You will find out through a customer questionnaire
For a consultancy or agency, the website is a credibility surface rather than a transaction one. The obligations arrive sideways, through a client asking you to prove something about it before they sign.
Why people arrive here
An enterprise customer sending a vendor assessment or a security questionnaire, with a section about accessibility and a section about data handling, and nobody internally able to answer either.
What bites hardest
These are the same obligations every business website carries. In this sector they are the ones that produce letters first.
ADA web accessibility
Title III of the Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities. The Department of Justice takes the position that this reaches the websites of businesses open to the public, and has published guidance saying so.
CCPA and CPRA
California privacy law gives consumers rights over personal information a business collects about them, and imposes duties on businesses that meet one of three thresholds. It is enforced by the California Privacy Protection Agency and the Attorney General.
Breach notification
A legal duty to tell affected people, and often a regulator, after personal information you hold has been acquired by somebody who should not have it. Every US state has such a law, and so do the EU and UK under the GDPR.
Data requests
A data subject request, or consumer request, is somebody exercising a legal right over the personal information you hold about them: to know what you have, to get a copy, to correct it, to delete it, or to opt out of its sale or sharing.
Sector rules to watch
These reach this sector specifically and have no page in the library yet. Each one is a question for a lawyer who knows your business.
- Contractual accessibility commitments
Enterprise and public-sector contracts increasingly require a conformance statement about your own web properties. That is a contractual obligation rather than a statutory one, which means it is enforced by the customer rather than a regulator, and it arrives with a deadline.
Developing an accessibility statementW3C Web Accessibility Initiative
What WebSpark does
- Security questionnaires are answered on your behalf on plans that include it, from a published architecture page that answers the technical sections directly.
- The accessibility statement and the monthly record are the two documents a vendor assessment asks for, and both exist before anybody asks.
- Every page tested against WCAG 2.2 AA before it publishes, with a dated record of what was found.
- Consent that matches the region a visitor is in, with nothing third-party loading before a grant.
- Data requests logged with their arrival date and tracked against the statutory deadline.
- A monthly operations record you can hand to a customer, an insurer or a funder.
What stays yours
- Everything the questionnaire asks about systems other than the website: your laptops, your email, your access control.
- Any commitment you make in a contract, which may exceed what general law requires.
WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business and your state.