What types of laws do you need to comply with as a website owner?
We’ll also touch upon laws that apply to specific industries, such as healthcare and finance, along with laws that pertain to eCommerce websites.
You can press on each bullet point to jump straight to each section.
Privacy and data protection requirements
In today's digital world, ensuring privacy and data protection for websites is essential. For website owners, compliance with these regulations involves a series of measures aimed at safeguarding website visitors' personal information.
Implementing robust privacy and data protection measures is not only a legal requirement but also essential for building trust and credibility with website visitors in an increasingly privacy conscious digital world.
Here are some of the most notable privacy and data protection laws you likely need to comply with:
The General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is a set of regulations designed to protect the personal data and privacy of individuals within the European Union (EU), Iceland, Liechtenstein, and Norway.
In order to be compliant with GDPR, website owners must have a lawful basis for collecting and processing personal data.
This could include user consent, contractual necessity, legal obligations, vital interests, public task, or legitimate interests. Websites need to clearly inform users about the data collected, how it's used, and who it's shared with in a privacy notice. Consent must be freely given, specific, informed, and unambiguous. Website visitors have the right to withdraw consent at any time.
It is important to note that if your website or business offers goods or services to individuals residing within these countries, the General Data Protection Regulation likely applies to you, regardless of where your business is located.
This is true even if you offer free services, or if your website monitors the behavior of individuals in the EU, such as through tracking cookies or targeted advertising, the GDPR is likely to apply regardless of where the website or business is located.
The ePrivacy Directive vs. GDPR
The ePrivacy Directive, often referred to as the 'Cookie Law’, sets out additional specific requirements for website owners and operators, particularly concerning the use of cookies and similar technologies.
While the GDPR sets broad rules for personal data handling, the ePrivacy Directive focuses on consent for cookies and electronic communication on websites. This includes specifically seeking user consent for tracking technologies, and providing clear cookie usage information.
We will explain these concepts in detail later in the blog. You can skip straight to that section by pressing here.
The Federal Trade Commission Act (FTC Act)
The Federal Trade Commission Act (FTC Act) aims to protect consumers from deceptive and unfair practices in commerce. As such, it places responsibilities on website owners and businesses operating online in the United States.
Among other laws, the FTC Act mandates that website owners need to clearly and conspicuously disclose their privacy practices, including how they collect, use, and share consumer information.
If your website collects personal information, you should include a privacy policy that outlines these practices.
In addition, website owners must implement robust security measures to safeguard user data from breaches or unauthorized access. This includes maintaining secure data storage and transmission practices.
Other relevant responsibilities under the FTC Act are discussed below. To skip straight to that section, press here.
Children’s Online Privacy Protection Act (COPPA)
The Children’s Online Privacy Protection Act (COPPA) focuses on protecting the online privacy of children under the age of 13 in the U.S. Website owners and operators who target or knowingly collect personal information from children must comply with COPPA's strict requirements.
COPPA requires obtaining verifiable parental consent before collecting any personal information from children, including names, email addresses, or any other data that could identify them. Additionally, website owners must provide comprehensive privacy policies that outline their data collection practices and offer parents the option to review and delete their child's information.
The FTC has recently proposed changes to the COPPA, which include requiring separate parental opt-in to process children’s personal data for targeted advertising, and reinforcing the ban on collecting more personal information than necessary for a child’s participation in online activities. While these changes have yet to be codified into law, it is important to be aware of them.
The California Online Privacy Protection Act - CalOPPA
CalOPPA stands for the California Online Privacy Protection Act. It's a state law in California that requires operators of commercial websites and online services that collect personal information from California consumers to clearly post a privacy policy on their website. CalOPPA applies to any business or individual operating a website or online service that collects personally identifiable information (PII) from California residents, regardless of where the business is located. Therefore, while CalOPPA is a state law, it can have broad implications, as many websites and online services cater to website visitors in California.
The CalOPPA requires that the privacy policy includes specific information such as the categories of personal information collected, the categories of third parties with whom the information is shared, the process for users to review and request changes to their information, how changes to the privacy policy will be communicated, and the date of the last update to the privacy policy.
Under CalOPPA, a privacy policy must also explain how website visitors can make a Do Not Track request. However, there is no law requiring websites to respect a visitor’s Do Not Track setting.
The California Consumer Privacy Act (CCPA)
The California Consumer Privacy Act (CCPA) is a state-level data privacy law that grants California residents certain rights regarding their personal information collected by businesses. CCPA applies to for-profit businesses that collect personal information of California residents, meet specific revenue thresholds, and engage in certain types of data processing.
The CCPA grants several rights to California consumers, including the right to know what personal information is being collected, the right to delete their information, the right to opt out of the sale of their data, and the right to non-discrimination for exercising their privacy rights. Businesses are required to inform consumers through a privacy policy about the categories of personal information collected, the purposes of collection, and the third parties with whom the data is shared. The privacy policy should also inform consumers about the aforementioned rights.
The Personal Information Protection and Electronic Documents Act - PIPEDA
PIPEDA stands for the Canadian Personal Information Protection and Electronic Documents Act. It is a Canadian federal privacy law that governs how private sector organizations collect, use, and disclose personal information in the course of commercial activities.
For websites, PIPEDA applies to the collection of personal information from users in Canada. Websites must obtain meaningful consent from users before collecting, using, or disclosing their personal information. This consent should be clear, understandable, and specific to the purposes for which the information is being collected.
Important note: aside from the PIPEDA, a number of Canadian provinces have also enacted comprehensive private sector privacy legislation that may be relevant for website operators.
Other important laws you should be aware of
- The Data Protection Act is an important legal framework governing data protection and privacy in the United Kingdom. Website owners and businesses operating within the UK must adhere to its provisions, which are designed to safeguard individuals' personal information. Under the Data Protection Act, website owners are required to process personal data lawfully, transparently, and for specific purposes. They must also ensure the accuracy of the data and implement appropriate security measures to protect it. Additionally, individuals have the right to access their personal data held by website owners and request its correction or deletion
- Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, or LGPD) applies to website owners and businesses operating in Brazil, governing the collection, processing, and storage of personal data. Website owners in Brazil must comply with LGPD by obtaining user consent for data collection, ensuring data accuracy, and implementing security measures to safeguard personal information. Individuals have the right to access, correct, or delete their data held by website owners
How to comply with privacy and data security laws
Compliance with data privacy laws includes two key elements:
1. Gain cookie consent
Cookies are small pieces of data stored in a user's browser that contain information about their activity on a website. They serve various purposes, including remembering preferences, analyzing site usage, and personalizing content.
Obtaining user consent for cookies is essential due to privacy regulations like GDPR and CCPA.
Website owners must obtain informed consent from users before placing cookies or similar tracking technologies on their devices. Users should be provided with clear and comprehensive information about the purpose of the cookies. For this purpose, websites typically display a cookie banner or pop-up explaining the types of cookies being used along with a request for user consent before any non-essential cookies are stored. Users should have the option to accept or decline these cookies, and the websites must respect their choices.
Consent for cookies must be obtained through an affirmative and active action from the user, such as clicking an "I agree" button or adjusting cookie settings. Pre-checked boxes or implied consent are generally not considered compliant.
Important note: Only “essential cookies”, i.e. certain cookies that are necessary for the functioning of the website are exempt from the consent requirement. However, the scope of these exemptions is limited.
2. Create a privacy policy
Creating a comprehensive privacy policy not only ensures compliance with relevant laws but also builds trust with users by demonstrating transparency and commitment to protecting their personal information.
A privacy policy should include applicable laws, detail user rights, explain data collection and usage, emphasize data security measures, and provide contact information for users to withdraw consent or request records.
Privacy policies can appear in various areas of a website, including within a dedicated landing page. If you’d like to see an in-depth example of such a document, you can check out accessiBe’s privacy policy by pressing here.
Important note: we strongly recommend that you check with a lawyer in order to prepare a privacy policy that is tailored to your unique practices and requirements. It is inadvisable to copy something you found on the internet and trust that this works for your purposes.
Requirements under web accessibility laws
16% of the world’s population (including more than 26% of adult Americans) live with some form of disability. However, the vast majority of websites are partially or completely inaccessible to members of the various disability communities.
To help end this discriminatory reality, several American and international laws have been enacted, mandating that websites be made accessible.
The following are the important laws you should be aware of:
The Americans with Disabilities Act (ADA):
The Americans with Disabilities Act (ADA) is a civil rights law that prohibits discrimination against individuals with disabilities in all areas of public life, including jobs, schools, transportation, and public and other businesses considered 'public accommodations' that are open to the general public.
The ADA doesn’t explicitly mention websites or digital accessibility because it was enacted before the widespread use of the internet. However, courts have increasingly interpreted the ADA to apply to websites. This is based on the idea that the internet is a crucial means of accessing goods, services, and information in the modern world, and denying individuals with disabilities access to websites would be a form of discrimination.
With nearly all businesses falling under the category of a ‘public accommodation’, ADA website compliance is a must for almost every business.
Section 508 of the Rehabilitation Act
Section 508 of the Rehabilitation Act requires government bodies, federally-funded agencies, and service providers to such organizations to make their information and communication technology (ICT) accessible to people with disabilities. ICT is a broad term that includes websites and online documents (as well as other forms of software and hardware).
The Accessibility for Ontarians with Disabilities Act (AODA)
The Accessibility for Ontarians with Disabilities Act (AODA) is a law in the province of Ontario, Canada, and aims to make Ontario more accessible for individuals with disabilities. The AODA applies to websites requiring Ontario-based website owners to make their websites accessible.
How to comply with web accessibility laws
Web accessibility laws draw upon the Web Content Accessibility Guidelines (WCAG), created and updated by the World Wide Web Consortium (W3C). A number of different WCAG versions were released over the years: WCAG 2.0, 2.1, and 2.2. Each of these WCAG versions consists of three levels of conformance: Level A (the most basic), Level AA (the more advanced level of conformance), and Level AAA (the highest level of conformance and hardest to achieve).
It is generally accepted that achieving ADA website compliance entails conforming to WCAG 2.0 or 2.1 at Level AA.
Many U.S. courts (acting upon the DOJ’s instructions on the matter) reference WCAG at that level as the standard websites should comply with under the ADA.
To comply with Section 508 and the AODA, relevant websites need to conform to WCAG 2.0 Level AA.
What does achieving WCAG 2.0 or 2.1 Level AA conformance entail?
To conform to WCAG 2.0 and/or 2.1 Level AA, your website needs to meet a number of technical and design-based requirements. These include, but certainly aren’t limited to:
- Compatibility with screen reader technology
- Keyboard-only navigation
- Accessible online documents (e.g., PDFs)
- Captions for videos
- Alt text for meaningful images
- Proper color contrasts
The full list of action items (or success criteria) is substantially longer. We recommend you check out our comprehensive checklists in your efforts to achieve compliance with these laws (if they apply to you):
Requirements under copyright laws
Website owners must comply with various Intellectual Property (IP) laws. Content, including text, audio, images, and audio-visual content, is considered a work of authorship and as such is usually protected by a copyright. You should assume that any content created by another person or company is copyrighted, and you need the permission of the respective copyright holder in order to include such content on your website.
You may incorporate quotes from another work without seeking permission under the "Fair Use" doctrine, provided that the extent of the quotation is limited (usually not exceeding a paragraph). The “Fair Use” doctrine allows for the limited use of copyrighted material for purposes such as criticism, comment, news reporting, parody, caricature, or for an intellectual comparison between the quoted work and the assertion. We recommend consulting with a lawyer before using specific excerpts to ensure that you do not risk a claim for copyright infringement.
Additionally, managing user-generated content necessitates clear intellectual property policies to prevent infringement.
If your website allows users to submit content (comments, images, etc.), establish terms of service that make it clear that users are responsible for ensuring they have the right to contribute the content. You should therefore implement mechanisms for addressing copyright infringement claims.
DMCA compliance:
If your website is hosted in the United States, you need to comply with the Digital Millennium Copyright Act (DMCA). Implement a DMCA notice and takedown process to promptly respond to copyright infringement claims.
Be cautious when linking to or embedding content from other websites. While linking to content generally doesn't infringe on copyright, embedding may raise legal issues, especially if the content owner has not granted permission.
Requirements under trademark laws
You generally cannot use a third party’s trademark or logo without their permission. Here are some best practices to avoid copyright infringement:
- Domain names: choose one that does not infringe on existing trademarks. Avoid using names that are identical or similar to registered trademarks, as this can lead to legal disputes
- Trademark searches: Before selecting a brand name, logo, or other identifier, check for existing trademarks to avoid potential conflicts
- Affiliate Marketing: If engaging in affiliate marketing, be cautious about using trademarks in a way that could create confusion or imply an affiliation with the trademark owner
Requirements unique to eCommerce websites
Along with the other issues mentioned above, eCommerce website owners need to be aware of legal requirements that are specific to their websites. Online stores have unique regulatory requirements to ensure secure and fair online transactions.
Key among these is compliance with the Payment Card Industry Data Security Standard (PCI DSS), which is essential for securely processing credit card transactions. To achieve this, eCommerce website owners must implement encryption, maintain secure networks, exercise access control, and conduct regular security assessments, all aimed at ensuring payment safety and data breach prevention.
Ecommerce websites must also adhere to specific consumer protection laws, such as the FTC Act. Under these laws, online store owners need to ensure they are providing clear information about products, transparent pricing, and accurate descriptions, as well as enacting policies for returns and refunds.
Finally, eCommerce operations must comply with sales tax collection laws, which vary by country and, in the U.S., by state. For international sales, understanding and adhering to export laws and customs regulations is crucial, as is compliance with specific shipping and labeling standards.
Important note: These are just a few of the laws pertaining to eCommerce websites.
Industry-specific regulations
Depending on the industry you operate in, you may need to be aware of further legal requirements.
If you operate within the healthcare industry, for example, and own a website that handles Protected Health Information (PHI) in the United States, you need to comply with the Health Insurance Portability and Accountability Act (HIPAA). Complying with this law entails adhering to the Privacy Rule for protecting personal health information, implementing robust security measures as per the Security Rule, and following the Breach Notification Rule in case of data breaches.
Websites that handle Protected Health Information (PHI) in the United States must also ensure secure patient communication channels and online forms, and have Business Associate Agreements (BAAs) with third-party service providers handling PHI. Additionally, HIPAA restricts the use of PHI for marketing purposes without explicit patient authorization.
Another example of an industry with specific legal requirements for websites is the Fintech industry.
Fintech companies are primarily governed by the Gramm-Leach-Bliley Act (GLBA) and the Payment Card Industry Data Security Standard (PCI DSS). The GLBA mandates that financial institutions safeguard sensitive data and inform customers about their information-sharing practices, ensuring consumer financial privacy. Meanwhile, PCI DSS sets global security standards for all entities handling credit card information, requiring stringent measures to protect cardholder data.
Compliance with these regulations is critical for fintech companies to ensure the security of financial transactions, maintain customer trust, and avoid legal penalties.
Legal best practices for your website
Achieving full compliance with the laws mentioned above (when they apply to you and your website) can seem daunting. However, by following best practices, the task becomes far more straightforward and achievable. To that end, here are a few best practices you should follow.
Important note: Carrying out some of these action items is mandated under certain laws, and are therefore not merely suggestions.
Create a Terms of Use and Conditions section
While it isn’t a legal requirement, it is important to create a Terms of Use and Conditions section on your website. These set forth the rules for use of your website. This can appear as a dedicated web page or within another relevant page.
A Terms of Use and Conditions section can provide you with:
- User guidelines: The section sets clear rules for how users can interact with your website
- Disclaimer limiting liability: A Terms and Conditions section can limit your liability by providing that the site owner is not responsible for providing content that is accurate, complete, or suitable for any purpose or if users engage with your site unlawfully
- Copyright protection: It helps clarify the ownership of the content on your website
- Compliance with platform requirements: Some third-party platforms or services require Terms and Conditions for usage
- Enforceability: Terms and Conditions can be enforceable in court (in some cases), providing a legal basis in disputes
Accessibility considerations for your Terms of Use and Conditions page or section:
Ensure the Terms and Conditions section is accessible to all website visitors, including those with disabilities. Use descriptive ​​headings, proper formatting, and alternative text for images to enhance readability through screen readers. Additionally, provide an easily accessible link to the Terms and Conditions from various parts of your website, using descriptive anchor text like "Terms and Conditions" or "Legal Information.”
Protect yourself when incorporating user-generated content
User-generated content (UGC) refers to any content such as text, images, videos, reviews, or discussions that are created and shared by users rather than the website or platform itself. When incorporating user-generated content on your website, it's crucial to understand legal protections and responsibilities.
Under American law, the Digital Millennium Copyright Act (DMCA) provides a safe harbor from copyright infringement claims, as long as you adhere to specific procedures like implementing a DMCA takedown process. Additionally, Section 230 of the Communications Decency Act offers immunity from liability for user-created content, a key protection for websites hosting such material. However, these protections have limitations; for example, the DMCA requires prompt responses to takedown notices, and Section 230 does not shield against federal criminal liability or intellectual property claims.
Feature an accessibility statement
Accessibility statements declare your website’s conformance with relevant web accessibility guidelines like WCAG, and prove your commitment to inclusivity and compliance with web accessibility legislation.
Accessibility statements are usually displayed as links in a website's footer section, appearing alongside other standard information such as a privacy policy and terms of service. Accessibility statements can also appear within accessibility widgets, such as accessWidget. Website visitors will be able to view the accessibility statement when interacting with accessWidget’s user interface, and by clicking on the ‘Statement’ button.
You can learn more about accessibility statements, their structure, and how to write one, by pressing here.
If you need to comply with Section 508 of the Rehabilitation Act or the AODA, featuring an accessibility statement is not merely a best practice, but rather a legal requirement.
Additionally, many website features opt to feature an accessibility statement as part of their efforts to comply with the ADA.
Pay attention to your other digital presences
If you run an online business, there’s a good chance your digital presence goes beyond your website. If you run online ads and conduct email marketing campaigns, there are legal aspects you should be aware of:
Website owners should be aware of the CAN-SPAM Act in the U.S. for email marketing, which requires clear messaging and an opt-out option. It mandates that commercial emails must include clear and accurate information in the header, subject line, and body. It also necessitates providing recipients with an option to opt-out and honoring those requests promptly. The Act also requires the inclusion of a physical postal address in the email.
The General Data Protection Regulation (GDPR) is broader and covers the processing of personal data of individuals within the European Union (EU). It emphasizes obtaining explicit consent for collecting and processing personal data, including email addresses. Individuals have the right to access their data, request its deletion, and have transparent information about how their data is being used.
For paid ads, adherence to FTC guidelines is crucial. These guidelines mandate clear disclosure of paid endorsements or sponsored content. Complying with specific platform standards like Google Ads and Facebook is also important. This is essential not only for legal reasons but also for maintaining credibility with website visitors.
Closing thoughts
Navigating the legal landscape as a website owner can be a complex undertaking, with numerous regulations and responsibilities to consider. From the well-known GDPR to often-overlooked aspects like web accessibility laws, the spectrum of legal requirements is substantial. However, it is crucial not to be overwhelmed. Properly researching the topic can provide you with important insights to help you comply fully with relevant laws, and find the right tools and platforms to help you maintain compliance.
