If you sell an app or run an online store and any of your users are in the United Kingdom, you are inside the UK's digital-rules perimeter, wherever you are based. The UK kept its own data-protection regime after leaving the EU, layered consumer-protection law on top, and added a children's-design code that catches more services than most indie builders expect. None of it needs a legal team to start on; it does need knowing which areas to look at before you point UK traffic at a launch.
This is a practical orientation, not a complete legal map. It walks through the four areas an indie app or store most often meets — UK GDPR, PECR (cookies and electronic marketing), the Children's Code, and the Consumer Contracts Regulations — and points each to the LaunchTrust check that surfaces the related signal. It is deliberately non-exhaustive: depending on your product you may also face accessibility, financial-promotions, or sector-specific rules not covered here.
UK GDPR and the Data Protection Act 2018
The UK's core privacy law is the UK GDPR, sitting alongside the Data Protection Act 2018 and overseen by the Information Commissioner's Office (ICO). If your app collects names, emails, device identifiers, analytics, or any other personal data from UK users, you are a "controller" with duties that mirror the EU GDPR: a lawful basis for processing, a clear privacy notice, data-subject rights (access, correction, deletion), and reasonable security. The two most visible launch signals are a privacy policy that exists and is linked, and a route for users to delete their account and data.
- A reachable, linked policy maps to the privacy policy detector.
- A user-facing deletion request maps to the account and data deletion detector.
- For the full data-protection set, see the GDPR checklist for indie apps — UK GDPR overlaps heavily with it.
PECR: cookies and electronic marketing
The Privacy and Electronic Communications Regulations (PECR) govern cookies, similar tracking technologies, and electronic marketing in the UK, and they work together with UK GDPR. The rule most sites get wrong: for cookies and trackers that are not strictly necessary — analytics, advertising, embedded widgets — you generally need consent before they fire, with a real choice to refuse. A banner that only says "we use cookies" while non-essential trackers have already loaded is the classic gap. PECR also covers unsolicited email and SMS marketing, where consent and a working unsubscribe route are commonly expected.
- A visible consent mechanism maps to the cookie consent banner detector.
- Trackers loading on first paint map to the third-party tracking detector. Trackers firing before any consent choice is exactly the pattern PECR is concerned with.
The Children's Code (Age Appropriate Design Code)
The UK's Age Appropriate Design Code — usually called the Children's Code — applies to online services "likely to be accessed by children" in the UK, a broader test than "designed for children." A general-purpose app with no age restrictions can still fall in scope if children are likely to use it. The Code expects services to put children's best interests first: privacy-protective defaults, data minimization, restraint on profiling, and age assurance proportionate to the risks. The practical first question is whether under-18s are likely to use your service, and if so, how you know a user's age before applying adult-level data practices.
- A visible age gate or age-assurance step maps to the age gate and assurance detector. A self-declared birthday may suit low-risk contexts and fall short in higher-risk ones — the right level is a product-and-risk judgment.
Consumer Contracts Regulations and selling online
If you sell to UK consumers — paid apps, subscriptions, digital downloads, physical goods — the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Consumer Rights Act 2015 set out what you must tell buyers before they pay and the rights they keep afterward. Pre-contract information (price, trader identity and contact details, key product terms) must be clear. Distance sales commonly carry a 14-day cancellation/withdrawal right, with specific rules for digital content where the consumer can agree to start delivery and waive part of it. Subscriptions get extra scrutiny: renewal terms, the price after any intro period, and how to cancel should be transparent before purchase, not buried after.
- Cancellation and refund terms map to the refund and cancellation policy detector.
- Auto-renewal disclosures map to the subscription auto-renewal disclosure detector.
- Trader identity and contact details map to the contact and imprint detector.
- For the broader pre-purchase set, see the UK distance selling checklist.
What LaunchTrust checks for the UK
LaunchTrust does not judge "UK readiness" as a whole — no scanner can, and this overview is not legal advice. It fetches your public pages as an anonymous visitor and reports observable signals a UK-minded reviewer looks for first: whether a privacy policy and cookie consent prompt appear present, whether third-party trackers load, whether an age gate is visible, and whether refund/cancellation, subscription, and contact/imprint information is reachable.
Every result is a signal — detected, not detected, or unable to determine — never a verdict. "Detected" means the wording or markup is on the page; it does not confirm the item is worded sufficiently, configured correctly, or adequate for UK law as applied to your product.
A concrete example
A common PECR gap: the page ships a cookie banner, but the analytics tag is already in the markup and fires immediately.
<!-- consent banner present -->
<div id="cookie-banner">We use cookies. <button>OK</button></div>
<!-- ...but the tracker loads on first paint, before any choice -->
<script src="https://analytics.example.com/track.js" data-id="UA-REDACTED"></script>A reviewer reads this as "consent banner detected, but a non-essential tracker also detected loading before consent." The fix is to gate non-essential scripts behind the user's choice, not just show a banner.
How to address UK requirements
- Publish a clear, linked privacy policy naming your data, lawful basis, and how users exercise their rights — reachable for logged-out visitors.
- Offer an account- and data-deletion route users can find, and describe it in your policy.
- Gate non-essential cookies and trackers behind consent, with a genuine reject option, so analytics and ad scripts do not fire until a UK user chooses.
- Assess whether children are likely to access your service; if so, apply privacy-protective defaults and age assurance proportionate to the data risks.
- Make pre-purchase terms transparent — price, trader identity, contact details, cancellation rights, and clear subscription renewal and cancellation terms.
- Re-scan and verify each signal, then confirm the behavior yourself in a logged-out session — especially that trackers wait for consent.
Check this in 30 seconds
Run your URL through LaunchTrust's free scanner. It fetches your live page and reports whether your privacy policy, cookie consent, age gate, refund and subscription terms, and contact details are detected, not detected, or unable to determine — so you can spot a missing UK trust signal before a user, the ICO, or an app reviewer does. No signup, and it only reads the same public HTML your visitors already get.
FAQ
Do UK rules apply to me if I'm based outside the UK? Often, yes. UK GDPR and the Children's Code can reach services likely to be accessed by people in the UK regardless of where you are based, and UK consumer law applies when you sell to UK consumers. If UK users can reach your app or store, these areas are commonly in scope.
Is UK GDPR the same as EU GDPR? They are closely aligned but separate regimes. The UK retained its own version after leaving the EU, supervised by the ICO under the Data Protection Act 2018, and the two can diverge over time. The practical groundwork overlaps — see the GDPR checklist for indie apps — but treat UK requirements as their own track.
My app isn't aimed at kids — can the Children's Code still apply? Possibly. The Code uses a "likely to be accessed by children" test, broader than "designed for children." A general-purpose service can fall in scope if under-18s are likely to use it. Whether it applies, and what age assurance is proportionate, is a product-and-risk judgment.
Does a clean LaunchTrust scan mean my app meets UK requirements? No. A scan surfaces observable signals on your public pages; it does not prove your app satisfies UK GDPR, PECR, the Children's Code, or consumer law. LaunchTrust reports signals — it is not legal advice or certification. For your specific situation, consult a qualified professional.
Compliance aid, not legal advice. LaunchTrust reports signals, not a verdict or certification.