Joe is a final year law student at the Australian National University. Joe has legal experience in private, government and community legal spaces and is now a Content Writer at Sprintlaw.
Your website is often the “front door” to your business - and for many NZ businesses, it’s also the shop, the booking system, the marketing engine, and the customer support desk all in one.
That’s why website theft can hit harder than people expect. We’re not just talking about someone copying a few words from your homepage (although that happens too). Website theft can include copying your branding, cloning your site design, stealing your content, lifting your product photos, scraping your database, impersonating your business, or even taking over your domain.
This updated guide reflects what business owners are dealing with right now: AI-assisted copying, faster impersonation scams, and bigger privacy and consumer law expectations for online businesses. Don’t stress - with the right legal foundations and practical steps, you can protect your website from day one and respond quickly if something goes wrong.
What Counts As “Website Theft” In New Zealand?
Website theft isn’t one single legal concept. It’s a mix of different risks, and the right response depends on what’s actually been taken (and how).
Common types of website theft we see include:
- Copying your written content (blog posts, landing pages, FAQs, product descriptions, policies).
- Using your images (product photos, team photos, banners, icons, illustrations).
- Cloning your website design (layout, styling, user interface, “look and feel”).
- Stealing your brand identifiers (business name, logo, tagline, domain name variations).
- Impersonation (a fake site pretending to be you to take payments or capture logins).
- Data theft (customer lists, email subscribers, account credentials, order history).
- Code theft (copying custom code, plugins, themes, or proprietary features).
It’s also worth saying out loud: some “theft” happens internally. A contractor might reuse your templates for another client, or a departing team member might copy assets they helped create. That’s why your contracts matter as much as your cybersecurity.
Why It Matters To Get The Legal Category Right
The legal tools you use will change depending on what’s happened. For example:
- If your blog post was copied, you’re usually looking at copyright.
- If someone is using a confusingly similar name or logo, it might be a trade mark or fair trading issue.
- If someone grabbed customer data, you may have a privacy and confidentiality problem (and a notification issue).
Getting this diagnosis right early helps you act faster and avoid wasting time on the wrong takedown process.
Protect Your Website Content With IP (Copyright And Trade Marks)
If you want to protect your website from theft, your first line of defence is knowing what intellectual property (IP) you actually own - and making sure it’s clearly yours.
Copyright: Your Automatic Protection (But You Still Need Proof)
In New Zealand, copyright generally arises automatically when an original work is created (you don’t “register” it like a trade mark). Website content that often attracts copyright protection includes:
- Written copy (articles, product descriptions, marketing copy, manuals)
- Photography and images
- Graphics and illustrations
- Video content
- Website code (depending on what it is and how it’s used)
The practical issue isn’t whether copyright exists - it’s whether you can prove:
- you own it (especially if contractors created it), and
- it was copied (screenshots, timestamps, original files, drafts, publishing history).
This is where businesses get caught out. If a freelance designer built your site and there’s no clear written agreement on ownership, it can become harder to enforce your rights later. A tailored Service Agreement can set ownership rules clearly, including what happens with templates, source files, and reuse.
Trade Marks: Protecting Your Name, Logo, And Brand Signals
Trade marks are about brand identity - the things customers rely on to know it’s you. If your website is being “cloned”, trade marks can be one of your strongest tools, especially if someone is using your name/logo to confuse people.
Trade marks can protect things like:
- Business names (used as a brand)
- Logos
- Product names
- Taglines (sometimes)
If your brand matters online (and it usually does), it’s worth getting advice about whether you should register your trade mark. Registration can make enforcement and takedowns much more straightforward.
What About “Copying My Website Design”?
This can be tricky. Some design elements may be protected by copyright (like original graphics), but general layout ideas aren’t always easy to “own”. In real life, the strongest cases usually involve a combination of:
- Direct copying of original images/graphics and text
- Use of confusingly similar branding
- Misleading conduct (for example, pretending to be your business)
If a competitor has taken your overall look and is creating confusion in the market, you may have options beyond copyright - including under the Fair Trading Act 1986 (more on that below).
Use Website Terms, Disclaimers, And Contracts To Set Boundaries
Strong legal documents won’t stop a bad actor from copying your website, but they can:
- make your rights clearer (which helps with takedowns and enforcement),
- set rules about how users can interact with your content, and
- reduce your risk if a dispute escalates.
Website Terms And Conditions (And Terms Of Use)
Your website terms can do a lot of quiet heavy lifting. They can set out:
- who owns your website content and IP
- how visitors are allowed to use your materials (and what they can’t do)
- acceptable use rules (including scraping, automated bots, or misuse)
- rules for accounts, passwords, and access
- limitations of liability and disclaimers (where appropriate)
If you run an online platform, marketplace, membership site, or SaaS-style service, properly drafted Website Terms and Conditions are particularly important, because the website isn’t just marketing - it’s the product.
Contracts With Developers, Designers, And Contractors
A lot of “website theft” disputes start with ownership confusion. If you hire someone to build your website, write copy, or create photos, make sure your contract covers:
- IP ownership (do you own it outright, or do you get a licence?)
- reuse restrictions (can they reuse your design or content for another client?)
- handover requirements (source files, logins, admin access)
- confidentiality (especially if they’ll access customer data or backend systems)
Where sensitive business information is involved, a Non-Disclosure Agreement can be a smart “from day one” step - particularly before you share plans, code, or marketing strategy with a third party.
Keep Your Privacy Documents Current
If a thief targets your website, they often aren’t just after your content - they’re after data. If your website collects personal information (even something as simple as a contact form), you should take privacy compliance seriously.
Under the Privacy Act 2020, you’re generally expected to have good privacy practices, including transparency about how you collect and use personal information. Having a clear Privacy Policy is a key part of that - and it also helps build customer trust.
It can feel like “admin”, but it’s part of protecting your business online. If you ever need to respond to a data incident, the quality of your privacy foundations can really matter.
Prevent Website Theft With Practical Security Basics (That Also Reduce Legal Risk)
Legal protection and tech protection go hand-in-hand. If you only focus on the legal side, you might still end up dealing with impersonation scams or data breaches. If you only focus on the tech side, you might struggle to enforce your rights when someone copies you.
Here are practical steps that reduce your theft risk and can also support your legal position later.
Lock Down Access And Ownership
- Use MFA (multi-factor authentication) on your hosting, CMS (e.g. WordPress), domain registrar, email accounts, and payment platforms.
- Separate accounts: don’t share one admin login across your team.
- Keep an asset register of who controls what (domain registrar, hosting, DNS, email, SSL certificates, Shopify, Meta accounts).
- Use strong password management (a password manager beats “the same password everywhere”).
Domain control is a big one. If someone gets access to your domain account, they can redirect traffic to a fake site and capture payments and logins - and the damage can happen fast.
Backups, Updates, And Monitoring
- Keep your CMS, themes, and plugins updated (outdated plugins are one of the most common entry points).
- Automated backups (stored separately from your web server).
- Security monitoring for file changes, malware, and suspicious logins.
- Use HTTPS (SSL certificates) and keep them current.
From a risk perspective, these steps reduce the likelihood of your site being compromised. From a legal perspective, they also show you’re taking reasonable care with your systems and customer data.
Reduce Copying And Scraping Where You Can (Without Relying On It)
No technical tool is a perfect “anti-theft shield” - determined thieves can still copy. But you can raise the barrier by:
- adding watermarks to key images
- using low-resolution images where full resolution isn’t needed
- limiting automated scraping where appropriate
- adding “noindex” rules to private content areas
These are helpful, but they’re not substitutes for IP protection and good contracts.
What Laws Apply If Someone Steals Or Copies Your Website?
When your website is stolen or copied, you’ll usually be dealing with a combination of legal issues rather than a single claim. Here are some of the key laws that often come up for NZ businesses.
Copyright And IP Rights
Copyright is often the clearest starting point where someone has copied your text, images, graphics, or code. Enforcement usually involves gathering proof, contacting the infringer, and (if needed) escalating to takedown procedures or formal legal action.
The right strategy depends on:
- what was copied (and how much)
- whether it’s a competitor vs a scammer
- where they’re hosted (NZ vs overseas)
- what outcome you want (remove it, stop sales, recover losses, or all of the above)
Fair Trading Act 1986 (Misleading Or Deceptive Conduct)
If someone is using your branding or website in a way that misleads customers - for example, pretending to be your business, or creating confusion about association/endorsement - the Fair Trading Act 1986 may apply.
This is particularly relevant for:
- clone websites designed to trick people into paying a fake business
- copycat branding that causes customer confusion
- false claims like “official reseller” or “authorised partner” when they aren’t
These situations aren’t just frustrating - they can damage your reputation quickly. Acting fast is key.
Privacy Act 2020 (If Personal Information Is Involved)
If personal information has been accessed, scraped, leaked, or stolen (even if it’s “just” customer email addresses), you may have obligations under the Privacy Act 2020. That can include assessing whether the incident creates a risk of serious harm and whether notification is required.
Privacy issues can also arise if a thief creates a fake site and collects personal information while pretending to be you. Even if you’re not at fault, you’ll still want to respond quickly to protect customers and your brand.
Having solid privacy documentation and practices (including a clear Privacy Policy and internal processes) makes it easier to respond in an organised way.
Contract Law (Where The Thief Is Someone You Worked With)
If the person who stole your website assets is a developer, marketer, contractor, or even a former business partner, your contract terms matter a lot. This is where clear clauses around IP ownership, confidentiality, and permitted use can be the difference between a quick resolution and a long dispute.
If you’re operating through a company and multiple founders are involved, it’s also worth making sure your internal documents are clear on ownership and decision-making. A well-drafted Shareholders Agreement can help avoid messy internal disputes that sometimes spill into “who owns the website?” territory.
What Should You Do If Your Website Has Been Stolen Or Copied?
If you find a copycat site or stolen content, it’s easy to go straight into panic mode. The best results usually come from moving quickly, staying organised, and documenting everything.
Step 1: Gather Evidence (Before You Contact Anyone)
Before you message the infringer (or post about it online), collect evidence while it’s still live:
- screenshots (include the URL and date/time if possible)
- archived links (where available)
- copies of your original source files (drafts, design files, metadata)
- records showing when you published the content (CMS history, invoices, project files)
This matters because content can disappear quickly once the other party realises they’ve been caught.
Step 2: Identify The Real Operator Behind The Website
Sometimes the visible “business” on the site isn’t the real operator. You may need to identify:
- the hosting provider
- the domain registrar
- platform providers (e.g. Shopify, Meta, Google)
- payment processors being used
This is important because takedown processes often depend on the platform/provider rather than the website owner responding nicely.
Step 3: Use The Right Takedown And Complaint Channels
Depending on what has been stolen, your options may include:
- contacting the website owner with a formal demand to remove content
- reporting to the host or platform (for impersonation, copyright, scams)
- requesting search engine de-indexing in certain situations
- reporting fraudulent activity to relevant agencies (if it’s a scam)
The wording and evidence you provide can make a big difference to how quickly a platform responds, so it’s worth getting legal input if the issue is serious or time-sensitive.
Step 4: Protect Your Customers And Brand If It’s An Impersonation Scam
If someone has cloned your site to trick customers, you’ll usually want to act on multiple fronts at once:
- secure your domain and admin accounts immediately
- notify customers via your real channels (website banner, email list, social media)
- report the impersonation to the host and relevant platforms
- consider whether there’s a privacy incident requiring assessment/notification
This is also where having a clean set of website terms and privacy foundations helps - you can focus on the response instead of scrambling to work out what you “should” have had in place.
Step 5: Don’t DIY The Legal Escalation
It’s tempting to grab a template “cease and desist” letter or send a heated email. The risk is you might:
- make claims you can’t support
- say something that escalates the dispute
- miss a stronger legal pathway (or evidence you should be collecting)
If the theft is harming sales, reputation, or customer safety, it’s usually worth getting tailored advice early so you can move fast and stay on solid ground.
Key Takeaways
- “Website theft” can include copying content, cloning branding, impersonation scams, and data theft - and each type needs a different legal response.
- Copyright can protect written content, images, and other original website materials, but you’ll still need evidence and clear ownership (especially where contractors are involved).
- Trade marks are a practical way to protect your brand name and logo online and can make enforcement easier when copycats cause customer confusion.
- Strong legal documents like Website Terms and Conditions, contractor agreements, and NDAs help set boundaries and reduce disputes about who owns what.
- Privacy compliance under the Privacy Act 2020 matters for websites that collect personal information, particularly if a theft incident involves customer data.
- If your website is stolen or copied, act quickly: gather evidence first, identify the real operator/platform, and use the right takedown channels.
If you’d like help protecting your website content, brand, and online legal foundations (or if you’re dealing with a copycat site right now), you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.
