Website Legal Requirements in NZ: A Plain-English Guide

The main website legal requirements in NZ come from a handful of laws: the Privacy Act 2020 (be open about the personal information you collect and keep it secure), the Fair Trading Act 1986 (no misleading claims, prices or reviews), the Consumer Guarantees Act 1993 (if you sell to consumers), the Unsolicited Electronic Messages Act 2007 (email and text marketing) and the Copyright Act 1994 (images and content). Government agencies also have to meet the NZ Government Web Standards. For most small businesses, that means a privacy policy, honest claims, clear GST-inclusive pricing, fair terms if you sell online, consent-based email marketing and properly licensed images.

Quick checklist: is your website legally sound?

• A privacy policy that matches what your forms, analytics and tools actually collect.
• A link to the privacy policy near every form.
• Website, forms and admin logins kept secure and up to date.
• Claims about price, quality, results and qualifications you can back up.
• Only genuine reviews and testimonials, presented fairly.
• Consumer prices displayed GST-inclusive, with no hidden extras.
• Clear terms on delivery, returns and refunds if you sell online, consistent with the CGA.
• Email and SMS marketing sent only with consent, with a working unsubscribe.
• Every image, font and piece of content properly licensed or owned.

Privacy Act 2020 and your website privacy policy

The Privacy Act 2020 applies to almost every business that handles personal information, which includes any website with a contact form, booking tool, newsletter sign-up, online store or analytics that can identify people. It is administered by the Office of the Privacy Commissioner.

The Act is built around 13 Information Privacy Principles, or IPPs. The ones that matter most for a typical website are:

• Only collect what you need (IPP 1): if you do not need someone's date of birth to quote a job, do not ask for it.
• Tell people what you are doing (IPP 3): when you collect information, take reasonable steps to make sure people know what is being collected, why, who will receive it and how they can access or correct it.
• Keep it secure (IPP 5): protect personal information against loss and misuse. For a website that means updates, strong passwords, SSL and secure hosting.
• Let people access and correct it (IPPs 6 and 7): people can ask what information you hold about them and ask for it to be corrected.
• Use and disclose it only for the stated purpose (IPPs 10 and 11): a quote enquiry is not permission to add someone to a newsletter.
• Take care sending it overseas (IPP 12): there are rules on disclosing personal information to organisations outside New Zealand.

Amendments passed in 2025 add a further principle, IPP 3A, which deals with telling people when you collect information about them from someone else rather than from them directly. Check the Privacy Commissioner's website for the current requirements and timing.

What to put in a website privacy policy

A privacy policy is the practical way to meet the openness principle. Keep it in plain English and make it accurate. It should cover:

• Who you are and how to contact you, including your privacy officer. Every organisation must have one, and in a small business it is usually the owner.
• What information you collect through forms, bookings, purchases, cookies and analytics.
• Why you collect it and how you use it.
• Who you share it with, such as your email platform, CRM, payment provider, booking system or an AI assistant that handles enquiries.
• Whether any of it is stored or processed overseas.
• How long you keep it and how you keep it secure.
• How people can access or correct their information, and how to complain.

Copying another company's policy is a common mistake. If it describes tools you do not use or misses ones you do, it is inaccurate, which defeats the purpose. You can see a working example on our own privacy policy.

Notifiable privacy breaches

If a privacy breach has caused, or is likely to cause, serious harm to someone, the Act requires you to notify the Privacy Commissioner and the affected people as soon as practicable. For a website, that could be a hacked form database, an exposed customer list or a compromised admin account. Failing to notify a notifiable breach is an offence. Keeping your site patched, backed up and monitored is the best prevention, which is a core part of our website maintenance and hosting.

Fair Trading Act 1986: claims, prices and reviews

The Fair Trading Act, enforced by the Commerce Commission, prohibits misleading and deceptive conduct in trade. Your website is part of your trading, so everything on it needs to be accurate.

Misleading and unsubstantiated claims

Claims such as "Auckland's best-rated", "lowest prices guaranteed", "eco-friendly", "certified" or "made in New Zealand" must be true and you must have reasonable grounds for making them at the time you make them. Unsubstantiated representations are a breach in their own right, even if the claim later turns out to be true. Be specific and keep evidence.

Fake and selective reviews

Writing your own reviews, paying for fake ones, posting reviews from staff or family as if they were customers, or presenting a hand-picked set of reviews in a way that gives a false overall impression can all mislead consumers. The Commerce Commission has published guidance on online reviews. Show genuine reviews, and if you offer an incentive for leaving one, do not make it conditional on the review being positive.

Pricing and GST

Prices advertised to consumers should be the price people actually pay, which means GST-inclusive. Showing GST-exclusive prices to the public, or adding unavoidable fees late in the checkout, risks misleading customers. If you sell to businesses, prices plus GST are fine, as long as "+GST" sits clearly beside the figure. That is why the prices on this site, which is aimed at businesses, are shown +GST.

Unfair contract terms

Standard form terms and conditions on your website cannot contain unfair terms, such as one-sided cancellation rights or penalties that go beyond protecting a legitimate interest. These rules apply to consumer contracts and, since 2022, to many small trade contracts too.

Consumer Guarantees Act 1993: selling online

If you sell goods or services to consumers, including through an online store, the Consumer Guarantees Act gives customers automatic guarantees. Goods must be of acceptable quality, fit for purpose, match their description and be delivered within a reasonable time. Services must be carried out with reasonable care and skill and within a reasonable time.

What that means for your website:

• Do not claim "no refunds". Customers have rights under the CGA whatever your policy says. You can choose not to offer refunds for change of mind, but you cannot override the guarantees.
• Describe products accurately. Photos, specifications and descriptions form part of what the customer is buying.
• Be clear about delivery. State delivery times, costs and areas, and be realistic about rural delivery.
• Contracting out is limited. Businesses can only contract out of the CGA when both parties are in trade, the agreement is in writing and it is fair and reasonable.

If you sell through online marketplaces as a business, you may also need to make it clear that you are in trade rather than a private seller. Building these policies in from the start is part of every e-commerce website we design.

Unsolicited Electronic Messages Act 2007: email and text marketing

The UEM Act, often called the spam law, covers commercial emails, texts and instant messages. It is enforced by the Department of Internal Affairs. The essentials are:

• Consent: only send commercial messages to people who have agreed, either expressly (they ticked a box or signed up) or where consent can reasonably be inferred from an existing relationship.
• Identify yourself: every message must clearly show who sent it and how to contact you.
• Unsubscribe: every message needs a working unsubscribe option, and requests must be honoured within five working days.
• No address harvesting: do not use software or bought lists that scrape email addresses.

For website forms, the simplest approach is a separate, unticked opt-in box for marketing. Someone asking for a quote has not agreed to your newsletter. Automated follow-ups about a quote they requested are generally fine; promotional campaigns to everyone who ever enquired need proper consent.

Accessibility: what applies to NZ websites

Government agencies covered by the NZ Government Web Standards must meet the Web Accessibility Standard, which is based on WCAG 2.1 AA. Private businesses are not covered by those standards, and there is no specific website accessibility law for the private sector.

That said, building to the current international guidelines, WCAG 2.2 AA, is good practice. It means readable text and contrast, descriptive link text, alt text on images, forms with proper labels, and sites that work with a keyboard and screen reader. Many of those choices also help SEO and mobile usability, which makes accessibility one of the easier wins in any build.

Cookies, analytics and tracking

New Zealand does not have a cookie-specific law like the European Union's. But analytics, advertising pixels, chat widgets and session recording tools can collect personal information, so the Privacy Act's openness and purpose principles still apply.

In practice, list the tracking tools you use in your privacy policy, explain what they do, and avoid collecting more than you need. If you actively target customers in the EU or UK, their rules may apply to you and a consent banner may be needed. Turning off features you do not use, such as session recordings that capture form inputs, is a good habit either way.

Copyright: images, fonts and content

Under the Copyright Act 1994, almost everything you find online is owned by someone. The common website traps are:

• Images from Google search: not free to use. Use your own photos, licensed stock, or images with a licence that clearly allows commercial use.
• Commissioned photos: in New Zealand the photographer generally owns copyright unless your agreement says otherwise, so agree on ownership or a licence before the shoot.
• Copied text: lifting competitors' copy is both a copyright risk and an SEO problem.
• Fonts and plugins: check licences cover commercial web use.
• Your website itself: make sure your web design agreement gives you ownership of the design, content and code. With us, you own all of it outright.

You can read the full text of each Act mentioned here on legislation.govt.nz.

Putting it into practice

None of this needs to be daunting. For most small businesses, being legally sound online comes down to a few accurate pages and a few good habits: an honest privacy policy, clear prices and terms, genuine reviews, consent-based marketing, licensed images and a site that is kept secure. Our guide to the pages a small business website needs shows where each of these fits.

When our Auckland web design team builds a site, we set up privacy policy and terms pages, GST-inclusive pricing for consumer stores, marketing opt-ins and accessible forms as standard, though we always recommend having a lawyer review your final policies. If you want a site built with these basics covered, talk to us about a free website plan.