When we take over a website built by someone else, the first thing we check is not the code. It is the footer. Over the past year we have gone through several dozen of them and almost every one was missing something: the court file number of a limited company, the Trade Register entry of a sole trader, a privacy notice that the contact form links to but which does not exist. And almost every one contained something that should not be there: a link to the EU online dispute resolution platform, which ceased to exist in July 2025, and an "I consent to processing" checkbox under the contact form, which GDPR does not require. This is the list we run through during that check, rewritten so you can run it yourself.
In short: every business in the Czech Republic must show its name, registered office, company ID (IČO) and register entry on its website (Section 435 of the Civil Code, fine up to CZK 100,000). A site with a contact form needs a privacy notice, not a consent checkbox. Non-essential cookies may be set only after demonstrable consent with an equally prominent Reject button. An online store additionally needs terms and conditions, information on the 14-day withdrawal right, a complaints procedure, prices including VAT, the lowest price in the last 30 days next to any discount, and a notice naming the Czech Trade Inspection Authority for out-of-court disputes. Online stores above the microenterprise threshold have fallen under the accessibility act since June 2025. Below I go through each point, the fines, and four things almost every site has that the law does not require.
One note up front: we are developers, not lawyers. This text is based on what the statutes say and on what clients and their lawyers ask us for when we hand over websites. For advice on your specific situation, ask a lawyer.
What every business website must have, including a sole trader's
The foundation is Section 435 of the Civil Code. It says every entrepreneur must state their identification details not only on invoices and contracts but also "in information made available to the public by remote access", meaning the website. It applies to everyone in business, including a sole trader with a one-page site. What exactly depends on the legal form:
| Detail | Sole trader (OSVČ) | s.r.o. / a.s. |
|---|---|---|
| Name / company name | First and last name, with any trading suffix | Exact registered name including legal form |
| Registered office | Registered business address | Address from the Commercial Register |
| Company ID (IČO) | Yes | Yes |
| Register entry | "Registered in the Trade Register" (naming the office is enough) | File number: court, section and insert |
| VAT number (DIČ) | Not required on the site by law; customary for VAT payers | Not required on the site by law; customary for VAT payers |
| Contact | Email and phone for service providers and stores | Email and phone for service providers and stores |
A joint-stock company (a.s.) must have a website under Section 7 of the Business Corporations Act and publish further information on it, such as general-meeting invitations. A limited company (s.r.o.) does not have to have a website, but if it does, the same details as on business documents apply. The most practical place is a footer on every page; a Contact page works too, provided it is linked from everywhere.
The fine for missing details is up to CZK 100,000 under the Act on Certain Offences. In practice the authorities usually ask for a correction first. Trust does more damage than the fine: a site with no company ID or address looks like a site nobody is accountable for, and customers, banks and search engines all read it that way.
Personal data: a privacy notice yes, a form consent no
As soon as your site has a contact form, an enquiry form or even just an email address people write to, you process personal data and under Article 13 GDPR you must inform them. The document is usually called a privacy notice and must contain:
- who the controller is (name, company ID, contact),
- what data you process and for what purpose (handling enquiries, invoicing, newsletter, analytics),
- the legal basis for each purpose (contract, legitimate interest, consent, legal obligation),
- how long you keep the data,
- who you share it with (hosting, email tool, accountant, Google),
- data-subject rights and how to exercise them, including the right to complain to the Office for Personal Data Protection (ÚOOÚ).
Conversely, you do not need an "I consent to the processing of my personal data" checkbox under the contact form. Replying to an enquiry is processing necessary for pre-contractual steps and consent is not the right legal basis for it; the ÚOOÚ has said so repeatedly. A sentence such as "By submitting the form you acknowledge our privacy notice" with a link is enough. A consent checkbox belongs only where you genuinely need consent, typically a newsletter sign-up.
Cookies: the rules since 2022 and the fines being issued
Since 1 January 2022, Section 89(3) of the Electronic Communications Act has imposed an opt-in regime: cookies that are not necessary for the site to work may be stored only after prior demonstrable consent. Technical cookies such as the cart or login are exempt. Analytics, remarketing, embedded videos or maps that set their own cookies all need consent.
For consent to be valid, the banner must meet several conditions most downloaded templates do not:
- the Reject button is as visible and as accessible as Accept, not hidden under "Settings",
- nothing actually loads before consent: a common error is Google Analytics firing before the click,
- consent can be withdrawn at any time, usually via a footer link,
- consent is logged so you can prove it in an inspection.
The fines are not theoretical. Since the start of 2023 the ÚOOÚ has issued fines for cookies without consent totalling over CZK 4.4 million, the largest single one being CZK 898,000. The GDPR ceiling is EUR 10 million or two percent of turnover, double for serious breaches, though the office has not gone anywhere near it for Czech websites. If your site has no analytics or ad scripts, you need no banner at all. If you do need one, choose a tool that actually blocks scripts until consent and supports Google Consent Mode; we built Consentio for exactly this, because the foreign tools billed in dollars and could not handle Czech invoicing.
Online stores: eight more things
Anyone selling to consumers online concludes distance contracts and has much broader information duties under Sections 1811, 1820 and following of the Civil Code and under the Consumer Protection Act. Inspections are carried out by the Czech Trade Inspection Authority (ČOI), and for online stores they happen regularly.
| Obligation | Where on the site | Source |
|---|---|---|
| Terms and conditions with details of the seller, goods, price, shipping, payment and delivery | Separate page, linked from the cart and footer | Sections 1811, 1820 Civil Code |
| Information on the 14-day right of withdrawal and a model form | Terms + separate page | Sections 1820, 1829 Civil Code |
| Complaints procedure and warranty | Complaints policy or part of the terms | Section 2165 ff. Civil Code, Consumer Protection Act |
| Final prices including VAT and all charges; unit price for goods sold by quantity | Product page, cart | Section 12 Consumer Protection Act |
| Lowest price in the last 30 days next to any discount | Every discounted item | Section 12a Consumer Protection Act |
| Whether and how you verify that reviews come from real customers | Next to reviews or in the terms | Consumer Protection Act (2023 amendment) |
| Information on out-of-court dispute resolution at the ČOI with a link to coi.gov.cz | Terms, footer | Section 14 Consumer Protection Act |
| Order button clearly stating it creates an obligation to pay | Last step of the cart | Section 1826a Civil Code |
And one thing to delete: the link to the EU online dispute resolution platform (ec.europa.eu/consumers/odr). The platform ceased operating on 20 July 2025 and the duty to inform ended with it. Most Czech stores still carry the link in their terms because a template put it there years ago. The duty to name the ČOI as the out-of-court dispute body, by contrast, remains.
Accessibility: who has been covered since June 2025
Act No. 424/2023 on accessibility requirements for certain products and services, the Czech transposition of the European Accessibility Act, has applied since 28 June 2025 and for the first time targets the private sector: online stores, banking and payment services, booking and ticketing systems, e-books. The standard is WCAG 2.1 level AA. Microenterprises providing services, meaning fewer than 10 employees and under EUR 2 million in turnover, are exempt; services launched before that date have a transition period until 28 June 2030. The maximum fine is CZK 10 million, though enforcement is so far mostly advisory. We covered who is in and who is out in detail in our piece on the European Accessibility Act one year on.
Newsletters and commercial communications
Newsletters are governed by Section 7 of Act No. 480/2004 on certain information society services. You may send commercial communications only to people who have consented, or to your own customers about similar goods or services if they did not object at purchase. Every email must be labelled as a commercial communication, identify the sender and contain a working unsubscribe option. A purchased contact database never meets this test. The ÚOOÚ supervises this area and spam is among the most frequently fined offences of all.
What the law does not require, even though almost everyone has it
- A consent checkbox on the contact form. See above; a redundant box that also reduces the number of enquiries sent.
- A cookie banner on a site without cookies. A static site with no analytics and no embedded third-party scripts needs no banner. A banner "just in case" only annoys visitors.
- A link to the ODR platform. It has not existed since 20 July 2025. Delete it.
- A copyright line in the footer. "© 2026 Company, all rights reserved" has no legal effect; copyright arises automatically. You may include it, but it is not a duty.
Checklist: 12 points before launch
- Company name or sole trader's name, registered office and company ID in the footer or on the Contact page.
- File number (s.r.o., a.s.) or Trade Register entry (sole trader).
- Email and phone if you provide services or sell.
- Privacy notice, linked from every form and from the footer.
- Forms without redundant consent; newsletter with consent.
- Cookie banner only where non-essential cookies exist; Reject on the first layer; scripts blocked until consent.
- Store: terms and conditions, withdrawal information with a form, complaints procedure.
- Store: prices including VAT, lowest 30-day price next to discounts, an "Order and pay" button or equivalent.
- Store: ČOI notice, ODR link removed.
- Store above the microenterprise threshold: accessibility to WCAG 2.1 AA, or a plan to get there by 2030.
- Newsletters labelled as commercial communications with an unsubscribe link.
- Licences for the photos and fonts you use; stock from Pexels or Unsplash is fine, images saved from Google are not.
Most of these points apply to a site you are building for the first time too, which is why they sit next to technical SEO in our pre-launch checklist. And if you are still deciding whether you need a store at all or whether a brochure site with an enquiry form and half the obligations would do, this breakdown will help.
How we handle it
Every site we hand over as part of web development goes through this list before launch: a footer with the details for the legal form, a privacy-notice template ready to complete, forms without redundant consents and a cookie banner only where it makes sense. Legal texts for a store, the terms and conditions and complaints policy, are written by a lawyer, not by us; we make sure they sit in the right places and that the cart does what the terms promise. For sites we take into project support, this check is part of the intake audit. If you want to know where your site stands, send us the link. We will go through the footer, forms and cookie banner and within two days send you what is missing and what is surplus.