Regulatory agencies and governments have finally caught up to the digital age. Now, it’s your turn to play catch up. With the thousands of rules, guidelines and regulations on the books, how do you know which to follow? A lack of knowledge of the law is not a defense the courts — or the public — will accept. These eight web compliance laws are a great place to start.
1. The Consumer Review Fairness Act
The Consumer Review Fairness Act protects consumers’ right to share honest opinions about a business’s services, products or conduct. The Business Opportunity Rule requires sellers to give prospective buyers accurate, specific information to help them evaluate a purchase properly before committing.
The United States Federal Trade Commission (FTC) uses these laws to combat deceptive or unfair uses of artificial intelligence with Operation AI Comply. For e-commerce websites, this means using generative AI to create fake reviews, misleading summaries or false answers is illegal. Violations will result in hefty fines.
2. Language Access Laws
Is your website only available in English? What about your communications with employees? Unless you operate internationally, it may never have occurred to you to post in multiple languages. It is good that you are brushing up on website compliance because there are various statutory and regulatory requirements.
There are no comprehensive laws that explicitly require websites to offer translations. However, broad regulations like the General Data Protection Regulation (GDPR) have many provisions for plain language. Technically, there are several circumstances in which you may have to display content like privacy policies or cookie consent forms in a language other than English.
There are also posting requirements regarding labor laws like the Fair Labor Standards Act and the Family and Medical Leave Act to consider. For example, the fine for not properly posting the “Know Your Rights: Workplace Discrimination is Illegal” poster was $680 per violation in 2023.
If a significant portion — typically 5% to 10% — of your workplace is not proficient in English, your employer must provide the notices in the language they speak. The specifics vary by location.
There are specific language requirements in some states and cities. For example, San Francisco’s Fair Chance Ordinance must be posted in English, Chinese and Spanish, regardless of the percentage of the workplace that speaks those languages.
There’s a good chance you — or a good portion of your company’s workforce — work remotely. Fortunately, the requirements for posting are flexible, and doing so electronically is fine in most cases. You can email posters to workers instead of physically putting them up at each workplace or jobsite.
3. Guides Against Deceptive Pricing
The Code of Federal Regulations (CFR) contains all permanent federal and regulatory rules. Pay special attention to 16 CFR Part 233 — the Guides Against Deceptive Pricing. E-commerce companies should consider the language they use and the misleading comparisons they make.
Even claiming you sell something under the retail value can be considered deceptive if the higher price is not typical in the area where your customers shop.
Artificially or fictitiously increasing prices to make discounts seem larger is common — but that does not make it legal. It is considered misleading, deceptive or unfair, which falls under the FTC’s jurisdiction. Even if you temporarily increase the price before dropping it, the action is still unlawful because it is not considered in good faith.
4. Unfair or Deceptive Acts or Practices
Despite sounding like a textbook compliance violation, price discrimination is not technically illegal. Businesses can generally charge customers different prices for the same product or service based on the belief that they can increase profits this way. Using specific attributes or characteristics to group consumers into segments is also lawful.
However, section 5(a) of the Federal Trade Commission (FTC) Act — Unfair or Deceptive Acts or Practices — and the Robinson-Patman Act prohibit certain types of price discrimination. Companies cannot knowingly use price differences to dominate markets through predation.
If there is a chance that price discrimination injures competition — which means websites that sell products of like grade and quality, legally speaking — the practice becomes unlawful. The federal government does not want organizations to outprice others because it may create a monopoly.
5. Payment Card Industry Data Security Standard
The Payment Card Industry Data Security Standard (PCI DSS) is a set of policies for securing online transactions. It was created over two decades ago by five major credit card companies to protect cardholders’ information. The PCI Security Standards Council (SSC) developed the guidelines.
PCI DSS is typically part of the contractual obligations you make when agreeing to process and store credit and debit card information. While compliance is not required by federal law, it is mandated by the PCS SSC. Also, some states have effectively incorporated this standard into state laws.
Don’t consider this technicality a pleasant surprise — the council’s members include American Express, Discover Financial Services, MasterCard, UnionPay, Visa Inc. and JCP International. Noncompliance can land you on the Member Alert to Control High-Risk Merchants (MATCH) list.
The MATCH list is a record of blacklisted merchants whose payment processing privileges have been revoked. Could you imagine running an e-commerce website that can’t accept major credit card brands? Other consequences include fines imposed by card issuers and lawsuits by states that enforce compliance.
A good rule of thumb is to leave PCI DSS compliance to the experts on your business’s behalf. Building, securing, monitoring and auditing multiple systems and databases is time-consuming at best. Notably, you may not always be able to rely on a third party. You must also maintain compliance if any cardholder information passes through your servers.
6. Online Identifiers for Profiling and Identification
The GDPR is the most comprehensive data protection legislation developed to date. Since cookies are considered personal information under Recital 30 — Online Identifiers for Profiling and Identification — they can be regulated under this law. It makes sense, considering cookies store enough data to identify users without consent.
Websites must provide a cookie consent notice as soon as users load in. Under the GDPR, it is illegal to use any — except strictly necessary cookies — without receiving explicit, informed consent. Web developers must provide accurate, specific information on each cookie’s purpose in plain language. Additionally, they must allow access even if the user refuses all cookies.
Even if e-commerce websites operate exclusively in the U.S., they must still comply. After all, there is no way to guarantee no citizen from the European Union will shop on their website. A good rule of thumb is to keep a small icon continuously visible to allow users to view and change their preferences at any point on their journey.
7. Web Content Accessibility Guidelines
The Web Content Accessibility Guidelines (WCAG) is an international standard for making web content accessible to people with disabilities. For example, it recommends providing captions for multimedia, avoiding flashing lights that may induce seizures, allowing assistive technologies to interpret content and making all functionality available from a keyboard.
While WCAG is not a legal requirement, many laws and regulations reference it since it is a widely accepted international standard. This is fundamental to website compliance. Web developers should consult it directly instead of parsing through various regulations to ensure nothing gets lost in translation.
8. Americans With Disabilities Act
You likely already know of the Americans with Disabilities Act (ADA) — the law that prohibits discrimination against people with disabilities. However, you might not have known it applies to websites.
According to Chapter 126 in 42 U.S.C. 12182 — Equal Opportunity for Individuals With Disabilities — no one can be discriminated against on the basis of disability. Businesses open to the public must provide complete and equal access to goods, services, privileges and advantages. If not, fines, regulatory investigations and class action lawsuits are fair game.
While courts are split on whether a website counts as a public accommodation under the ADA, the Civil Rights Division of the U.S. Department of Justice has consistently taken the stance that it does. It states the ADA’s requirements extend to all activities, services, goods and privileges offered on the internet.
The E.U. has a similar law. EN 301 549 is the European Standard of Accessibility for information and communications technology. It covers websites, software, mobile apps and electronic documents in both the public and private sectors. It states that organizations in Europe must make their digital technology accessible.
The European Accessibility Act is another accessibility rule that applies to E.U. websites. It will become enforceable by June 2025. At this point, noncompliance will likely result in fines and penalties. Web developers can prepare by following guidelines from the WCAG.
Only microenterprises — organizations with fewer than 10 employees and an annual turnover of under 2 million euros — will be exempt from the European Accessibility Act.
Maintaining Web Compliance Requires Ongoing Effort
Rules, regulations and standards are subject to change. As soon as you become fully compliant, you may have to pivot. It can be frustrating, but avoiding fines and maintaining your company’s reputation is worth the effort. Ensure you regularly revisit these laws to see if there are relevant updates so your company can operate with confidence.
Eleanor Hecks is Editor-in-Chief of Designerly Magazine. She specializes in writing on web design and development topics for sites such as Smashing Magazine, freeCodeCamp, and more.
