Exempt from some privacy law, and from none of the accessibility law
Nonprofits are outside the scope of several state privacy statutes, which is genuinely useful and frequently over-read. Accessibility obligations do not carry that exemption, and funders increasingly ask about both.
Why people arrive here
Almost always a grant application or a funder diligence questionnaire asking whether the website is accessible, followed by the discovery that nobody can answer it. Occasionally a demand letter, because a nonprofit serving the public is a public accommodation.
What bites hardest
These are the same obligations every business website carries. In this sector they are the ones that produce letters first.
ADA web accessibility
Title III of the Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities. The Department of Justice takes the position that this reaches the websites of businesses open to the public, and has published guidance saying so.
WCAG 2.2 AA
The Web Content Accessibility Guidelines are a technical standard published by the W3C describing how to make web content usable by people with disabilities. Version 2.2 is current, and Level AA is the conformance level regulators, procurement teams and courts generally treat as the target.
Data requests
A data subject request, or consumer request, is somebody exercising a legal right over the personal information you hold about them: to know what you have, to get a copy, to correct it, to delete it, or to opt out of its sale or sharing.
Cookie consent
Rules about storing information on a visitor device, and about the tracking that storage enables. In the EU and UK the relevant rule comes from the ePrivacy Directive as implemented nationally, alongside the GDPR standard for consent. In the US the question is framed through state privacy statutes and their opt-out rights.
Sector rules to watch
These reach this sector specifically and have no page in the library yet. Each one is a question for a lawyer who knows your business.
- Nonprofit exemptions vary by state
Several state privacy statutes exempt nonprofit organizations outright, some exempt them only partially, and others do not exempt them at all. Whether you are covered is a question about each state you operate in rather than a single answer, and the exemptions have been narrowing.
US State Privacy Legislation TrackerInternational Association of Privacy Professionals
- Federal funding and Section 508
Organizations receiving federal funds may take on accessibility obligations through the terms of that funding, and federal agencies procure against Section 508 standards. Where a grant references accessibility, the reference is usually to the same technical standard the rest of this library points at.
Section 508 standardsUS Access Board
What WebSpark does
- A funder diligence form asks for a dated accessibility record. One is produced monthly, so the answer exists before the question arrives.
- Donation and sign-up forms are tested with a keyboard and a screen reader, because a form that excludes people is the part of an inaccessible site that costs you directly.
- Every page tested against WCAG 2.2 AA before it publishes, with a dated record of what was found.
- Consent that matches the region a visitor is in, with nothing third-party loading before a grant.
- Data requests logged with their arrival date and tracked against the statutory deadline.
- A monthly operations record you can hand to a customer, an insurer or a funder.
What stays yours
- Establishing whether a state exemption applies to you, which turns on the state and on what you do.
- Terms attached to your funding, which may impose obligations beyond anything general law requires.
- Your donor database and email platform, which are separate systems holding more than the website does.
WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business and your state.