Compliance
Most of these reach an ordinary business website, and most owners have never been told which ones. WebSpark describes obligations and evidences what a site does. It does not provide legal advice.
Title III of the Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities. The Department of Justice takes the position that this reaches the websites of businesses open to the public, and has published guidance saying so.
The Web Content Accessibility Guidelines are a technical standard published by the W3C describing how to make web content usable by people with disabilities. Version 2.2 is current, and Level AA is the conformance level regulators, procurement teams and courts generally treat as the target.
An overlay is a script you add to a site that presents visitors with a toolbar of display preferences, such as larger text or higher contrast, and attempts some automatic repairs to the page. It is sold as a fast route to accessibility compliance.
The Unruh Civil Rights Act guarantees full and equal access to the accommodations and services of all business establishments in California. It provides for statutory damages, and a violation of the Americans with Disabilities Act is also a violation of the Unruh Act under California law.
The European Accessibility Act sets common accessibility requirements for a defined list of products and services, including e-commerce, banking, transport, and electronic communications. It applies to businesses placing those products or services on the EU market, regardless of where the business itself is established.
California privacy law gives consumers rights over personal information a business collects about them, and imposes duties on businesses that meet one of three thresholds. It is enforced by the California Privacy Protection Agency and the Attorney General.
Beyond California, a substantial and growing number of US states have enacted comprehensive consumer privacy laws. They share a common core, drawn largely from the Virginia model, and differ on thresholds, definitions, cure periods and enforcement.
The General Data Protection Regulation governs the processing of personal data about people in the EU. It applies to organizations established in the EU, and to organizations outside it that offer goods or services to people in the EU or monitor their behavior.
Rules about storing information on a visitor device, and about the tracking that storage enables. In the EU and UK the relevant rule comes from the ePrivacy Directive as implemented nationally, alongside the GDPR standard for consent. In the US the question is framed through state privacy statutes and their opt-out rights.
A data subject request, or consumer request, is somebody exercising a legal right over the personal information you hold about them: to know what you have, to get a copy, to correct it, to delete it, or to opt out of its sale or sharing.
Session replay tools record a visitor interactions with a page, including mouse movement, scrolling and keystrokes, and send them to a vendor for playback. Chat widgets often route conversations through a third party too. A substantial volume of litigation argues that doing either without consent is interception of a communication under state wiretap law.
A legal duty to tell affected people, and often a regulator, after personal information you hold has been acquired by somebody who should not have it. Every US state has such a law, and so do the EU and UK under the GDPR.