Topics: Website design & costs
Want this done for your business? Get a fixed quote or book a free 30-minute call.
Quick answer: An Australian business website must show total prices including GST and mandatory fees, avoid misleading claims, leave consumer guarantees intact on refund pages, get consent before sending marketing emails or texts, and identify who runs the business. A privacy policy is legally required for businesses covered by the Privacy Act and good practice for everyone else.
Lawyers have written plenty about each of these laws in isolation. This checklist approaches them from the build side: which pages and features on a typical small business site each law touches, and what to get right before launch. It isn't legal advice, and your final pages should still be reviewed by a lawyer who knows your industry.
Which laws apply to an Australian business website?
Five sets of rules touch almost every small business site, and a sixth applies if you're in a licensed trade.
| Law | Regulator | Where it shows up on your site |
|---|---|---|
| Privacy Act 1988 and the Australian Privacy Principles | OAIC | Privacy policy, enquiry forms, analytics and ad tracking, data security |
| Australian Consumer Law | ACCC and state fair trading agencies | Prices, claims, reviews, refunds and returns, terms |
| Spam Act 2003 | ACMA | Newsletter sign-ups, SMS marketing, consent tick boxes |
| Disability Discrimination Act 1992 | AHRC | Accessibility of pages, forms and documents |
| Corporations Act and business names rules | ASIC | Business name, ACN or ABN |
| State licensing schemes | State regulators | Licence numbers for regulated trades |
Accessibility has its own detailed guide: see our website accessibility checklist for Australia. Keep an eye on consumer law too. Parliament passed unfair trading practices legislation in 2026 aimed at drip pricing, subscription traps and manipulative online design, with the new rules reported to start on 1 July 2027. If your checkout adds fees late or your subscriptions are hard to cancel, review them against the ACCC's guidance as it's published.
Do you need a privacy policy if you're a small business?
If the Privacy Act covers you, yes. If it doesn't, you almost certainly still want one.
Per the OAIC, the Act applies to businesses with annual turnover above A$3 million, and to some smaller ones regardless of turnover, including health service providers and businesses that trade in personal information. Those businesses need a clearly expressed, up-to-date privacy policy that meets Australian Privacy Principle 1. Our guide to privacy obligations under Australian law explains the principles in more detail.
For everyone else, two practical reasons make a policy worthwhile. Your site almost certainly collects personal information through forms, analytics and ad platforms, and those platforms' own terms generally require you to tell visitors about tracking. If you use the Meta pixel or Google Ads tags, it helps to understand how tracking pixels collect data before writing about them.
A useful privacy policy explains:
- What personal information you collect, through which forms and tools
- Why you collect it and how you use it
- Who you share it with, including overseas service providers
- How people can access or correct their information
- How to make a privacy complaint and how you'll respond
Treat the policy as a living page. When you add a booking tool, live chat, a new ad pixel or an AI assistant, update it in the same week.
How must prices and GST be shown on your website?
Show consumers a single, total price that includes GST and any compulsory fees, and make it at least as prominent as any part-price. That's the ACCC's long-standing position under the Australian Consumer Law's component pricing rules.
On a typical site, that means:
- Prices for consumers are GST-inclusive. If you sell to businesses and quote ex-GST, say so clearly beside every price.
- Mandatory booking, service or card-handling fees are built into the headline figure or shown upfront, not added at the last step.
- Delivery costs are stated where they're known, or the page says plainly that delivery is extra.
- "From" prices are genuinely available, and "was/now" comparisons reflect real former prices.
- Claims such as "Australian made", "best in Brisbane" or "guaranteed results" can be backed up.
Reviews and testimonials sit under the same rules. Don't publish fake reviews, don't present paid or incentivised reviews as independent, and don't quietly delete the negative ones so the rest look better. Registered health practitioners face stricter advertising rules from AHPRA, including limits on testimonials about clinical care.
What do consumer guarantees mean for refund and returns pages?
Consumer guarantees apply automatically, and your refund page can't take them away. Under the Australian Consumer Law, products must be of acceptable quality and match their description, and services must be delivered with due care and skill. When something fails, customers are entitled to a repair, replacement or refund depending on whether the failure is major or minor.
Write your returns page in two parts:
- Faulty goods and services. Explain how to report a problem and what happens next, in a way that's consistent with the guarantees. Signs such as "no refunds" are misleading and shouldn't appear anywhere.
- Change of mind. This is optional. If you offer it, state the conditions, such as time limits and unused items, and honour them.
Your terms of use and terms of sale need care too. Since November 2023, unfair terms in standard form contracts with consumers and small businesses can attract significant penalties, so one-sided clauses copied from elsewhere are a real liability.
What do Spam Act rules mean for forms and newsletters?
Per ACMA, commercial emails and texts must meet three conditions: you have consent, you identify who sent the message, and every message includes a working unsubscribe option. Unsubscribe requests must be honoured within five working days.
For your website forms, that translates to:
- A separate, unticked opt-in box for marketing, distinct from consent to answer an enquiry
- A record of when and where each person opted in
- No adding enquiry or customer contacts to your newsletter without consent
- The same rules for SMS campaigns sent from your CRM or booking system
Which business details should appear on the site?
Make it obvious who runs the business and how to reach you. Per ASIC, companies must show their name and ACN, or an ABN that contains the ACN, on public documents, and tax invoices need your ABN under ATO rules. Whether a website counts as a public document is debated, so the simple answer is to put the details in your footer anyway.
Include:
- Legal entity name and any registered business name
- ABN, and ACN for companies
- A phone number and email address, plus a physical address if customers visit
- Licence numbers for regulated trades such as building, electrical, plumbing, real estate and migration advice; several state schemes require them in advertising, so check your regulator's rules
Who should check your legal pages before launch?
A lawyer should review your terms and privacy policy, your accountant should confirm GST treatment, and your developer should make sure the site does what the policies say. Templates copied from another business's site are risky. They may refer to another company, cite overseas laws, promise processes you don't follow or simply infringe copyright.
Pre-launch checklist:
- Privacy policy matching your actual forms, tools and tracking
- Terms of use, plus terms of sale if you sell online
- Refunds and returns page consistent with consumer guarantees
- Shipping and delivery page for e-commerce
- Tracking disclosure, in the privacy policy or a separate notice
- Business name, ABN or ACN and contact details in the footer
- Marketing consent boxes on every sign-up form
- Licence numbers where your trade requires them
Budget for legal review alongside the build; our breakdown of website costs in Australia covers what a professional site should include.
Frequently asked questions
Does every Australian business website need a privacy policy?
Not every one is legally required to have one, but most should. Businesses covered by the Privacy Act must have one, including all health service providers. Everyone else still collects personal information through forms and tracking, and a clear policy builds trust with visitors.
Do website prices have to include GST?
Prices shown to consumers should be the total price including GST and any compulsory fees. Business-to-business sites can quote ex-GST, but should say so clearly next to each price to avoid misleading anyone.
Do Australian websites need a cookie banner?
Australia has no specific cookie-consent law like the European Union's. You should still disclose tracking in your privacy policy, and a consent banner becomes worth considering if you actively market to customers in the EU or UK. Watch for further privacy reforms that may change this.
Can I copy another business's terms and conditions?
You shouldn't. Copied terms may infringe copyright, refer to processes or laws that don't apply to you, and include clauses that could be unfair contract terms. Have terms drafted or reviewed for your own business.
Do I need to show my ABN on my website?
There's no simple rule covering every website, but companies must display their name and ACN or ABN on public documents, and invoices need an ABN. Showing your ABN in the footer is easy, builds trust and avoids any doubt.
Launch with the right pages in place
We build Australian business websites with consent-ready forms, clear pricing layouts and space for every policy page your lawyer prepares. Learn how GRWW in Australia works with local businesses, or request a fixed-price quote for your next build.