Skip to content

The Legal Pages Almost Every Site Is Missing

Scroll to the footer of any ten small-business websites and count the legal pages. You'll usually find a privacy policy. Sometimes terms. Rarely a cookie policy that matches the cookies actually loaded. Almost never a data processing agreement or an accessibility statement — the two pages that lose deals and invite complaints.

The footer is the least loved part of a website, and it's where liability quietly lives. This post covers the full set; the next four go deep on each page.

The complete set

Five documents cover most businesses:

  • Privacy policy. What you collect, why, and the legal basis. Required under GDPR whenever you handle personal data of EU residents — which is essentially everyone with analytics on their site.
  • Terms and conditions. The contract that limits your liability, protects your IP and sets payment and governing law. Missing terms mean default law decides disputes — and default law is rarely on the seller's side.
  • Cookie policy. What trackers you set, what they do, and how visitors consent. The ePrivacy Directive makes this a separate duty from the privacy policy, and regulators fine for mismatch between policy and reality.
  • Data processing agreement. Required by GDPR Article 28 whenever you process personal data on behalf of a customer. If you're a B2B supplier, your buyers are legally obliged to have one with you — which means no DPA, no contract.
  • Accessibility statement. Documents conformance with WCAG. Required in practice across the EU under the European Accessibility Act for many businesses, and expected by enterprise buyers regardless.

What happens without them

Two failure modes, both expensive. First, liability: a missing terms page leaves you with unlimited exposure on disputes, a stale cookie policy draws regulator attention, and an absent accessibility statement is itself the first thing a claimant's lawyer looks for. Second, lost deals: enterprise procurement checks legal pages before signing anything, and a missing DPA stalls a contract the same way a missing security report does. We covered the trust-center version of this in the cost-of-not-having post.

The lesson SaaS trust centers taught

Software companies learned a decade ago that publishing security and legal documents on one verifiable page turns a sales objection into a self-serve check. Buyers stop emailing for the DPA, the ISO certificate, the accessibility statement — they click, read, and move on. The same structure works for every business. A legal section hosted as living pages — dated, versioned, always current — under one trust address is the cheapest deal-acceleration a small company can buy. The SaaS playbook is documented here.

  • Every page as a living document — dated, versioned, and updated in place behind a permanent URL.
  • One Trust Hex address — the legal section lives alongside your compliance documents where buyers already look.
  • Current by design — when your cookie stack or policy changes, the page updates without anyone re-sending attachments.

The Footer Is Where Liability Lives. Fix It Once.

Publish the full legal set as living pages under one verifiable address. Start with a free draft: no card needed, publish the verifiable version when you are ready.

See the Trust Hex →

Frequently Asked Questions

Do small businesses really need all five pages?

The obligations follow your activities, not your size. If you have analytics, customers and a website, you need at least a privacy policy, terms and a cookie policy; if you process data for clients, add a DPA; if you sell into the EU, add the accessibility statement.

What's the most commonly missing one?

The DPA. Most B2B suppliers first learn it exists when a customer's procurement team refuses to sign without one.

Why publish them as living pages instead of PDFs?

Because policies change and PDFs don't. A dated, versioned page at a permanent URL means the version a buyer reads is the current one — and the version you update once is the version everyone sees.

Last updated: September 28, 2026

Global Digital Trust & Compliance

Sustalium is the digital-first platform for managing complex business certificates and sustainability declarations across global supply chains.

Environment & ESG
  • Digital Product Passport (DPP)
  • Carbon & Water Footprint
  • Circularity & Reuse (ISO 14021)
  • De-Forestation Free
Product & Food Safety
  • FSMA 204 (FDA Traceability)
  • REACH & RoHS Compliance
  • PFAS-Free & VOC Declarations
  • Prop 65 & TSCA Title VI
Social & Ethical
  • ISO 26000 Responsibility
  • Modern Slavery Statements
  • UFLPA Forced Labor Traceability
  • Ethical Labor Declarations
Governance & Trade
  • Swiss Made & Origin Claims
  • GDPR & AI Ethics (EU AI Act)
  • CE Marking & UKCA Conformity
  • Bill S-211 (Canada) Reporting
Start Free

Have questions about a specific standard?
Contact our compliance team at compliance@sustalium.com