Reference regulations for your website
Overview of European and Italian regulations applicable to websites. Direct links to official texts, deadlines and penalties.
GDPR — EU Regulation 2016/679
The General Data Protection Regulation is the fundamental European legislation for the protection of personal data. It applies to all websites processing data of EU citizens, regardless of the company's location.
Key obligations for websites
- Complete privacy policy accessible from every page
- Legal basis for each processing of personal data
- Explicit and documentable consent for non-technical cookies
- Record of processing activities (Art. 30)
- DPO appointment if required (Art. 37)
- Data breach notification within 72 hours (Art. 33)
- Data subject rights: access, rectification, erasure, portability
- Privacy by design and by default (Art. 25)
Official links
Art. 2250 Italian Civil Code — Mandatory corporate information
Article 2250 of the Italian Civil Code requires limited companies (SpA, SRL, Sapa) to display specific identifying information in documents, correspondence and on their websites. The obligation was extended to websites by Law Decree 185/2008 (converted into Law 2/2009, art. 42): every corporate website must clearly and accessibly include the company's identifying details.
Mandatory information on the website
- Full company name (legal denomination)
- Registered office address
- Business Register office of registration
- Business Register registration number (REA)
- Subscribed and paid-up share capital (for SpA, SRL, Sapa)
- Status of sole shareholder company, if applicable
- Status of company in liquidation, if applicable
- Tax code and VAT number
- Certified email address (PEC)
Official links
ePrivacy Directive (Cookie Law)
The ePrivacy Directive regulates the use of cookies and tracking technologies. It requires prior informed consent before installing non-technical cookies on users' devices.
Key obligations
- Cookie banner on first visit with granular options
- Ability to reject all non-technical cookies with a single click
- No cookie walls (blocking access if cookies are not accepted)
- No dark patterns in the banner
- Detailed cookie policy listing all cookies
- Consent renewal every 6 months
Official links
European Accessibility Act + Italian Stanca Act
The European Accessibility Act (Directive EU 2019/882) requires all e-commerce and digital service websites to comply with WCAG 2.1 Level AA — including online shops, banking, transport, e-books and more. In Italy, the transposition (Legislative Decree 82/2022) extends the Stanca Act to the private sector: in addition to public administrations, businesses offering digital goods or services to the public are subject to the rules, with the exclusion of microenterprises (fewer than 10 employees and annual turnover ≤€2 million). Administrative penalties are enforced by AGCOM and vary depending on the violation: the exact amount is defined by national implementing rules, not by a single EU-wide ceiling.
Key obligations
- WCAG 2.1 Level AA compliance (WCAG 2.2 for best practice)
- Published accessibility statement
- Feedback mechanism for reporting accessibility issues
- Full keyboard navigability
- Screen reader compatibility
- Adequate colour contrast (minimum 4.5:1)
- Alternative text for non-text content
Official links
Empowering Consumers Directive (EU 2024/825) — anti-greenwashing
Directive EU 2024/825, known as "Empowering Consumers for the Green Transition", is the concrete and operational regulation on environmental claims. It amends the UCPD 2005/29/EC on unfair commercial practices and prohibits generic or unverifiable environmental claims (e.g. "eco", "green", "sustainable", "carbon neutral", "zero emissions") unless backed by evidence. It applies to all communication channels, including websites.
Key obligations
- Generic environmental claims ("eco-friendly", "green", "sustainable") prohibited unless they specify what they refer to and the supporting basis
- Climate-neutrality claims based solely on offsets are prohibited
- Sustainability labels must be based on official certification schemes or recognised by public authorities
- Undisclosed planned-obsolescence practices are prohibited
- Environmental and durability information must be clear, understandable and accessible
Status of the upcoming "Green Claims Directive" (COM/2023/166)
The Green Claims Directive proposal — which would add stricter rules on independent ex-ante verification of claims — is not yet law. The legislative process was suspended by the European Parliament in June 2025, and the Commission is working on a reformulated version, expected indicatively in 2026-2028. In the meantime, the framework fully in force is Directive 2024/825 described above.
Official links
CSRD — Corporate Sustainability Reporting Directive
The CSRD requires large companies and listed SMEs to report the environmental impact of their activities, including digital ones. Website environmental impact falls within the reporting scope.
Who is affected
- From 2024: large companies already subject to NFRD (>500 employees)
- From 2025: all large companies (>250 employees or >€40M turnover)
- From 2026: listed SMEs (with opt-out until 2028)
Official links
DSA — Digital Services Act
The Digital Services Act establishes rules for digital services in the EU, with obligations on transparency, content moderation and user protection. It applies to online platforms, marketplaces and search engines.
Key obligations
- Transparency in recommendation algorithms
- Prohibition of dark patterns in interfaces
- Mandatory point of contact for authorities
- Transparency in online advertising
- Reporting and complaint mechanisms
Official links
Start with a free analysis
Discover the environmental impact of your current website and receive a detailed report with steps to improve it.
Request free analysisNo commitment. Instant analysis.