Website legal requirements catch out more Auckland businesses than most designers admit. A site can look sharp and still breach the Privacy Act, the Fair Trading Act or the Human Rights Act, and none of those problems show up in a Google PageSpeed report. This guide covers the four laws that actually apply to a New Zealand business website in 2026, what changed in May with the new privacy notice rule, and the checklist we run through before we publish anything for a client.

Why website legal requirements matter more in 2026

Most website advice for Auckland businesses focuses on design, speed and search ranking. Legal compliance rarely gets a mention, yet it is the one area where a mistake costs more than a lost sale. A misleading pricing claim can bring a Fair Trading Act complaint. A contact form with no privacy notice can breach the Privacy Act 2020. Neither requires a lawsuit to hurt you: the Commerce Commission and the Privacy Commissioner can both act on a single complaint from a customer.

Two changes in 2026 raised the stakes. The Fair Trading Amendment Bill strengthened penalties for misleading conduct and introduced a takedown process for scam-style sites, and Information Privacy Principle 3A came into force on 1 May, adding a new notification duty that catches almost every website with a contact form, booking widget or newsletter signup.

Privacy Act 2020 and the new IPP3A notice requirement

If your website collects a name, email, phone number or any other personal detail, whether through a contact form, live chat, booking system or newsletter signup, you are handling personal information under the Privacy Act 2020. There is no small business exemption. A one-person trades business with a simple enquiry form has the same basic obligations as a large retailer.

IPP3A is the practical change to act on now. It requires you to notify people when you collect their personal information indirectly, for example through a third-party lead form, a referral partner or a marketing platform that passes contact details to you. For most Auckland businesses this means:

• A visible privacy policy linked from your footer, not buried on a page nobody finds.
• A short notice at the point of collection explaining what you collect and why, next to every form.
• A note on indirect collection if you buy leads, use referral partners, or import contacts from a third party.
• Secure storage for anything you collect, including a plan for what happens if your CRM or hosting is breached.

Fair Trading Act 1986: what your website copy can’t say

The Fair Trading Act governs everything you say about your business online, including your homepage claims, pricing pages, testimonials and delivery promises. It prohibits misleading or deceptive conduct, which covers more than outright lies. A “from $X” price that almost nobody actually pays, a “5-star rated” claim with no source, or a countdown timer that resets every visit can all fall foul of the Act.

Watch for these specific risks on an Auckland business website:

1. Pricing claims that omit conditions, such as “from” prices that exclude common add-ons.
2. Testimonials that are edited, fabricated or unverifiable.
3. Urgency tactics like fake stock counters or sale timers that do not reflect reality.
4. Comparison claims against competitors that cannot be substantiated.

The Fair Trading Amendment Bill introduced in 2026 also adds a safe harbour defence to help legitimate businesses get scam impersonation sites taken down faster, which is worth knowing if a competitor or scammer ever clones your site.

Cookie consent and tracking tools

Most Auckland business websites run Google Analytics, a Meta pixel, or both, without ever mentioning it to visitors. New Zealand follows an opt-out model rather than the strict opt-in consent used in the EU, but that does not mean tracking is unregulated. You still need to:

• Disclose in your privacy policy which tracking tools and cookies you use.
• Give visitors a clear, easy way to decline non-essential tracking.
• Avoid tracking that identifies individuals without disclosure, particularly remarketing pixels shared with ad platforms.

A simple cookie notice linked to your privacy policy covers most small and medium Auckland businesses. You do not need the heavy consent-management platforms built for EU compliance unless you are trading into Europe.

Website accessibility and the Human Rights Act 1993

New Zealand has no law forcing private businesses to meet WCAG accessibility standards, that requirement sits with government agencies under the NZ Government Web Accessibility Standard. But the Human Rights Act 1993 prohibits discrimination against people with disabilities, and an inaccessible website that blocks a customer from booking, buying or enquiring can expose a business to a complaint under that Act.

You do not need a full accessibility audit to close most of the gap. Focus on:

• Alt text on every meaningful image, written to describe what it shows.
• Colour contrast that meets WCAG AA, particularly for text over gradient or image backgrounds.
• Keyboard navigation so forms and menus work without a mouse.
• Labelled form fields that screen readers can announce correctly.

Consumer Guarantees Act: refund and warranty pages

If you sell goods or services online, the Consumer Guarantees Act 1993 gives customers non-excludable rights when something is faulty or misdescribed. A “no refunds” policy printed on your website does not override these rights, and stating it without qualification is itself a Fair Trading Act risk. Your returns or terms page should acknowledge CGA rights rather than attempt to exclude them.

A compliance checklist for Auckland business websites

1. Privacy policy linked in the footer and updated for IPP3A.
2. A short data-collection notice beside every form.
3. Pricing and testimonial claims you can substantiate on request.
4. A cookie notice covering analytics and ad pixels.
5. Alt text, contrast and keyboard access checked on key pages.
6. A returns or terms page that acknowledges CGA rights.
7. A record of who reviewed the site for compliance, and when.

Most of this is a half-day fix, not a rebuild. If you are already planning a bigger project, our guide to redesigning a website without losing SEO rankings is worth reading alongside this checklist, since a compliance pass fits naturally into a redesign scope. Getting these basics right also feeds directly into the trust signals that convert Auckland website visitors into enquiries, since a visible privacy policy and honest claims are themselves a trust signal.

Frequently asked questions

Do I legally need a privacy policy on my New Zealand website?

There is no single law stating every website must carry one, but if you collect personal information through any form, booking tool or newsletter signup, the Privacy Act 2020 effectively requires you to be transparent about it, and a privacy policy is the standard way to meet that duty.

Is website accessibility a legal requirement in New Zealand?

Only for government agencies under the Web Accessibility Standard. Private Auckland businesses are not mandated to meet WCAG, but an inaccessible site can still expose you to a Human Rights Act complaint if it blocks a disabled customer from using your services.

What happens if my website breaches the Fair Trading Act?

The Commerce Commission can investigate on a single complaint, and penalties for misleading conduct increased under the 2026 amendments. Most cases start with a warning or a request to fix the claim, but repeated or serious breaches can lead to fines.

Do I need a cookie consent banner on my website?

You need to disclose your use of cookies and tracking tools and give visitors a way to opt out of non-essential tracking. New Zealand’s opt-out model is less strict than the EU’s opt-in requirement, but silence is not compliance.