 2005
In force; Gambling Commission licence conditions (LCCP) updated regularly.
Who it covers: Anyone offering gambling, betting or real-money prize games to people in Great Britain.
What it requires of a website or app (3)
- A Gambling Commission operating licence before offering gambling to people in Great Britain (if if you offer gambling)Checkeds. 33 & 36
- Age and identity verified before anyone deposits or plays (if if you offer gambling)CheckedLCCP SR 3.2.11
- Safer-gambling tools: deposit limits, time-outs, self-exclusion and signposting to help (if if you offer gambling)CheckedLCCP SR 3.3–3.5
Sources:Gambling Commission: LCCP
FSMA 2000 s. 21 (financial promotions)
In force; crypto-asset promotions in scope since 8 Oct 2023.
Who it covers: Anyone promoting investments or crypto-assets to people in the UK.
What it requires of a website or app (3)
- Investment and crypto promotions are issued or approved by an FCA-authorised firm (if if you promote investments or crypto)CheckedFSMA s. 21
- Promotions are fair, clear and not misleading and carry the prescribed risk warning (if if you promote investments or crypto)CheckedCOBS 4.2, 4.12A
- Crypto: a 24-hour cooling-off for first-time investors and an appropriateness check (if if you promote crypto-assets)AI reviewCOBS 4.12A
Sources:FCA: financial promotions
Licensed professionals in United Kingdom
These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.
Check your site against United Kingdom's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.