Most business websites are built by designers and developers, not lawyers — so the legal pages get copied from a competitor or skipped entirely. That is a real risk in California, where several statutes attach specific obligations to what your site says and collects. Here are the pages your website actually needs, what belongs in each, and which laws are doing the enforcing.
1. Privacy policy — required by law, not optional
If your website collects personally identifiable information from California residents — names, email addresses, payment details, even analytics identifiers — the California Online Privacy Protection Act (CalOPPA, Bus. & Prof. Code § 22575) requires you to conspicuously post a privacy policy. The policy must identify the categories of information collected and the categories of third parties with whom it is shared, describe any process for users to review or request changes to their information, explain how material policy changes are communicated, and provide the policy's effective date. It must also disclose how you respond to "Do Not Track" or similar choice signals and whether other parties may collect information about users' online activities over time and across different websites.
Larger businesses face a second layer: the California Consumer Privacy Act (CCPA, as amended by the CPRA). The CCPA applies to for-profit businesses that do business in California and meet any one of these thresholds:
- Annual gross revenue above $26.625 million, the inflation-adjusted threshold effective January 1, 2025;
- Buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year; or
- Deriving 50% or more of annual revenue from selling or sharing consumers' personal information.
Covered businesses must disclose consumer rights (access, deletion, correction, opt-out of sale or sharing), generally provide at least two methods for submitting requests, and honor them on statutory deadlines. Even if your company is under the thresholds today, growth or an acquisition can put you over them — and buyers in an M&A deal will check.
2. Terms of service — your contract with every visitor
Terms of service (or terms of use) are not mandated by statute, but they are the contract that governs your relationship with users and customers. Well-drafted terms should cover:
- Permitted and prohibited uses of the site and your content
- Intellectual property ownership and license grants
- Disclaimers of warranties and limitations of liability
- Dispute resolution — governing law, venue, and any arbitration provision
- How the terms may be updated and how users accept them
Enforceability turns on assent. California courts routinely refuse to enforce "browsewrap" terms buried in a footer link; a "clickwrap" checkbox at account creation or checkout is far more likely to hold up. If your terms include an arbitration clause or a class action waiver, presentation matters even more.
3. E-commerce disclosures: refunds and auto-renewals
Selling online adds two California-specific requirements. First, retail sellers with a return policy that does not offer a full cash or credit refund, an equal exchange, or a combination of those remedies for at least seven days must conspicuously display that policy. Under Civil Code § 1723, failure to make the required disclosure can entitle a buyer to return covered goods for a full cash refund within 30 days, subject to statutory exceptions; online sellers should state their policy clearly to avoid disputes and chargebacks. Second, California's Automatic Renewal Law (Bus. & Prof. Code § 17600 et seq.) is one of the strictest in the country: subscription businesses must, among other things, present renewal terms clearly and conspicuously before checkout, obtain affirmative consent, send an acknowledgment and required reminders, provide notice of material changes, and offer an easy cancellation method, including online cancellation for subscriptions accepted online. Plaintiffs' firms actively test subscription flows for violations.
4. Accessibility statement — and an accessible site behind it
Website accessibility lawsuits under the Americans with Disabilities Act and California's Unruh Civil Rights Act (Civ. Code § 51) have targeted thousands of businesses, and the Unruh Act's statutory damages of $4,000 per violation make California a favorite venue. An accessibility statement alone does not immunize you, but pairing one with genuine conformance efforts (WCAG 2.1 AA is the common benchmark) reduces risk and shows good faith.
5. Industry-specific and situational disclosures
Depending on what you do, additional pages or notices may be required: Proposition 65 warnings for certain products, licensing disclosures for regulated professions, testimonial and endorsement disclosures under FTC rules, affiliate link disclosures, and COPPA-compliant practices if your site is directed at children under 13. If your site serves users in the EU or UK, GDPR obligations layer on top.
Why copying a competitor's pages backfires
Borrowed legal pages describe someone else's data practices, someone else's refund policy, and someone else's dispute terms. When your actual practices do not match your posted policies, the mismatch itself can become an unfair or deceptive practice claim under Bus. & Prof. Code § 17200. The right approach is a short audit: what you collect, what you sell, who your users are, and which statutes apply — then pages drafted to match. That is a routine project for a regulatory compliance attorney, and the terms themselves are a species of business contract worth getting right the first time.
Talk to a California business attorney
A website legal audit is quick, inexpensive, and far less costly than a demand letter about your subscription flow or privacy policy. Schedule a free consultation or call (949) 418-2113.
This article is attorney advertising and provides general information only. It is not legal advice and does not create an attorney–client relationship. Facts matter; consult a lawyer about your specific situation.
