Small business website compliance checklist: accessibility, privacy, cookies and email

1. Accessibility

Make your pages usable by people with disabilities, which means testing against WCAG. This is the part Clir tests: start with the ADA website compliance checklist and a free scan. If you sell to consumers in the EU, read the European Accessibility Act guide.

2. Privacy policy

If your site collects personal information (contact forms, newsletter sign-ups, orders, analytics), publish a privacy policy that says what you collect, why and how people can ask about it. California's Online Privacy Protection Act requires a conspicuously posted privacy policy for commercial websites that collect personal information from California residents (Cal. Bus. & Prof. Code 22575). Other states and countries have their own rules.

3. Cookies and tracking notices

For visitors in the EU, rules implementing the ePrivacy Directive (Article 5(3)) generally require consent before storing or reading non-essential cookies (Directive 2002/58/EC). Whether you need a banner depends on who visits and what you use. A consent tool or an attorney can confirm. Clir focuses on accessibility; for cookies, rely on your consent tool and an adviser.

4. Email marketing

In the U.S., the CAN-SPAM Act requires commercial email to have accurate sender information, a valid physical postal address and a clear way to opt out that you honor promptly. The FTC publishes a plain compliance guide for business.

5. Payments and security

Use a reputable payment provider that handles card data, serve your site over HTTPS and keep your platform, themes and plugins updated. Clir focuses on accessibility; use your platform's security tools for security.

6. Terms, refunds and contact

Publish clear terms of sale, a refund or returns policy and a real way to contact you. Customers and payment providers expect them.

How to use this checklist

This list covers common areas small businesses are asked about. It is general information, not legal advice, and requirements depend on where you operate and who your customers are. Use it to know what to ask, then confirm details with a lawyer or the official sources linked in each section. Clir is built for accessibility; privacy, cookies, email rules, payments and security each have their own tools and advisers.

What to prepare for each area

Accessibility in this wider context

Accessibility sits alongside these other areas, and customers feel it more directly than most. A privacy policy that no one can read or a cookie banner that traps the keyboard is a problem on both counts. When you update your policies and banners, test them with a keyboard and at high zoom. See keyboard focus and zoom and reflow.

A sensible order of work for a new business

1. Publish clear contact details, terms, delivery and returns information.
2. Add a privacy policy that matches what you actually do with data.
3. Set up a cookie notice only for the tools you really use, and make it usable with a keyboard.
4. Make email sign-up clear, with honest wording and an unsubscribe link.
5. Check your site for accessibility and publish an honest statement.
6. Review all of this twice a year, and when you add a new tool.

When to get professional help

If you collect sensitive data, sell across borders, process children's information or have received a legal letter, speak to a qualified professional. A short consultation is often worth the cost, and a lawyer can tell you which rules actually apply to you.

Plain-language notes on each area

Privacy policy

A privacy policy tells visitors what personal information you collect, why, how long you keep it, who you share it with and how they can contact you or exercise their rights. Many jurisdictions require one if you collect personal data, and many third-party services, such as payment providers and advertising platforms, require you to have one. Write it to match what you actually do, in language a customer can read. Review it when you add a new tool.

Cookie notices

Whether you need a notice, and what kind, depends on where your visitors are and what you use cookies for. Rules in the EU and UK are stricter than in most U.S. states, and some U.S. states have their own privacy laws. A notice that cannot be used with a keyboard or that covers the whole screen on a phone is a barrier, so choose a tool that works for everyone and test it.

Email marketing

In the U.S., the CAN-SPAM Act sets rules for commercial email, including accurate sender information, a physical postal address and an easy way to opt out. Other countries have their own rules, often with stricter consent requirements. Keep records of when and how people agreed to hear from you.

Payments and security

Use a reputable payment provider that handles card data for you, so that your site never stores card numbers. Keep your platform and plugins updated, use strong passwords and two-factor authentication on admin accounts and back up your site.

Terms, refunds and contact

Clear terms, a straightforward returns policy and visible contact details build trust and reduce disputes. Make them easy to find, written in plain language and accessible in the same way as the rest of your site.

Keeping pages readable and usable

Policy pages tend to be long. Make them easier to use by adding a clear heading structure, short paragraphs, descriptive links and a table of contents if the page is long. Avoid putting policies in images or in documents that cannot be read by assistive technology. See heading structure.

A calendar for the year

A worked example: a new online shop

A potter opens an online shop selling mugs and bowls to customers in the U.S. and the UK. She builds a short checklist from this guide. She publishes terms, delivery and returns pages. She writes a privacy policy that says she collects names, addresses and emails to fulfil orders, shares details only with her payment provider and courier, and keeps order records for the time her accountant advises. She uses a cookie notice because she uses an analytics tool, and she tests that it works with a keyboard. She adds a newsletter sign-up that clearly says what subscribers will receive and includes an unsubscribe link in every email.

For accessibility, she scans her pages, fixes missing labels and contrast, writes alternative text for her product photos and publishes a short statement with her email address. Each item is recorded in a notebook with a date. When a customer later asks about accessibility, she has an answer and a record. The whole exercise takes her a few evenings.

Signs you need advice sooner

• You receive a legal letter or a complaint from a regulator.
• You plan to collect health, financial or children's data.
• You will sell into a new country with different consumer or privacy rules.
• You are selling to government or education customers who ask for formal documents.
• You are unsure whether an exemption applies.

In each case, a short consultation with a qualified professional is usually better value than guessing. Use this guide to prepare good questions.

What a simple record looks like

The last item in the checklist is a record. It does not need special software. A shared folder with a few documents is enough, so long as someone keeps it up to date. The point is to be able to answer questions quickly, and to show that you have paid attention.

Common mistakes small businesses make

• Copying a policy from another site that does not match how they work.
• Adding a cookie banner that sets cookies before consent, or that cannot be used with a keyboard.
• Promising in a policy something they do not do, such as deleting data on request without a process.
• Ignoring emails about accessibility, because they seem unimportant.
• Letting policies go out of date after changing tools.
• Assuming a platform handles all the legal requirements automatically.

Where to go for official guidance

For the U.S., the Federal Trade Commission publishes plain-language business guidance on privacy, email marketing and advertising. For the EU, national data protection authorities and the European Commission publish guidance on data protection and consumer rules. For accessibility, the U.S. Department of Justice publishes web guidance and the W3C publishes guidance on the standards. These sources are better than a blog post for the details, and they are free to read.

Frequently asked questions

• Do I need all of this for a small site? The scale differs, but most sites need clear contact details, terms, a privacy statement that matches reality and an accessible experience.
• Can I use a template for my privacy policy? A template is a starting point. Edit it to match what you do, and have a professional review it if your data use is complex.
• What if I use a platform that handles payments? You still need to explain how you use personal data, and your platform's terms may require specific wording.
• How often should I review everything? Twice a year, and when you add a new tool, market or product line.
• Who in my business should own this? One named person. Ownership matters more than seniority.

The accessibility part, in three lines

Scan your main pages and fix what you find. Test checkout with a keyboard. Publish an honest statement with a working contact. See the ADA website compliance checklist for the full routine and the statement guide for the wording.

A note on tools that promise everything

Be wary of any single product that claims to handle accessibility, privacy, cookies and security together. These are separate areas with separate rules and separate checks. A scanner for one does not replace a review of another. Choose tools for what they actually test, and read what they say they do not.

A one-page version to print

1. Contact details, terms, delivery and returns pages are live and easy to find.
2. A privacy policy matches what the business does with personal data.
3. A cookie notice exists if needed, and works with a keyboard.
4. Email sign-ups are clear and have an unsubscribe link in every message.
5. Payments run through a reputable provider; admin accounts use strong passwords and two-factor sign-in.
6. The site has been scanned and tested by hand, fixes are logged and a statement is published.
7. Everything is reviewed twice a year, and after any big change.

Stick the list where you will see it, and tick items off with a date. It is a modest tool, but it turns a vague worry into a routine.

7. Keep a record

Date your policies, save accessibility scan results and note changes. When something changes (a new app, a new market), check which of the items above it touches. For website changes, use the redesign and maintenance checklist.