Bálint is a bookkeeper in Debrecen. He has just launched a website, and on Tuesday morning a German company that runs a small warehouse nearby visits it. Katrin, their office manager, likes what she reads: clear prices, a friendly photo, a short form.
Then she does what she always does before contacting a new supplier. She scrolls to the very bottom and looks for the word "Impressum".
There is no Impressum. There is no company name either, just "© Bálint" and an email address. Katrin is not a lawyer, but she knows that every German business site has this page, and a missing one feels like a shop without a sign over the door. She opens the next search result.
Bálint will never know she was there.
Bálint, Katrin and the warehouse are imagined. The research, laws and cases below are real.
What visitors check first
The previous chapter described trust as the absence of doubt. This one is about the specific, often dull, pieces of information that remove the most common doubt of all: is there a real, accountable business behind this page?
Research on this is surprisingly consistent across two decades. The 2002 Stanford Guidelines for Web Credibility put "Show that there's a real organization behind your site" second on their list, followed by "Show that honest and trustworthy people stand behind your site" and "Make it easy to contact you". Nielsen Norman Group's credibility factors include upfront disclosure of contact information, costs, fees and policies. Both describe the same thing: visitors want to know who they would be dealing with, how to reach them, and what the rules are.
For small businesses, the person matters as much as the company. A visitor deciding whether to email a two-person studio is really deciding whether to trust those two people. A real photo and a name beside the form ("Bálint reads every message himself") answers a question no logo can. Our tip on how small studios beat giants on first impressions goes deeper on making the people and their judgment visible.
A real address matters for a less pleasant reason too. In May 2026 the US Department of Justice, on behalf of the FTC, and the state of Illinois sued a Chicago company alleged to have created thousands of online listings for non-existent local home-repair businesses, with addresses that were made up or belonged to unrelated third parties, propped up by fabricated five-star reviews. The case is pending and the allegations are unproven. But it shows why visitors have learned to be suspicious of a business they cannot place on a map.
Do this: open your site on a phone and time how long it takes to find your full business name, a street address and a way to reach a human. If it takes more than a few seconds, so does Katrin's search.
Seals: which ones people trust
Trust badges are the first thing many owners reach for. The best public evidence on which ones work comes from Baymard Institute, which has repeatedly asked US adults the same question: "Which badge gives you the best sense of trust when paying online?"
In the first survey, in January 2013, 2,510 people answered and 1,286 picked a seal (the rest chose "don't know or no preference"). Of those, about 36% chose Norton, 23% McAfee, and about 13% each TRUSTe and BBB Accredited. The 2023 round, the seventh, told largely the same story: Norton's seal dominated, followed by three trust seals, with most SSL-vendor seals far behind.
Then comes the uncomfortable finding. Since 2016, Baymard has included a completely made-up seal with no issuer and no meaning. It performed significantly better than every established SSL seal except Norton's. Baymard's conclusion is that, beyond strong brand recognition, it matters less which seal you use than that some visual reassurance sits right next to the sensitive fields.
- Examples
- Norton, Thawte, GeoTrust, Comodo
- Actually proves
- The connection is encrypted
- Perceived
- Weak, unless the brand is famous
- Examples
- BBB Accredited, TRUSTe, national e-commerce marks
- Actually proves
- A third party checked the business against its criteria
- Perceived
- Strong when recognized
- Examples
- A padlock, "Secure checkout"
- Actually proves
- Nothing beyond your own claim
- Perceived
- Surprisingly strong
That gap between what a seal proves and how it feels is precisely why the law steps in. Under the EU Unfair Commercial Practices Directive, Annex I point 2, "displaying a trust mark, quality mark or equivalent without having obtained the necessary authorisation" is banned in all circumstances, and the UK has the same rule in paragraph 3 of Schedule 20 to the DMCC Act 2024. A homemade padlock with the true words "Secure form (HTTPS)" is a factual claim. A homemade badge designed to look like a certification you do not have is a different matter.
Three practical points for small businesses. Show only seals you are entitled to, and keep them current. Place them next to the moment they reassure: payment logos near the price, a security note next to the form, a trade-body membership near the testimonials. And remember that Baymard's surveys concern US online payments; for a service enquiry with no card involved, a named person and a real address do more than any badge.
Do this: list every badge on your site and write next to each one who issued it and when it expires. Delete any you cannot fill in.
The legal notice, country by country
Here is the part Katrin knew instinctively. In the EU, a business website must make basic identity information easy to find. The rule comes from one directive, implemented slightly differently in each country, and the UK kept its version after Brexit.
This section is general information, not legal advice. Requirements depend on your country, legal form, profession and customers. Check your own jurisdiction or ask a lawyer.
Anyone providing an "information society service", which includes an ordinary business website, must provide at least: name; the geographic address where they are established; contact details including an email address that allow rapid, direct and effective contact; trade register and registration number, if registered; the supervisory authority, if the activity needs authorization; for regulated professions, the professional body, title and applicable rules; and the VAT number, if applicable. Article 5(2) adds that prices must be clear and say whether they include tax and delivery costs. In case C-298/07 (16 October 2008), the Court of Justice held that an email address alone is not enough: there must be a second rapid, direct means of contact, which need not be a telephone number and can be an online enquiry form.
Source: Directive 2000/31/EC, Art. 5; CJEU C-298/07. Not legal advice.
Since 14 May 2024, the German imprint duty sits in § 5 DDG, which replaced § 5 of the old Telemediengesetz (TMG) with essentially the same content. It applies to business digital services normally offered for payment, which in practice covers most commercial websites. Required details include name and address; for companies, legal form and authorized representative (and capital, if any is stated); fast electronic contact including email; supervisory authority where relevant; register and number; professional details for regulated professions; and VAT ID or business ID number. Failing to provide them is an administrative offence with a fine of up to €50,000 under § 33 DDG, and German competitors and associations can also send cease-and-desist letters. Sites still citing "§ 5 TMG" are referring to a law that no longer exists.
Source: § 5 DDG, § 33 DDG on gesetze-im-internet.de. Not legal advice.
"Directly reachable" has a well-known interpretation. In judgment I ZR 228/03 of 20 July 2006, the German Federal Court of Justice (BGH) held that provider details reachable through two links, in that case "Kontakt" and then "Impressum", could satisfy the requirement, because users understood those labels. The court also said the information did not have to be on the home page. The case was decided under the predecessor law (§ 6 TDG), and German practice still treats it as the benchmark: at most two clicks, with a link label people recognize.
The Hungarian e-commerce act requires the service provider to publish at least: name; registered seat or establishment (or, failing that, home address); contact details, in particular a regularly used email address; the court or authority that registered it and the registration number, where registration is required; licensing authority and licence number, for licensed activities; tax number, if subject to VAT; professional chamber and qualification details for regulated professions; and, unusually, the seat and contact details, including email, of the provider that hosts the website (point h), unless these are evident from the nature of the hosting. Hungarian sites therefore commonly list their hosting company in the legal notice ("Impresszum").
Source: 2001. évi CVIII. törvény, 4. § (Nemzeti Jogszabálytár / Jogtár). Not legal advice.
Regulation 24(2) of SI 2015/17 requires every company to disclose its registered name on its websites. Regulation 25 adds the part of the UK where it is registered (for example England and Wales), its registered number and its registered office address. These 2015 regulations replaced the Companies (Trading Disclosures) Regulations 2008. Separately, regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002, retained after Brexit, mirrors Article 5 of the EU directive: name, geographic address, email and other rapid contact details, register details and VAT number where applicable.
Source: SI 2015/17, Part 6; SI 2002/2013, reg. 6. Not legal advice.
Do this: add a footer link called "Legal notice" (or "Impressum" or "Impresszum", matching your market) on every page, leading to one page with every item your country requires.
Privacy and cookies
Two more footer links carry legal weight, and both affect trust directly. A privacy notice answers "what will they do with my details?" A cookie banner is often the very first thing a visitor sees, and a manipulative one makes a poor first impression.
Article 13 requires, at the moment of collection: your identity and contact details (and those of a data protection officer, if you have one); the purposes and legal basis; any legitimate interests relied on; recipients; transfers outside the EU and safeguards; the retention period or criteria; the rights of access, rectification, erasure, restriction, objection and portability; the right to withdraw consent where processing relies on it; the right to complain to a supervisory authority; whether providing the data is required and the consequences of not doing so; and any automated decision-making. Article 12 requires plain, accessible language.
Source: Regulation (EU) 2016/679, Arts 12–13. The UK GDPR has equivalent provisions. Not legal advice.
The practical design: a full notice in the footer, plus a one-line summary and link right beside every form. Visitors read the line; the notice is there for those who want detail and for regulators.
Storing information on, or reading it from, a user's device is allowed only with consent based on clear and comprehensive information, except where strictly necessary to transmit a communication or provide a service the user explicitly requested. In Planet49 (C-673/17, 1 October 2019), the Court of Justice ruled that a pre-ticked checkbox is not valid consent, that the rule applies whether or not the data is personal data, and that users must be told how long cookies last and whether third parties can access them. Germany implements the rule in § 25 TDDDG; the UK equivalent is regulation 6 of PECR.
Source: Directive 2002/58/EC, consolidated text, Art. 5(3); CJEU C-673/17. Not legal advice.
Making refusal harder than acceptance has proved expensive. In decisions dated 31 December 2021 and announced in January 2022, France's data protection authority, the CNIL, fined Google €150 million (€90 million for Google LLC, €60 million for Google Ireland) and Facebook's Irish entity €60 million because on google.fr, youtube.com and facebook.com one click accepted cookies while refusing took several. It gave them three months to fix it, under a penalty of €100,000 per day of delay.
Figure 4. A cookie banner before and after. Fictional example; the duration and provider are placeholders you would replace with your own facts.
The best cookie banner, for trust, is often no banner at all. If your site uses no non-essential cookies, for example by choosing privacy-friendly analytics configured not to store anything on the device, you may not need consent under Article 5(3). Check with your provider and your national authority before relying on that.
Do this: open your site in a private window. If "Reject" takes more clicks than "Accept", fix it this week.
Terms and the 14 days
If you sell to consumers online, including services booked through your site, the Consumer Rights Directive gives them information rights before the contract and, in most cases, a right to change their mind.
Article 9 gives consumers 14 days to withdraw from a distance contract without giving a reason; for services, the period runs from the day the contract is concluded. Article 6(1)(h) requires you to explain, before the contract, the conditions, time limit and procedure, with the model withdrawal form. If a consumer asks you to start a service during the withdrawal period and later withdraws, they owe a proportionate amount, but only if you informed them (Art. 6(1)(j)). Directive (EU) 2023/2673 added Article 11a: from 19 June 2026, for contracts concluded through an online interface, traders must provide a withdrawal function labelled "withdraw from contract here" or something equally clear, prominently displayed and available throughout the withdrawal period, followed by a confirmation step and an acknowledgement on a durable medium. Exceptions to the right of withdrawal are listed in Article 16.
Source: Directive 2011/83/EU, consolidated text, Arts 6, 9; Directive (EU) 2023/2673, Arts 1–2. In the UK, the Consumer Contracts Regulations 2013 provide a similar 14-day right. Not legal advice.
For most of the readers of this guide, who take enquiries rather than online orders, the withdrawal button will not apply to the website itself. The pre-contract information still does once you agree work with a consumer, and clear terms linked from the footer are a trust signal in their own right: they show you have thought about what happens when things go wrong.
Do this: if consumers can buy or book on your site, check that terms, withdrawal information and, since June 2026, a withdrawal function are reachable before and after purchase.
The trust-signal checklist
Here is everything above in one table. "Law" lists the main EU source and national examples covered in this chapter; your country may add more.
| Item | What it is | Law that requires it | Where to put it |
|---|---|---|---|
| Business name and legal form | Full registered name, e.g. "Ltd", "GmbH", "Kft." | ECD Art. 5(1)(a); DDG § 5(1) no. 1; Ekertv. 4. § a); UK SI 2015/17 reg. 24(2)CRD Art. 6(1)(b) for consumer contracts | Footer and legal notice |
| Geographic address | A real street address, not only a PO box | ECD Art. 5(1)(b); DDG § 5(1) no. 1; Ekertv. 4. § b); UK reg. 25 (registered office)CRD Art. 6(1)(c) | Legal notice, contact section |
| Email plus a second fast channel | Email and a phone number or working contact form | ECD Art. 5(1)(c) with CJEU C-298/07; DDG § 5(1) no. 2; Ekertv. 4. § c)CRD Art. 6(1)(c): phone and email | Contact section, footer |
| Register and number | Company register and registration number | ECD Art. 5(1)(d); DDG § 5(1) no. 4; Ekertv. 4. § d); UK reg. 25 | Legal notice |
| VAT or tax number | VAT ID (or tax number in Hungary) | ECD Art. 5(1)(g); DDG § 5(1) no. 6; Ekertv. 4. § f) | Legal notice |
| Authority or chamber | Supervisor, licence or professional body, if your work is regulated | ECD Art. 5(1)(e)–(f); DDG § 5(1) nos. 3, 5; Ekertv. 4. § e), g) | Legal notice |
| Hosting provider | Name, seat and email of your web host | Ekertv. 4. § h) (Hungary) | Legal notice |
| Privacy notice | Who, why, legal basis, retention, rights, complaints | GDPR Arts 12–13 | Footer, plus a line beside every form |
| Cookie consent | Equal accept and reject, before non-essential cookies | ePrivacy Art. 5(3); Planet49; DE § 25 TDDDG; UK PECR reg. 6 | Banner on first visit, "Cookie settings" in footer |
| Prices with tax | Total price, or how it is calculated | ECD Art. 5(2); CRD Art. 6(1)(e) | Pricing section, near the button |
| Terms and withdrawal | Contract terms, 14-day withdrawal info, withdrawal function for online contracts | CRD Arts 6(1)(h), 9, 11a (from 19 June 2026) | Footer, and before purchase or booking |
| Seals and memberships | Only marks you are authorized to show | UCPD Annex I point 2; UK DMCC Sch. 20 para. 3 | Next to the step they reassure |
| Named people | Name, photo and role of who does the work | No direct duty (DDG requires the authorized representative of companies) | About section, beside the form |
| Payment logos | Methods you actually accept | CRD Art. 6(1)(g): payment arrangements | Near the price or checkout |
ECD = e-Commerce Directive 2000/31/EC. CRD = Consumer Rights Directive 2011/83/EU. UCPD = Unfair Commercial Practices Directive 2005/29/EC. Not legal advice.
A footer that does the work
All of this fits in a footer and one short page. Here is what Bálint's could look like, in English for this guide. The business and all its numbers are invented; the structure is what matters.
Legal notice (Impresszum)
Service provider: Fenyő Bookkeeping Kft., Sample utca 1, 4000 Debrecen, Hungary. Managing director: Bálint Fenyő.
Contact: hello@fenyo.example, +36 00 000 0000, or the contact form on our home page.
Registration: Registered by the Company Registry Court of [court], no. 00-00-000000 (sample).
Tax number: 00000000-0-00 (sample). EU VAT ID: HU00000000 (sample).
Professional registration: [registering body and number, if your profession requires one].
Hosting provider: [host name, seat and email], as required by Ekertv. 4. § h).
Notice what the footer does beyond compliance. The managing director's name and "answers every enquiry personally" address benevolence. Opening hours set expectations. "Prices shown include VAT" removes an integrity doubt before it forms. Compliance and trust use the same raw material.
Score your own site
Open your website in another tab and tick what you can find within two clicks from the home page.
Score: 0 of 10
Still missing:
The audit is a prompt, not a compliance certificate. A full score means the visible basics are in place; a lawyer familiar with your sector should still review the content of your privacy notice and terms.
What to change tomorrow
Build the legal notice page
One page, linked from every footer, with every item your country requires, using the checklist table. Label it the way your market expects: "Legal notice", "Impressum", "Impresszum".
Fix the second contact channel
Email alone is not enough under C-298/07. Add a phone number or a contact form that someone actually answers, and say when they answer it.
Put privacy beside the form
Add one line under every form saying what you use the details for, linked to a complete Article 13 notice. Delete fields you cannot justify in that line.
Make the cookie choice fair
Equal Accept and Reject buttons, nothing pre-ticked, durations and third parties named. Or drop non-essential cookies altogether.
Clean up your badges
Keep only seals you are entitled to, place them where they reassure, and add a named person with a real photo near the form. People trust people before logos.
Bálint added a legal notice, his photo and a sentence saying he answers every message himself. Two weeks later, Katrin's colleague found the site again. This time she got to the bottom of the page, found what she was looking for, and sent an enquiry. It began, "We are a small German company with a warehouse near you..."
What the research supports
Credibility research consistently finds that visitors look for evidence of a real organization, real people and easy contact, but most of it is qualitative or survey-based and does not measure conversion effects of individual elements. Baymard's seal studies are large but concern stated preferences of US adults about online payment, not behavior on service sites, and they show that perceived security can diverge sharply from actual security. The legal requirements in this chapter are, by contrast, specific and in force as of October 2026, although details vary by country, legal form and profession.
Sources
- Stanford Persuasive Technology Lab (2002). Stanford Guidelines for Web Credibility. Guidelines 2, 4 and 5 consulted.
- Harley (2016), Nielsen Norman Group. Trustworthiness in Web Design: 4 Credibility Factors. Consulted for upfront disclosure.
- Holst (2013), Baymard Institute. Which Site Seal do People Trust the Most? Survey method, sample and 2013 percentages consulted.
- Holst (2016, updated with 2023 results), Baymard Institute. How Users Perceive Security During the Checkout Flow. Consulted for the 2023 seal results, seal categories and the homemade seal finding.
- US Federal Trade Commission (11 May 2026). FTC and Illinois Take Action to Stop Deceptive Conduct by Company that Created Thousands of Business Listings of Fake Local Home Repair Businesses. Press release consulted; the case is pending.
- Directive 2000/31/EC on electronic commerce. Official text on EUR-Lex. Article 5 consulted.
- Court of Justice of the EU (2008). Case C-298/07, Bundesverband der Verbraucherzentralen v deutsche internet versicherung AG. Operative part consulted.
- Digitale-Dienste-Gesetz. § 5 DDG and § 33 DDG. Official consolidated text consulted for the list of required items and the fine.
- Bundesgerichtshof (2006). Urteil vom 20. Juli 2006, I ZR 228/03, Anbieterkennzeichnung im Internet. Headnotes and facts consulted.
- 2001. évi CVIII. törvény az elektronikus kereskedelmi szolgáltatások, valamint az információs társadalommal összefüggő szolgáltatások egyes kérdéseiről. Consolidated text. 4. § consulted.
- The Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015. SI 2015/17, Part 6. Regulations 24 and 25 consulted.
- The Electronic Commerce (EC Directive) Regulations 2002. SI 2002/2013, regulation 6. Consulted.
- Regulation (EU) 2016/679 (GDPR). Official text on EUR-Lex. Articles 12 and 13 consulted.
- Directive 2002/58/EC as amended by Directive 2009/136/EC. Consolidated text on EUR-Lex. Article 5(3) consulted.
- Court of Justice of the EU (2019). Case C-673/17, Planet49. Operative part consulted.
- DLA Piper Privacy Matters (2022). CNIL fines Facebook Ireland €60 million and Google €150 million. Secondary summary of CNIL decisions SAN-2021-023 and SAN-2021-024, consulted because the CNIL's English announcement is no longer online.
- Directive 2011/83/EU on consumer rights. Consolidated text on EUR-Lex. Articles 6 and 9 consulted.
- Directive (EU) 2023/2673. Official text on EUR-Lex. New Article 11a of Directive 2011/83/EU and application date consulted.
- Directive 2005/29/EC on unfair commercial practices. Consolidated text on EUR-Lex, Annex I point 2; and DMCC Act 2024, Schedule 20, paragraph 3. Consulted.
Sources checked 18 October 2026. Legal texts were read in their official consolidated versions. Only publicly available material was consulted. Bálint, Katrin, Fenyő Bookkeeping Kft. and every name, address and number in the sample footer are fictional; the figures are original illustrations.