Website legal requirements
in Malta: the checklist.

Malta’s Electronic Commerce Act covers businesses that offer services online, and that includes an ordinary business website that promotes what you sell. It does not matter whether you are a sole trader in Gozo or a limited company in Sliema, or whether your site takes payments. If you collect names through a contact form, use analytics or run Facebook pixels, GDPR and the cookie rules apply as well.

The good news is that most of it is a one-off job. Done once, properly, during the build, it stays done until your business details change.

If your website shows prices, the Electronic Commerce Act says they must be clear and must say whether they include tax and delivery costs. “From €990 excluding VAT” is fine. A price with no word about VAT is not.

Promotions need the same care. Discounts, gifts and competitions must be clearly marked as promotions, and their conditions must be easy to find and clearly explained. A banner that says “20% off” needs a link to the terms: what is included, until when and for whom.

Malta’s cookie rule is in Subsidiary Legislation 586.01: you need a person’s consent before storing or reading anything on their device, unless it is strictly necessary for the service they asked for. Analytics, Meta and Google ad pixels, chat widgets that track and embedded videos that set cookies all need consent. Cookies that keep a basket working or remember a cookie choice usually do not.

The IDPC’s guidance on cookie consent is clear on what does not count as consent: cookie walls that block the site until people accept, pre-ticked boxes, and treating scrolling or browsing as a yes. As good practice it shows banners that offer “Accept all” and “Reject all” on the same first layer, and it says non-essential cookies must not be in use until people have agreed. Withdrawing consent must be as easy as giving it, so keep a “Cookie settings” link in the footer.

The part banners often get wrong is the technical one: the banner shows, but the tracking scripts have already loaded. A proper setup blocks every non-essential script until consent is given, and records the choice. That also keeps your Meta and Google ads measurement honest, because it only counts people who agreed.

If people can order or pay on your website, you need terms of sale, and before an order is placed the Electronic Commerce Act asks you to explain, clearly: the technical steps to complete the order, whether you file the contract and whether the customer can access it, how to spot and correct typing mistakes before ordering, the languages you offer the contract in, and any codes of conduct you follow. The terms must be available in a way customers can save and print, and each order should be acknowledged by email without undue delay.

Consumer rules on delivery, returns and the right to withdraw also apply. Our ecommerce guide covers those for Malta and Gozo.

One link to remove: some online shops still have a link to the EU Online Dispute Resolution platform in their footer. The platform was closed on 20 July 2025 under Regulation (EU) 2024/3228, so the link and the wording around it should come out.

Use this to check your own website. If you tick everything, you are in good shape. If not, most items take minutes to fix on a well-built site.

Every website we build includes the footer details, a privacy notice link next to each form, cookie consent that really blocks tracking until people agree, a “Cookie settings” link and, for shops, the order steps and terms pages. We ask for your registration and VAT numbers at the start, set up the pages from your real tools and processes, and you or your lawyer approve the final wording. We do not give legal advice, and we will tell you when something needs one.

Websites start from €990 for a Professional Website, €2,490 for a Business Website and €4,900 for a Growth Website, excluding VAT. If you already have a site and just want to know what is missing, apply and send us the link.