What regulates a hospitality website
Hospitality businesses take money from consumers in advance, advertise prices, make claims about places, serve food that can harm people, and hold guest data. Each of those is regulated, and the detail changes by country. This is orientation for a website project, not legal advice.
Five areas come up on every build: how prices must be displayed, what cancellation rights apply to an online booking, what food information must be published, how guest data is handled, and accessibility.
United Kingdom
Prices: the Consumer Protection from Unfair Trading Regulations and the DMCC Act 2024 require the total price including unavoidable fees to be shown up front; drip pricing has been a specific enforcement target. VAT included in consumer prices.
Cancellation: the Consumer Contracts Regulations exclude accommodation, transport and leisure services booked for a specific date from the fourteen-day right, so your own policy governs, but it must be stated clearly before booking and must not be unfair under the Consumer Rights Act.
Food: allergen information for the fourteen regulated allergens must be available; Natasha's Law governs labelling of pre-packed for direct sale food; publishing allergens on the menu page is good practice.
Privacy: UK GDPR and a privacy notice; ICO registration; a data processing agreement with your booking provider.
Cookies: PECR consent for anything beyond strictly necessary.
Accessibility: the Equality Act, with WCAG 2.1 AA as the working standard; accessibility information about the premises themselves is expected on the site.
Other: food hygiene rating display rules apply in Wales and Northern Ireland; alcohol and gambling advertising rules where relevant.
United States
Prices: the FTC rule on unfair and deceptive fees, effective 2025, targets hotel, lodging and ticket pricing and requires the total price to be displayed clearly; several states including California and New York have their own junk fee and hotel fee laws.
Cancellation: state law and your own stated policy; no federal cooling-off right for dated hospitality bookings. Automatic renewal laws apply to memberships such as coworking plans.
Food: FDA menu labelling for chains above the covered threshold; state and local allergen and food code rules.
Privacy: state privacy laws for businesses over thresholds, with opt-out rights; TCPA consent for marketing texts, which matters for booking reminders.
Accessibility: the ADA, enforced heavily through litigation; hotels have a specific reservation rule requiring accessible room details and the ability to book them the same way as other rooms. WCAG 2.1 AA.
Canada
Prices: the Competition Act's drip pricing provisions make partial price display a deceptive practice; Quebec's Consumer Protection Act is stricter and requires all-in prices; French language obligations apply to Quebec sites under the Charter of the French Language.
Cancellation: provincial consumer protection acts; your stated policy governs dated bookings.
Food: provincial food premises regulations; allergen practice follows CFIA guidance.
Privacy: PIPEDA, provincial equivalents, and Quebec's Law 25 with its consent and policy requirements.
Cookies: Quebec requires consent for tracking technologies; CASL governs commercial email, including booking marketing.
Accessibility: the AODA in Ontario and the Accessible Canada Act federally.
Australia
Prices: the Australian Consumer Law requires a single total price including GST to be at least as prominent as any component price; the ACCC has pursued drip pricing in travel and accommodation.
Cancellation: consumer guarantees apply; unfair contract terms provisions cover standard-form booking terms, and non-refundable clauses can be challenged if unreasonable.
Food: Food Standards Code allergen requirements; state menu labelling rules for larger chains.
Privacy: the Privacy Act for businesses over the turnover threshold; the Spam Act for marketing messages.
Accessibility: the Disability Discrimination Act; WCAG 2.1 AA is the accepted benchmark.
European Union
Prices: the Price Indication Directive and the Unfair Commercial Practices Directive require the total price including taxes and unavoidable charges; the Consumer Rights Directive adds information duties before an online booking.
Cancellation: the fourteen-day withdrawal right does not apply to accommodation, transport, car hire, catering or leisure services for a specific date; your policy governs and must be presented clearly. The Package Travel Directive applies if you combine two or more travel services, which catches some tour operators and hotels selling packages.
Food: Regulation 1169/2011 requires allergen information for the fourteen allergens.
Privacy: GDPR, a privacy notice, and processing agreements with your engine and channel manager.
Cookies: ePrivacy consent as implemented nationally.
Accessibility: the European Accessibility Act applies from June 2025 to many consumer-facing digital services, including e-commerce and some travel services.
What is the same everywhere
- Total prices including tax and unavoidable fees, shown before the guest reaches checkout.
- Cancellation, deposit and refund terms stated plainly before booking and repeated in the confirmation.
- Allergen information published where food is served.
- Accessibility information about the premises, and a site that meets WCAG 2.1 AA.
- A privacy notice that matches what the site, the booking engine and the channel manager actually do.
- Cookie consent handled properly, including the analytics you use to measure bookings.
- Marketing consent captured at the point of booking rather than assumed.
Where this sits
Every hospitality business website we build runs through a country checklist at the content stage covering price display, terms, allergens, privacy, cookies and accessibility, with the booking engine configured to match what the pages say. Most of it lives on the prices page and the policies page, which is another reason to write both properly.