Three legal problems hiding on your property website

Almost none of the legal risk sitting on a small property firm's website was put there deliberately. It arrived by standing still. The rules moved between 2018 and now, the site did not, and nobody was looking at the gap because the site still loads and the enquiry form still works.

Three problems turn up again and again. None is a reason to panic, and all three are best dealt with during a rebuild rather than bolted on afterwards.

The cookie banner that is not really a banner

The rule is narrower than it sounds, and stricter about what it does cover. If your site stores or reads anything on a visitor's device beyond what is strictly needed to deliver the page, you need consent first. Google Analytics needs consent. So does a Facebook or LinkedIn pixel, and so does an embedded map or video that sets its own cookies. Your login session does not.

Two things make a banner genuine. There has to be a real reject option that is as easy to use as accepting, so a big coloured Accept and a grey line of text saying "manage preferences" three clicks deep does not count. And the non-essential scripts must not run until the visitor has said yes. A banner that appears while Analytics has already fired is decoration.

On penalties, be clear-eyed rather than frightened. From February 2026 the fines available under PECR were brought in line with UK GDPR, up to £17.5 million or 4% of global turnover, raised from the old ceiling of £500,000. That is a statutory maximum built for the worst offenders on the planet. No six-person lettings agency in Leeds is getting a £17.5 million fine for a missing reject button. What it does tell you is which direction the enforcement is pointing. The ICO has been working through the biggest sites first: it wrote to 134 of the UK's top 200 websites about cookie compliance, then extended the campaign to the top 1,000 in January 2025.

How to tell if you have the problem. Open your site in a private browsing window. If no banner appears at all and you know there is Analytics on the site, stop there, you have found it. If a banner does appear, look for a Reject button on the first screen, at the same size and weight as Accept. If you have to hunt for it, that is the problem in its other form.

What fixing it involves. A consent tool, wired so the tracking scripts are held back and only released on consent. The wiring is the part that matters, and the part usually skipped. It is a small job on a site built with it in mind, and a fiddly one on a site that was not.

The privacy policy written for a different law

Most of these were written once, by somebody copying a template, and never touched again. The site has changed underneath it. A valuation calculator got added, then a newsletter signup, then a chat widget, then a map embed nobody thought of as data collection at all. The policy still describes a brochure site with a contact form.

A privacy notice has to be accurate about your site as it exists today. What you collect, why you collect it, the lawful basis you rely on, how long you keep it, who else sees it, and what a person can do if they want their data back or gone. If your enquiry form pipes straight into a CRM run by a third party, that third party belongs in the notice. A policy that claims the site sets no cookies while the site sets eleven is wrong in a way anyone can check in thirty seconds.

How to tell if you have the problem. Open the page and look for the date. Then search it for "Data Protection Act 1998" or "Directive 95/46/EC". Both were superseded in 2018, and both survive in policies still live today. Then read it against your own site: does it mention every form you actually have, and every place that data goes afterwards.

Plenty of firms already know their policy is wrong and cannot do anything about it, because the site is locked in software nobody can open. That is a separate problem with the same symptom, and it is worth reading why you cannot edit your own website if that sounds familiar.

What fixing it involves. Before any writing, an inventory: every form and embedded widget, every analytics or advertising tag, and where each one sends what it collects. The notice is then written to match, and put somewhere your own staff can amend it when the site changes. A website cannot make your firm compliant, and we would not claim otherwise. The duty stays with you. What a well-built site does is make the obligation visible and harder to forget.

The site that some of your applicants cannot use

There is no separate website law here. The Equality Act 2010 requires service providers to make reasonable adjustments for disabled people, and a website that locks someone out is a risk under it. Nobody issues you a certificate. The recognised standard to build against is WCAG 2.2 at level AA, which covers colour contrast, alt text on images, full operation by keyboard alone, and a focus state you can actually see as you move through the page.

Property sites fail this more than most, because they are heavy on the things that go wrong. Galleries of unit photos with no alt text. Floorplans and EPCs as scanned PDFs, which are pictures of documents and unreadable to a screen reader. Pale grey body text on white because it looked elegant in the mockup. Map embeds you cannot reach without a mouse.

How to tell if you have the problem. Put your mouse away. Load the home page, press Tab repeatedly, and try to reach the property list, open a listing, fill in the enquiry form and submit it. See if you can always tell where you are on the page. On the older sites we test, it usually breaks inside the first ten presses, and the enquiry form is where it collapses. The barrier sits on your revenue path.

What fixing it involves. Nearly all of it is decided at design and build. Contrast chosen properly rather than corrected later, form fields with real labels attached, focus states drawn in the design rather than switched off because they spoiled the look, and a habit of writing alt text as part of adding a property. Retrofitting the same things later costs more and never comes out as clean.

All three of these live in the plumbing of a site. That is also true of the material information duties that came in under the DMCC, which we covered in what you now have to publish on a listing. A redesign that only changes the fonts leaves every one of them exactly where it was.

The three checks above take an afternoon and cost nothing, so start there. If you would rather somebody went through the site properly and told you what the repairs come to, have us look at it.