Website legal checklist for Estonian businesses: GDPR, cookies and accessibility
A plain-language checklist of the legal basics for websites and online shops run by companies in Estonia, from your registry code to cookie banners and accessibility.
By Maruf H., Founder & CEO at Next Innovation Hub · · 3 min read
Most small business websites in Estonia are built to look good, and legal requirements come up only when a customer complains or a partner asks. This checklist covers the basics every company website in Estonia should get right. It is written by developers, not lawyers, so treat it as a starting point and check specific questions with a legal advisor.
1. Business information
Under Estonian and EU e-commerce rules, a business website should clearly show who is behind it. At minimum:
- Your company's legal name
- Your registry code from the Estonian Business Register
- Your address
- An email address and ideally a phone number
- Your VAT number if you are VAT-registered
The usual place is the footer plus a contact page. It costs nothing and builds trust.
2. Privacy notice (GDPR)
If your website collects any personal data, and contact forms, newsletter signups, analytics and online orders all do, you need a privacy notice that explains:
- What data you collect and why
- The legal basis for each purpose
- Who you share it with, such as hosting, email and analytics providers
- How long you keep it
- How people can access, correct or delete their data
- How to contact you, and their right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Keep forms lean. Every field you do not collect is a field you do not need to protect.
3. Cookie consent
Analytics and advertising cookies generally need consent before they are set. Strictly necessary cookies, such as those that keep a shopping cart working, do not. In practice this means:
- A consent banner that lets people accept or reject non-essential cookies just as easily
- No analytics or ad tags firing before consent
- A way to change the choice later
If you use Google Analytics or Google Ads, set up Consent Mode so tags respect the visitor's choice.
4. Accessibility: the European Accessibility Act
The European Accessibility Act applies from 28 June 2025 to many consumer-facing digital services, including e-commerce, banking services, e-books and passenger transport services. Estonia has brought it into national law. Microenterprises providing services, meaning fewer than 10 employees and annual turnover or balance sheet total of no more than €2 million, are exempt from the service requirements.
Even if you are exempt, the requirements are good practice:
- Text alternatives for images
- Sufficient colour contrast
- Full keyboard navigation
- Clear labels on forms
- Captions for video
The usual technical benchmark is WCAG 2.1 level AA.
5. Selling online to consumers
If you run an online shop, EU consumer law adds more requirements:
- Clear total prices including VAT and delivery costs before checkout
- Terms and conditions, available before purchase
- Information about the 14-day right of withdrawal for most distance sales
- A clear order confirmation sent by email
- Information about how complaints are handled
6. Language
If you sell to consumers in Estonia, provide the essential information in Estonian. Many businesses in Tallinn also offer Russian and English versions, which is good for customers and for search. See our guide to multilingual websites.
7. Security
- HTTPS on every page
- Up-to-date software, plugins and server
- Regular backups you have actually tested restoring
- Spam protection on forms
Most security incidents on small business websites come from outdated plugins. That is what website maintenance is for.
Need a hand?
Every website we build in Tallinn includes HTTPS, a cookie consent setup, accessible markup and space for your business details, and we help you keep it updated. Talk to us about your site or read about our web development service.