How to Spot Legal Gaps on Your Own Website

A lot of New Zealand businesses launch a website that looks polished but misses basic legal protections.

The common mistakes are usually simple: copying terms from an overseas site, collecting customer data without a clear privacy explanation, and making marketing claims that sound great but create risk under New Zealand consumer law.

The problem is that legal gaps on a website are easy to miss when you are focused on design, sales and getting the business live. A missing returns position, unclear subscription wording, no website terms, or a badly drafted checkout flow can turn into customer complaints, regulator attention, or payment disputes later.

This guide answers a practical question founders often ask before they spend more money on ads, software or website upgrades: how do you spot gaps on your own website without being a lawyer? The answer is to review your site the way a customer, regulator and commercial counterparty would, and then fix the pages, promises and processes that create the biggest risk first.

Overview

Most website legal issues sit in plain sight. They usually appear where your business takes payments, collects information, makes promises, or allows users to interact with your brand.

A useful self-audit looks at both what your website says and what your business actually does behind the scenes. If those two things do not match, that is often where founders get caught.

• Check whether your website has clear terms of use and, if relevant, sale terms that match how you actually trade.
• Review your privacy position, including what personal information you collect, why you collect it, how you store it, and whether your privacy policy reflects your tools and processes.
• Look at all advertising claims, testimonials, pricing statements, discount offers and product descriptions for accuracy under the Fair Trading Act.
• Check your checkout flow, subscription settings, auto-renewals, refund language and delivery statements for clarity.
• Review whether your website content properly addresses obligations that cannot be contracted out of easily, such as rights that may arise under the Consumer Guarantees Act.
• Confirm that you have permission to use website content, images, logos, software plugins and customer reviews.
• Check whether your business name, branding and product names raise trade mark or passing off risks.
• Review your contact details, legal entity details and complaint handling process so customers know who they are dealing with.
• Check any cookies, analytics, tracking tools and third party integrations that collect or share user data.
• Make sure your website promises line up with your supplier agreements, fulfilment process and internal policies.

What This Means For Your Business

For a New Zealand business, spotting legal gaps on your own website means checking whether your online presence matches New Zealand consumer, privacy and commercial rules, not just whether the site looks professional. A modern website is often your shopfront, sales tool and contract process all at once.

This matters whether you are selling physical products, software subscriptions, professional services, online courses or marketplace listings. It also matters if your site is only collecting leads. If your website asks people to make decisions based on what you say, the legal risk starts there.

Your website is not just marketing copy

Many founders treat the website as branding first and legal second. In practice, key parts of the site can become evidence of what you promised customers, what data you said you would collect, and what rights a user agreed to.

That includes pages and features such as:

• homepage claims and banners
• pricing pages
• checkout pages
• subscription sign-up flows
• shipping and returns pages
• contact forms
• download pages
• account dashboards
• user-generated review sections
• terms, privacy and cookie notices

New Zealand consumer and privacy rules shape what your site should say

The Fair Trading Act 1986 can affect how you advertise products and services online. If your website overstates results, uses misleading scarcity messages, hides important conditions, or presents fake urgency, the main risk is that your marketing is not just bad practice, it may also be unlawful.

The Consumer Guarantees Act 1993 can also shape how you describe returns, refunds, repair rights and service standards, especially when dealing with consumers. A website term that says “no refunds in any circumstances” may not reflect how the law works in practice.

The Privacy Act 2020 matters where your site collects personal information, whether through enquiries, newsletter sign-ups, account creation, payment details or behavioural tracking. If you collect data, your customers should be able to understand what you collect and what happens to it.

Different business models create different gaps

A software business may need to focus on SaaS terms, user licences, acceptable use rules, uptime disclaimers and data handling. An ecommerce business may need stronger customer terms, shipping language, returns wording and supplier alignment. A service business may need to tighten proposal terms, lead capture wording and website statements about outcomes.

That is why a good website review is not just a generic legal template exercise. The legal gaps depend on your business structure, how you sell online, what contracts you use, and what promises your website makes before a customer buys.

When This Issue Comes Up

This issue usually comes up at a growth point, not at day one. Founders often notice website legal gaps when something goes wrong, or right before a major next step such as launching ads, introducing online payments, or expanding into a new product line.

Before you launch online or turn on ecommerce

If your site is moving from brochure-style information to taking orders, legal gaps become more serious. You are no longer just displaying content. You are creating a transaction pathway that should be backed by clear terms, accurate pricing and a privacy position that reflects real data collection.

This is also the point where your business structure and registration details matter more. Customers should be able to identify the legal entity they are dealing with, and your documents should align with that entity.

When you add subscriptions, memberships or recurring billing

Recurring revenue creates extra risk if the sign-up flow is vague. Businesses often forget to explain renewal timing, cancellation rules, trial periods, payment dates and what happens when prices change.

If a customer feels trapped or surprised by billing, disputes usually follow. That can affect chargebacks, reputation and customer retention, even before legal issues escalate.

When you start collecting more customer data

As soon as your website adds analytics tools, remarketing tags, account registration, support chat, downloadable resources or application forms, your privacy position may need a fresh review. A short privacy statement written at launch often stops matching what the website actually does.

This is where founders often get caught. They think they only collect names and emails, but the site also captures usage information, payment information, location data or interaction data through third party tools.

When a complaint, refund request or supplier issue appears

A customer complaint is often the fastest way to discover that your website wording is too loose. Maybe the delivery estimate was presented as a firm promise. Maybe the refund page tried to exclude rights too broadly. Maybe the product page made a claim your supplier cannot support.

Supplier and platform changes can create gaps too. If your fulfilment partner changes delivery windows, your software vendor changes terms, or your payment provider has new rules, your website content may need to catch up.

When you are preparing to scale, sell, or seek investment

Website legal gaps can become due diligence issues. Before you sign a contract with a distributor, onboard a major client, or start investor conversations, a messy website can raise questions about compliance and risk management.

A buyer or investor may look at:

• whether customer terms are enforceable
• whether privacy practices are documented
• whether the brand is protected by trade mark registration
• whether the website uses licensed content properly
• whether customer complaints reveal misleading website wording

Practical Steps And Common Mistakes

The best self-audit starts with the customer journey. Open your website as if you were a stranger, move from homepage to enquiry or purchase, and note every place where the site asks for trust, money or information.

Step 1: Identify every page that creates a promise

Start with the obvious sales pages, but do not stop there. Any statement about pricing, timeframes, outcomes, stock levels, security, support or guarantees can create legal risk if it is inaccurate or incomplete.

Look closely at:

• headlines that promise results
• comparison claims about competitors
• discount banners and countdown offers
• free trial wording
• money-back statements
• delivery estimates
• “best”, “fastest” or “guaranteed” claims
• customer testimonials and case studies

A common mistake is assuming that small print fixes a big headline. If the main message is misleading, a buried qualification may not solve the problem.

Step 2: Check whether your terms match how the website really works

Your website terms should reflect your actual process, not a generic template copied from another market. New Zealand businesses often use overseas wording that refers to foreign laws, irrelevant consumer carve-outs, or delivery concepts that do not fit their operations.

For an ecommerce site, you may need terms covering acceptance of orders, pricing errors, payment methods, fulfilment, returns, liability limits, intellectual property and account misuse. For a software or IT business, you may also need user licence terms, service access rules, data usage wording and restrictions on improper use.

A common mistake is having only a footer link labelled “Terms” that nobody clearly accepts during checkout or sign-up. If the terms matter, think carefully about how users are notified of them and when they agree.

Step 3: Review your privacy statement against actual data flows

Your privacy wording should explain what personal information you collect, why you collect it, how you use it, who you share it with, and how people can access or correct their information. It should also reflect the systems you actually use.

Do not just read the privacy page in isolation. Compare it to your forms, cookies, CRM, email tools, booking systems, support tools and payment setup.

Check questions such as:

• Do your forms collect more fields than your privacy statement mentions?
• Do you use third party tools that receive customer data?
• Do you send marketing messages, and if so, is that use explained clearly?
• Do you store account data or order history?
• Do customers know how to contact you about privacy requests?

A common mistake is treating website analytics or retargeting tools as invisible. They may still be relevant to your privacy disclosures, even if customers never see them directly.

Step 4: Test the checkout and sign-up flow like a customer

The checkout page often reveals the biggest gaps. It is where your pricing, terms, renewals, fees, delivery expectations and customer rights need to be clearest.

Go through the flow on mobile and desktop. Take screenshots. If a customer could reasonably miss a key condition, that is a warning sign.

Pay special attention to:

• whether prices are displayed clearly and consistently
• whether GST treatment is obvious where relevant
• whether shipping costs and timing are transparent
• whether renewals and cancellation rights are clearly disclosed
• whether add-on products or upsells are pre-selected
• whether any non-refundable language goes too far
• whether the terms and privacy documents are presented properly

A common mistake is hiding important conditions until after payment. If the customer only learns a material term in a confirmation email, that may be too late.

Step 5: Review your returns, refunds and complaints wording

Your website should not overstate your ability to refuse refunds or limit liability. New Zealand consumer law may affect what rights customers have, particularly where goods or services are supplied to consumers.

That does not mean every business must offer broad goodwill refunds. It means the website should describe your policy accurately and avoid blanket statements that cut across rights that may apply by law.

A common mistake is importing a US-style “all sales final” clause or saying there are no returns under any circumstances. Another common issue is forgetting that digital products and services can still raise consumer law questions.

Step 6: Check ownership and permission for content

If content appears on your site, your business should have the right to use it. That includes images, graphics, code, testimonials, product descriptions, videos and downloadable resources.

Founders often assume that content supplied by a freelancer, agency or manufacturer automatically belongs to the business. That may not be true unless the contract says so.

Review whether you have:

• written permission for testimonials and photos
• ownership or licence rights from designers and developers
• permission to use supplier images and descriptions
• clear rights in your logo, branding and copy
• a plan to respond if someone alleges infringement

This is also the stage to think about trade mark risk. If your website branding is central to your online growth, checking name availability and trade mark registration is often sensible before you spend money on business setup, packaging or ad campaigns.

Step 7: Match the website to your internal process

A website can only be legally accurate if the business behind it operates the same way. If your site promises same-day response times, 30-day refunds or local data storage, your team should be able to deliver that consistently.

Ask whether staff, contractors and suppliers know what the website says. A legal gap often comes from a disconnect between marketing and operations, not from the document itself.

Common mistakes founders make

Most website legal issues come from speed, copying and assumptions. The same patterns appear across startups and SMEs.

• Copying website terms from an Australian, UK or US business without adapting them for New Zealand law.
• Using a privacy template that does not match actual tools, integrations or data practices.
• Making broad claims like “guaranteed”, “risk-free” or “cancel anytime” without operational support.
• Hiding key subscription terms, auto-renewals or fees in fine print.
• Overreaching on refunds, liability exclusions or consumer rights.
• Forgetting that testimonials, before-and-after examples and reviews also need to be accurate and properly authorised.
• Assuming a web developer or marketing agency handled the legal side when they only handled design and functionality.
• Failing to update legal pages when the business model changes.

FAQs

Do all New Zealand business websites need terms and conditions?

Not every site needs the same set of terms, but most business websites should have at least basic website terms or sale terms if they take orders, bookings, enquiries or user sign-ups. The right document depends on whether you are selling products, services, software or simply collecting leads.

Do I need a privacy policy if I only collect contact form enquiries?

If your website collects personal information, even basic enquiry details, a privacy statement is usually a sensible step. It should explain what you collect, why you collect it and how people can contact you about their information.

Can I use overseas website templates for my New Zealand business?

You can review overseas examples for structure, but using them without adaptation is risky. They often refer to foreign laws, different consumer rules and privacy concepts that do not fit New Zealand businesses.

What if I do not sell anything directly on my website?

You can still have legal risk. If your site advertises services, collects leads, uses testimonials, captures data or promotes offers, the Fair Trading Act, privacy obligations and intellectual property issues can still be relevant.

How often should I review my website for legal gaps?

A practical rule is to review the site whenever you change pricing, launch a new product, add a subscription model, start new marketing campaigns, install new data tools, or update your fulfilment process. A regular check once or twice a year also helps catch drift between the website and the business.

Key Takeaways

• Spotting gaps on your own website means checking where the site takes money, collects personal information, makes promises or sets customer expectations.
• For New Zealand businesses, the main legal pressure points are usually consumer law, privacy, misleading advertising, contract formation and intellectual property.
• The highest-risk areas are often the pricing page, checkout flow, returns wording, subscription setup, privacy statement and promotional claims.
• Generic overseas templates often create more problems than they solve because they may not match New Zealand law or your actual business model.
• A good self-audit compares your website wording to what your business really does in practice, including internal processes, supplier arrangements and customer support.
• It is worth reviewing your website before you launch online, before you sign a major contract, before you spend money on setup, and whenever your business model changes.

If your business is dealing with how to spot gaps on your own website and wants help with website terms, privacy wording, subscription terms, advertising claim reviews, and contract review, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.