What customers need from a travel website

People come to a travel website to find a trip, see what it will really cost, check that the business can be trusted and book without fuss. Where a point below is practical advice rather than a rule, it is marked In practice. Packages, flights, hotel-only bookings and car hire are each treated differently, so check your own position against the sources.

Prices, availability and search results

Since 6 April 2025, the Digital Markets, Competition and Consumers Act 2024 has required every invitation to purchase to show the total price, including any fee, tax or charge the customer will necessarily pay, or how it is calculated where it cannot reasonably be worked out in advance. The Competition and Markets Authority (CMA) says invitations to purchase include website listings, online adverts and social media posts. Adding compulsory charges later in the booking, known as drip pricing, is banned.

The CMA’s price transparency guidance, published in November 2025, gives travel examples:

• Booking and administration fees, however they are described, belong in the price.

• Local taxes and resort fees are mandatory charges and belong in the total, even when paid at the hotel, with a breakdown of what is paid now and what is paid later.

• A “from” price must be realistic, meaningful and attainable. A website can show “from £1,000 per person including flights” if it says immediately underneath that the price is based on two adults sharing, then gives the full total once the customer enters their party and dates.

• Once a customer has searched for a party and dates, such as a three-night stay for two people, the prices shown should be totals for that search.

• Genuinely optional extras can be priced separately, but calling a compulsory charge an extra does not make it optional.

Some practices are banned outright, including advertising a price you have reasonable grounds to believe you cannot offer in reasonable quantities for a reasonable time without saying so, falsely claiming a price is available only for a limited time to rush a decision and giving materially inaccurate information about availability to get customers to buy on worse terms than normal.

In 2019 the CMA published principles for businesses of all sizes selling accommodation online. They say to tell customers prominently if the money earned from bookings or clicks affects the order of search results, to label paid-for placements, to show a discount only if it is a real like-for-like saving and to give the full context for availability messages. The CMA notes that they predate the 2024 Act, whose prohibitions are broadly similar to those in the earlier law.

Since 6 April 2025, the CMA has been able to decide for itself whether consumer law has been broken, order compensation and fine a business up to 10% of its global turnover or £300,000, whichever is higher. In November 2025 it wrote to 100 businesses about fees and online sales tactics, in sectors including holidays and package travel. In August 2026 it opened an investigation into whether a seller of package holidays had included mandatory resort fees and local taxes in its upfront prices. It has reached no conclusions.

In practice: make sure the prices and availability customers see are refreshed often enough to be bookable.

A clear booking and payment flow

The Electronic Commerce (EC Directive) Regulations 2002 say that before a customer orders online, the business must explain clearly:

1. the technical steps to complete the contract

2. whether it will file the contract and whether the customer can access it

3. how to spot and correct input errors before ordering

4. which languages the contract can be made in

It must also name any relevant code of conduct it subscribes to and say how to read it online, let customers save and reproduce its terms and acknowledge each order electronically without undue delay. If there is no way to correct input errors, the customer can rescind the contract unless a court orders otherwise.

The Consumer Contracts Regulations 2013 add that, directly before the customer orders, the main characteristics and total price must be shown clearly and prominently. The order button must say “order with obligation to pay” or something equally clear, such as “pay now”, or the customer is not bound. Optional extras need the customer’s express consent, and a pre-ticked box does not count.

How far they apply depends on what you sell:

• Packages are outside them. The Package Travel Regulations apply instead.

• Passenger transport sold on its own, such as a flight, is outside most of the information rules and all of the cancellation rules, but the rules on the final order step still apply.

• Accommodation, car hire and leisure services booked for specific dates have no 14-day right to cancel. Customers must be told this before they book, and a confirmation must follow on a durable medium, such as an email, before the service starts.

For packages, a business is liable for booking errors caused by technical defects in the booking system that are attributable to it.

In practice: book a test trip on a phone, from search to confirmation email, as a customer would.

Business details your website must show

A limited company must show on its website its registered name, its registered number, its registered office address and the part of the UK where it is registered. If it mentions share capital, the figure must be the paid-up capital. Equivalent rules apply to limited liability partnerships, and failing to follow them without a reasonable excuse is an offence.

Every business selling online, including sole traders, must make these easily and permanently accessible:

• its name and geographic address

• contact details, including an email address

• any public trade register it is on, with its registration number

• the supervisory authority, if its activity needs authorisation

• its VAT number, if it is registered for VAT

Prices must be clear and say whether they include tax and delivery costs. Under the 2024 Act, a listing that invites customers to buy must also give the business’s name, address and any business email address, plus those of any business it acts for, such as a tour operator, unless these are already clear from the context.

Packages and ATOL on your website

When a website sells packages, the Package Travel Regulations 2018 require the business to give the traveller, before they book:

• the information in Schedule 1, including the main features of the trip, the trading name, address, phone number and email of the organiser and any retailer, the total price with all fees, the payment arrangements and whether the trip is generally suitable for people with reduced mobility

• the standard information form in Schedule 2, the version for sales where hyperlinks can be used, in its set form and wording

This must be clear, comprehensible and prominent. Failing to give it is a criminal offence for the organiser and, where a retailer sells the package, for both. A statement on the website that the organiser acts only as an intermediary does not remove its duties.

The law treats a retail website as a point of sale. From 6 April 2027, a customer who selects and pays separately for different types of travel service for the same trip, in a single visit to a business’s point of sale, will generally be buying a package. The change covers bookings made from that date, and linked travel arrangements, with their information forms, are abolished at the same time. Our Package Travel Regulations guide explains the detail.

Where a website offers ATOL-protected flights or holidays, the CAA’s ATOL Standard Terms require it to say clearly, close to the price, that a service is ATOL protected wherever a customer is choosing it. Where known, it must also show flight dates and times, airports, the airline and whether hold luggage and transfers are included.

• ATOL holders must show their name, ATOL number and the ATOL logo, with one of two set statements depending on whether all or only some of the flights and flight-inclusive holidays offered are protected.

• Agents for an ATOL holder must name that ATOL holder, give its ATOL number and include the same set statement on all publicity offering flights or flight-inclusive packages. They must not use the ATOL logo without the CAA’s permission.

• Certificates. For online bookings, the ATOL Certificate must be emailed, or sent by equivalent electronic means, immediately after the first payment is taken, and no payment may be accepted until a certificate can be issued.

Suggesting that you hold an ATOL you do not hold is a criminal offence. Our ATOL guide covers the wider scheme.

Cookies, analytics and privacy

The Privacy and Electronic Communications Regulations 2003 (PECR) say a website must not store or read information on a visitor’s device, for example through cookies or tracking pixels, without consent unless an exception applies.

Since 5 February 2026, changes made by the Data (Use and Access) Act 2025 mean consent is no longer needed for:

• analytics used only to produce statistics on how your website is used so you can improve it, with the data shared only with anyone helping you do so

• remembering a visitor’s preferences, such as language, or otherwise improving how the site looks or works

For both, visitors must be told what the technology is for and given a simple, free way to object. Storage that is strictly necessary for a service the visitor asks for, such as remembering their selections during a booking, is also exempt.

The ICO’s guidance, finalised on 29 April 2026, says the analytics exception does not cover advertising or tracking individual visitors, so measuring adverts or sharing conversion data with advertising partners still needs consent. Where consent is needed, the ICO expects refusing to be as easy as accepting, and non-exempt technologies not to be set until the visitor opts in. Since 5 February 2026, PECR fines can reach £17.5 million or 4% of global turnover.

UK GDPR requires a privacy notice, given when you collect personal data, that explains who you are and how to contact you, why you use the data and on what lawful basis, who receives it, any transfers abroad, how long you keep it and what rights people have. It must be concise and in clear, plain language. Since 19 June 2026 it must also say that people can complain to you, and businesses must make complaining easy, for example with a form that can be completed online, and acknowledge complaints within 30 days. Information about a traveller’s health, such as a medical condition, is special category data with extra conditions. On 30 September 2026 the Information Commission took over from the Information Commissioner, and it is still known as the ICO.

Accessibility

The Equality Act 2010 requires anyone providing a service to the public to make reasonable adjustments for disabled people. The Equality and Human Rights Commission’s statutory code of practice, updated with effect from 5 August 2026, says these obligations apply to services provided on a website. In Northern Ireland the Disability Discrimination Act 1995 applies instead.

The duty is anticipatory: businesses must consider the barriers disabled people could face and act before a disabled customer tries to use the service, whether or not they know of any disabled customers. Where information is involved, reasonable steps include giving it in an accessible format. The code gives the example of a website with all its text embedded in graphics, which people with a visual impairment cannot enlarge or have read aloud.

The Act does not name a technical standard. The W3C’s Web Content Accessibility Guidelines (WCAG) 2.2, published in October 2023 and updated in December 2024, is approved as an international standard, ISO/IEC 40500:2025. It has three levels: A, AA and AAA. A booking journey only conforms if every step does. Criteria added in 2.2 matter for booking forms, such as not making customers re-enter details already given and making tap targets at least 24 by 24 CSS pixels, with exceptions. Separate regulations for public sector bodies are met, GOV.UK says, by meeting WCAG 2.2 AA and publishing an accessibility statement.

Taking card payments securely

PCI DSS, the card industry’s security standard, applies to any business that stores, processes or transmits card data, including through a provider. The card schemes and acquirers decide how a business must show it complies, typically with a self-assessment questionnaire (SAQ), and your acquirer can say which one applies.

SAQ A is for businesses that have outsourced all card handling to PCI DSS compliant providers, so card data is never stored, processed or transmitted electronically on their own systems. A website can do this by sending customers to the provider’s payment page or by embedding the provider’s payment form, for example in an iframe. Since 31 March 2025, a business using SAQ A with an embedded form must also confirm that its site is not open to script attacks that could affect its e-commerce systems, either through its own controls or with confirmation from its compliant provider. This check does not apply to a full redirect.

Outsourcing reduces the work but not the responsibility. A business still needs a written agreement with its provider and should check the provider’s compliance at least once a year. Our guide to taking payments covers deposits, card fees and refunds.

Speed, mobile and search

Google indexes and ranks websites using the mobile version of their content, which it calls mobile-first indexing. It recommends responsive design, where the same page adapts to the screen, and says the mobile site should contain the same content as the desktop site.

Google’s Core Web Vitals measure loading, responsiveness and visual stability. It suggests aiming for:

• Largest Contentful Paint, the main content loading, within 2.5 seconds

• Interaction to Next Paint, the response to a tap or click, under 200 milliseconds

• Cumulative Layout Shift, how much the layout moves, under 0.1

Google says Core Web Vitals are used by its ranking systems, but good scores do not guarantee top rankings, and it always seeks to show the most relevant content, even when page experience is poor. Its key search signals include meaning, relevance, quality, usability and context, and it says that when other signals are relatively equal, content people find more accessible may perform better. Its page experience checklist also asks whether pages are served securely, display well on mobile and avoid intrusive interstitials.

In practice: pages that help customers, such as clear destination and product information, also help with search. Google says its systems prioritise helpful, reliable content created for people rather than to manipulate rankings.

Trust signals: memberships and reviews

The 2024 Act bans outright claiming to be a signatory to a code of conduct when you are not, displaying a trust mark or quality mark without authorisation and falsely claiming approval by a public or private body.

• ABTA. ABTA says its logo can only be used with its express permission. Its Code of Conduct requires members to show the current logo and their ABTA number in advertising. Its website standards also require members to point customers to ABTA’s dispute resolution at abta.com, state prominently which products are financially protected and link prominently to the Foreign, Commonwealth and Development Office’s travel advice. They say ABTA travel agents should not make claims such as “fully ABTA bonded”.

• Checks. Customers can check a business on ABTA’s member search and the CAA’s Check an ATOL service.

Reviews. Since 6 April 2025, submitting or commissioning fake reviews, or reviews that hide an incentive, has been banned outright. So has publishing reviews or ratings in a misleading way, such as hiding negative reviews or giving positive ones more prominence. A business that publishes reviews, including reviews gathered by another company, must take reasonable and proportionate steps to prevent and remove fake and misleading ones. The CMA’s guidance expects a published policy prohibiting fake reviews, a regular risk assessment and processes to detect, investigate and act on them. Showing only favourable reviews can also mislead.