Website Legal Requirements in Australia
By BudgetByte Editorial Team • Published on 04/10/2026
What the Law Expects From a Business Website
Building or refreshing your site? We include a privacy policy page, accessible forms and clear contact details in every build. See our services or ask us a question.
Most small business owners know their website should have a privacy policy, but beyond that, the rules can feel vague. There is no single "website law" in Australia. Instead, several laws that apply to your business also apply to what you publish online and how you collect information through your site.
This guide gives an overview of the main website legal requirements in Australia for small and medium businesses. It points you to the official sources so you can check the detail for your situation.
This is general information only, not legal advice. Laws change, and how they apply depends on your business. For specific advice, speak to a lawyer or the relevant regulator.
1. Privacy: The Privacy Act and Australian Privacy Principles
The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set rules for how organisations collect, use, store and disclose personal information. The Office of the Australian Information Commissioner (OAIC) regulates them.
Does it apply to your business?
The Privacy Act generally applies to businesses with an annual turnover above $3 million. However, some smaller businesses are covered regardless of turnover. Examples include health service providers (which can include allied health, some fitness businesses and others that hold health information), businesses that trade in personal information, and certain contractors to the Australian Government. The OAIC website has a tool to help you check.
What it means for your website
If the APPs apply to you, you need a clearly expressed, up-to-date privacy policy that explains:
- What personal information you collect, such as names, emails, phone numbers and addresses from forms.
- How you collect it, including through forms, cookies, analytics and third-party tools.
- Why you collect it and how you use it.
- Who you disclose it to, such as email platforms, CRMs or overseas service providers.
- How people can access or correct their information, and how to make a complaint.
Even if the Privacy Act doesn't strictly apply to you, having a clear privacy policy is good practice. Customers increasingly expect one, and many tools such as Google advertising products and payment providers require one in their own terms.
Collect only what you need
Ask for only the information you actually use. A quote form for a plumber doesn't need a date of birth. Fewer fields also tend to mean more completed enquiries.
2. Email Marketing and Forms: The Spam Act
The Spam Act 2003 (Cth), regulated by the Australian Communications and Media Authority (ACMA), applies to commercial electronic messages such as emails and SMS. If your website collects email addresses for newsletters or offers, you need to:
- Get consent. Express consent, such as a clearly worded opt-in checkbox that isn't pre-ticked, is the safest approach.
- Identify your business in every message.
- Include a working unsubscribe option and act on it within the required time.
A contact form enquiry is not consent to add someone to your marketing list, unless you clearly asked for that consent.
3. Australian Consumer Law: Claims, Reviews and Prices
The Australian Consumer Law (ACL), enforced by the ACCC and state fair trading agencies, applies to what you say on your website just as it does in any other advertising.
No misleading or deceptive claims
Statements about your services, results, qualifications, guarantees and comparisons with competitors must be accurate and able to be backed up. Be careful with words like "best", "guaranteed" and "cheapest", and with before-and-after images that aren't representative.
Genuine reviews and testimonials
Testimonials must be real and reflect genuine customer experiences. Don't write fake reviews, don't selectively publish only positive reviews in a way that misleads, and disclose any incentive you gave for a review. The ACCC publishes guidance for businesses on online reviews.
Pricing
If you display prices, they generally need to include mandatory charges and, where applicable, GST, rather than advertising a lower base price with unavoidable extras. "From" prices should be genuinely available.
Consumer guarantees
Your terms can't exclude the consumer guarantees that the ACL gives customers. Statements like "no refunds under any circumstances" can be misleading.
4. Accessibility: The Disability Discrimination Act
The Disability Discrimination Act 1992 (Cth) makes it unlawful to discriminate against people with disability in the provision of goods and services, and the Australian Human Rights Commission has made clear this extends to websites. The usual reference point is the Web Content Accessibility Guidelines (WCAG).
In practice, that means things like readable text contrast, alt text for meaningful images, forms that work with a keyboard and screen reader, and video captions. Our guide to website accessibility in Australia explains what to check.
5. Business Identity and Licence Numbers
Customers and regulators need to know who they're dealing with.
- Business name and contact details: show your registered business name (or company name) and clear contact information.
- ABN and ACN: companies have obligations to show their name and ACN or ABN on certain public documents. Displaying your ABN in the footer is a simple trust signal either way.
- Licence numbers: in several states, licensed builders and some tradespeople must show their licence number in advertising, and that can include websites and social media. Check with your state's licensing body, for example NSW Fair Trading or the QBCC in Queensland.
- Regulated professions: health practitioners regulated by AHPRA must follow its advertising guidelines, which restrict things like testimonials about clinical care. Financial services, legal services and real estate have their own rules too.
6. Copyright: Images, Text and Fonts
Using someone else's images, text or code without permission can infringe copyright, even if it's "just for the website".
- Use your own photos, or images licensed for commercial use.
- Keep records of stock image licences.
- Don't copy competitor text. It's a legal risk and bad for SEO.
- Check font and plugin licences.
If someone else built your site, make sure you know who owns the design and content. Our article on who owns your website covers this.
7. Cookies and Tracking
Australia doesn't have a standalone cookie consent law like the EU's. However, if cookies or tracking tools collect personal information, the Privacy Act can apply. Your privacy policy should mention analytics, advertising pixels and similar tools. If you actively target customers in the EU or UK, their laws (such as the GDPR) may also apply, so get advice.
8. Terms and Conditions
Website terms and conditions aren't legally required for every business, but they're strongly recommended if you sell online, take bookings or deposits, or offer quotes and guarantees. Typical terms cover payment, cancellations, refunds (consistent with the ACL), delivery, limitations of liability and website use. You can see how we lay ours out on our terms page, and our privacy policy as an example of the structure a privacy policy usually follows. Your own documents should reflect your business.
A Quick Compliance Checklist
- A clear privacy policy that matches what your forms and tools actually collect.
- Marketing opt-ins that are clear and not pre-ticked.
- Accurate claims, genuine reviews and pricing that includes mandatory charges.
- Accessible design and content, tested with a keyboard and screen reader.
- Business name, ABN, contact details and any required licence numbers.
- Licensed images, fonts and plugins.
- Terms and conditions if you sell, book or take payments.
- A yearly review, because laws and your website both change.
Frequently Asked Questions
Is a privacy policy required on every Australian website?
It's legally required for organisations covered by the Privacy Act, which generally means businesses with annual turnover above $3 million plus some smaller businesses such as health service providers. For everyone else, it's strongly recommended and often required by third-party tools you use.
Do I need a cookie banner in Australia?
There's no general Australian law requiring a cookie banner. You should still explain cookies and tracking in your privacy policy. If you target EU or UK customers, their rules may apply.
Do I have to show my ABN on my website?
Not every business is strictly required to, but companies have obligations to display their ACN or ABN on certain public documents, and showing it is a simple way to build trust. Check ASIC's guidance for your structure.
Can I copy terms and conditions from another website?
No. Their wording is protected by copyright, and it probably doesn't match how your business operates. Use a reputable template service or a lawyer.
Need Help Getting the Basics Right?
We build websites with these foundations in place, including accessible forms, clear contact details and space for your policies. Contact BudgetByte to talk about your site.
Related guide: NDIS Provider Website Design Guide
Related guide: Childcare Website Design: What Parents Want
Related guide: How to Accept Payments on a Business Website
About BudgetByte Editorial Team
The BudgetByte Editorial Team specializes in local SEO and high-performance web development strategies tailored for Australian trades and agencies.
Need a Local Website Built Fast?
We serve small businesses and tradesmen across Australia with premium, affordable web design.
