Four layers, not one
Practices tend to think of website compliance as one thing their regulator does to them. It is four things, from four directions, and separating them makes the work manageable.
- Regulatory disclosure. What your professional body requires you to display.
- Advertising rules. What your body and general consumer law allow you to claim.
- Privacy and data. What happens to the information the site collects.
- Accessibility. Whether the site can be used by everyone.
This is orientation, not legal advice. Your regulator's current guidance and your own compliance lead are the authority on anything specific.
Layer one: disclosure
Who authorises you, under what number, for what activities, plus the entity details, the insurance position where you must state it, and the complaints route with the external body a client can escalate to. Solicitors, advisers, brokers, accountants, immigration advisers and notaries each have their own version, and the details differ by country as well as by profession.
Two rules cover most of it. Put the short form in the footer of every page and the full form on a Regulatory information page in the navigation. Link every registration number to your entry on the public register, so a client can verify it in one tap.
The failure mode is not omission, it is decay. Numbers, partners, insurers and addresses change. Hold them as dated fields with a review date and a named owner rather than as text typed into a template.
Layer two: what you may say
Every regime we work under forbids the same core things: statements that are false or misleading, including by omission; claims you cannot substantiate; promises about outcomes; misuse of protected titles; and offers or inducements presented without their terms. Beyond that core, the detail varies a great deal. Solicitors, financial advisers, accountants, brokers and immigration advisers each sit under bodies with their own rules on comparative claims, on the words that may be used to describe expertise, and on how charges must be presented. In the United States, state bar advertising rules and the marketing rules that apply to investment advisers and broker dealers add their own requirements around records, disclosure and endorsements.
The practical position for a website is the same everywhere. Describe accurately what you do, who does it, how you charge and what happens next. Do not promise a result, a timescale you cannot control, or a saving you cannot evidence. Do not call anyone a specialist unless the title is one your regime recognises. Do not publish a client comment without checking what your body permits, and where testimonials or endorsements are permitted, keep them genuine, sourced and free of outcome claims.
Write the marketing copy on the assumption that the regulator reads the whole site as one document, home page included.
Layer three: privacy and data
A practice site collects enquiries, booking intake and sometimes documents. That means:
- A privacy notice that describes what the site actually does, linked from every form and the footer.
- Minimal fields on general forms. Name, contact, what it concerns, and a sentence.
- Sensitive material, financial documents, identity documents and case papers, taken through a secure portal or the practice system, never as an email attachment from a web form.
- Written arrangements with the processors you use, including the booking tool, the form handler, the CRM and the analytics provider.
- Cookie consent where your jurisdiction requires it, with tracking held back until consent is given.
- Retention: how long enquiries live in the inbox and the CRM, and who deletes them.
- HTTPS everywhere, and a plan for what happens if there is a breach.
Client confidentiality obligations sit on top of data protection law and are usually stricter. Design the forms so that a client cannot easily put privileged detail into them, because some will try.
Layer four: accessibility
Build to WCAG 2.1 AA. Contrast, keyboard operation, labelled form fields, alternative text, headings in order, and no information carried by colour alone. Several jurisdictions apply general equality or disability legislation to websites, and the European Accessibility Act has brought many private digital services into scope. Beyond the legal position, an inaccessible booking form is a client who cannot instruct you.
The process that makes it routine
Structure carries most of the burden. Registrations, titles and fees as fields with review dates. A testimonial setting that reflects what your regime allows. Forms that cannot accept sensitive categories. A single privacy notice rendered from one source.
The rest is a short checklist before anything publishes: is every statement true, is there any promise of an outcome, are titles and registrations right, is this kind of client comment permitted here, does any offer carry its terms, is any image consented, and would a client with no background understand it. Two minutes a page, one named owner, and an annual walk through the register links and the insurer details.
What we usually find
The common finding on an existing site is not a breach. It is a practice so worried about the rules that it stopped saying what it does, which helps nobody, converts nobody and ranks for nothing. The rules leave you a great deal of room to be clear, specific and human.
Where this sits
A compliance read is part of how every professional services website is built and part of a review of an existing one, and it is handled per profession on pages like financial advisers and law firms, because a broker's disclosure and a solicitor's are different documents.