Selling online adds three obligations at once
A checkout is the highest-consequence accessibility surface a business owns, because a barrier there is a customer who cannot buy. Selling also brings payment card obligations and, if you take subscriptions, disclosure rules about how people cancel.
Why people arrive here
Frequently a demand letter naming the checkout specifically, because that is where automated scanning finds the most. Sometimes a payment processor asking about card handling, or a chargeback pattern that turns out to be a cancellation flow nobody could complete.
What bites hardest
These are the same obligations every business website carries. In this sector they are the ones that produce letters first.
ADA web accessibility
Title III of the Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities. The Department of Justice takes the position that this reaches the websites of businesses open to the public, and has published guidance saying so.
European Accessibility Act
The European Accessibility Act sets common accessibility requirements for a defined list of products and services, including e-commerce, banking, transport, and electronic communications. It applies to businesses placing those products or services on the EU market, regardless of where the business itself is established.
CCPA and CPRA
California privacy law gives consumers rights over personal information a business collects about them, and imposes duties on businesses that meet one of three thresholds. It is enforced by the California Privacy Protection Agency and the Attorney General.
Cookie consent
Rules about storing information on a visitor device, and about the tracking that storage enables. In the EU and UK the relevant rule comes from the ePrivacy Directive as implemented nationally, alongside the GDPR standard for consent. In the US the question is framed through state privacy statutes and their opt-out rights.
Session replay and wiretapping
Session replay tools record a visitor interactions with a page, including mouse movement, scrolling and keystrokes, and send them to a vendor for playback. Chat widgets often route conversations through a third party too. A substantial volume of litigation argues that doing either without consent is interception of a communication under state wiretap law.
Sector rules to watch
These reach this sector specifically and have no page in the library yet. Each one is a question for a lawyer who knows your business.
- PCI DSS
If your site is involved in taking card payments, the payment card standard applies to you, and how much of it applies depends on how the payment is handled. A hosted payment page from your processor keeps far more of the standard off your site than a form you built yourself.
PCI Data Security StandardPCI Security Standards Council
- Automatic renewal and cancellation rules
California has an automatic renewal law requiring clear disclosure of renewal terms and a straightforward way to cancel, and several other states have similar statutes. Federal rulemaking in this area has been actively litigated, so the durable point is the state law rather than the current federal position.
California Business and Professions Code sections 17600 to 17606California Legislative Information
What WebSpark does
- The checkout and every form in it are tested with a keyboard and against WCAG 2.2 AA on every change, because that is where an accessibility barrier costs you revenue directly.
- Payments are routed to a hosted page from your processor wherever possible, which keeps card data off your site and most of the payment standard with them.
- Every page tested against WCAG 2.2 AA before it publishes, with a dated record of what was found.
- Consent that matches the region a visitor is in, with nothing third-party loading before a grant.
- Data requests logged with their arrival date and tracked against the statutory deadline.
- A monthly operations record you can hand to a customer, an insurer or a funder.
What stays yours
- Your payment processor relationship, your card handling scope, and any self-assessment questionnaire that comes with it.
- The commercial terms of a subscription, including what you disclose at the point of sale.
- Product data and fulfillment, which live in your commerce platform.
WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business and your state.