Consumer Rights Act 2015: What UK Websites Must Disclose

The Consumer Rights Act 2015 and its associated regulations contain disclosure requirements that Trading Standards enforces regularly and that directly affect what a UK e-commerce or service website must include. These rules are not glamorous compliance topics but they are routinely checked, and failure to meet them creates enforceable consumer rights as well as regulatory exposure.

For a technical scan of your site's compliance signals, including checkout flow and information disclosures, run a free scan at /uk/en/scan.

The legal framework: CRA 2015, CCRs 2013 and E-Commerce Regs 2002

Three pieces of legislation collectively determine what a UK website selling to consumers must disclose.

The Consumer Rights Act 2015 establishes consumers' rights in contracts for goods, services and digital content. It includes provisions on the information that must be part of the contract, the standards the goods and services must meet and the remedies available when they don't.

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (CCRs) implement the EU Consumer Rights Directive into UK law and set out the specific pre-contract information that must be provided for distance and off-premises contracts. These regulations survived Brexit and remain in force.

The E-Commerce Regulations 2002 implement the EU E-Commerce Directive and require website operators to disclose identifying information about the business. These also remain in force.

Together, these three instruments create a layered set of obligations. A business can comply with E-Commerce Regs but fail CCRs. Compliance with all three is required simultaneously.

Mandatory pre-contract information under the CCRs

Schedule 2 of the Consumer Contracts Regulations 2013 lists the information that must be given to the consumer before they are bound by a distance contract. For an e-commerce checkout, this information must be provided clearly and legibly before the consumer places the order.

The required information includes: the trader's identity and geographical address (a PO box does not satisfy this for complaints purposes), a phone number and email address, the total price of the goods or services including taxes and all fees, arrangements for payment, delivery and performance of the contract, the existence of the 14-day right to cancel, how to exercise that right, the model cancellation form or an equivalent clear statement, the trader's policy on returns and who bears the return cost, information about the goods or services sufficient for the consumer to understand what they are buying, and any relevant after-sales support or guarantee terms.

This information must be given in a durable medium, typically an order confirmation email, as well as being available on the site. The confirmation email is not optional. It must be sent after the order is placed and must contain the key information or a reference to where it can be found.

Pre-contract information for digital content

For digital content specifically, the CRA 2015 imposes additional pre-contract requirements. Section 36 requires that the consumer is told before the contract is made: the functionality of the digital content, any technical protection measures, any interoperability of the digital content with hardware and software that the trader knows about, and the minimum duration of the contract where it is for ongoing supply.

Digital content that does not match the description given before purchase gives the consumer rights under section 35 of the CRA: the right to repair or replacement, and if those fail, a price reduction.

The 14-day cancellation right: disclosure requirements

The 14-day cancellation right under the CCRs applies to most distance contracts. The right must be disclosed before the contract is concluded. If it is not disclosed, Regulation 31 extends the cancellation period to 12 months and 14 days.

The disclosure must include: confirmation that a cancellation right exists, the period it runs for, when it starts (typically from receipt of goods or conclusion of the service contract), how to exercise it (a clear statement or the model cancellation form in Annex I to the Regulations), and who bears the cost of returning goods.

The model cancellation form is published in the Consumer Contracts Regulations as Annex I. Businesses are not required to use the model form, but they must provide an equivalent clear statement. Many sites include both.

What the E-Commerce Regulations 2002 require

The E-Commerce Regulations 2002 require any website providing commercial services to display:

The name of the service provider. The geographic address at which it is established (not a registered office if that is different from the operational address). An email address. Where the service provider is registered in a trade or commercial register, the register name and registration number. Where the activity is subject to an authorisation scheme, the particulars of the relevant supervisory authority. Where the business is a member of a profession with a regulated title, the professional body and the professional title.

VAT-registered businesses must display their VAT registration number. This requirement often appears in the footer or on the legal information page but must be accessible from all pages.

Consequences of non-disclosure

Failure to provide the CCRs' mandatory pre-contract information has direct legal consequences for the contract, not just regulatory exposure.

Failure to disclose the cancellation right extends it to 12 months and 14 days under Regulation 31. The consumer can cancel and receive a full refund at any point during that extended period.

Failure to include certain information in the order confirmation means the consumer is not bound by the contract until that information is provided. For digital content, failing to provide the required pre-contract information can make the digital supply unlawful even after payment.

Trading Standards offices can take enforcement action for breaches of the CCRs and E-Commerce Regulations. Local councils instruct Trading Standards to investigate consumer complaints and can seek court orders requiring compliance with the regulations, civil fines and in some cases criminal prosecution for persistent breaches.

Practical placement: where to put required disclosures

Disclosures that exist only in a lengthy terms and conditions document linked from the footer do not satisfy the CCRs' requirement that information be provided clearly before the consumer places the order. The CCRs require the information to be given, not merely made available.

The standard approach for compliant e-commerce sites is:

The product or service page includes the total price inclusive of tax. If the price varies by delivery option or region, this is noted clearly. A prominent summary of the cancellation or return right appears either on the product page or in the checkout flow. The checkout summary page (the last page before the "place order" button) displays the full order total including delivery, any applicable taxes and any handling charges. It includes a clear statement of the cancellation right and a link to the returns policy. The order confirmation email repeats the key CCRs information and includes the model cancellation form or equivalent statement.

The "place order" button or equivalent should clearly indicate that placing the order creates a payment obligation. Buttons labelled "Continue", "Next" or "Submit" without an indication that payment follows can create disputes about whether the consumer understood they were committing to a purchase. The CCRs' requirement that the consumer explicitly acknowledges the payment obligation (Regulation 14(3)) means a button with wording such as "Order and pay" or "Place order with obligation to pay" is the standard compliant formulation.

Distance selling and the 14-day right: practical implications for returns handling

The 14-day cancellation right for distance contracts gives consumers the right to cancel without giving any reason during the cooling-off period. This affects how returns and refund processes must be designed.

The trader must refund the full amount paid, including the original delivery charge, within 14 days of receiving the returned goods or evidence that they have been dispatched. The refund must be made using the same payment method as the original purchase unless the consumer expressly agrees otherwise. Deducting the original delivery charge is only permitted where the consumer chose a premium delivery option rather than the cheapest available standard option.

The consumer bears the cost of return unless the trader has agreed to pay it or failed to inform the consumer that they would bear it. If the trader fails to disclose the returns-cost obligation before the contract, the trader must bear the cost of return under Regulation 35(7) of the CCRs.

Goods that are personalised to the consumer's specification, perishable goods, sealed hygiene products opened after delivery, and audio or video recordings or software unsealed after delivery are exempt from the 14-day right. For digital content, the right can be waived where the consumer expressly consents to performance beginning during the cancellation period and acknowledges that the right will be lost.

For how DMCCA 2024 adds additional obligations on dark patterns and drip pricing on top of these base disclosures, see DMCCA 2024: CMA enforcement of dark patterns. For the data-protection obligations that sit alongside these consumer disclosures, see UK GDPR fines under the ICO.

---

This is technical analysis, not legal advice. Consult a solicitor for specific guidance on Consumer Rights Act and CCRs compliance for your business.