ESTIMATED READ TIME: 6 minutes
Most websites have legal exposure their owners don’t know about.
That’s not a scare tactic. It’s what I keep running into after maintaining and building websites for businesses and agencies for 15 years. The risks are real, they’re growing, and the most common “solutions” people reach for often don’t actually fix them.
This post walks through what those risks are, what the law actually says (as best I can explain as a developer, not a lawyer), and what risk reduction looks like in practice.
Fair warning: this is long. I’d rather be honest and specific than short and vague.
A quick disclaimer before we get into it
I’m a web developer. I’ve been building and maintaining WordPress sites for over 15 years, and I’ve watched the legal landscape around websites change significantly. What I share here reflects that experience and a lot of reading. It is not legal advice. If you have specific concerns about your website’s legal exposure, talk to an attorney who knows internet law in your jurisdiction. What I can help with is the technical side: identifying issues, implementing fixes, and setting up the right tools.
Why this is worth paying attention to now
A few years ago, most small businesses could reasonably think: these compliance issues are for big companies. That’s changed.
In 2025, more than 3,100 web accessibility lawsuits were filed in federal court, a 27% increase from 2024 and the highest total in three years. When state court filings are included, that number exceeds 5,000. Cookie tracking without proper consent generated over 1,000 lawsuits in California alone in 2025, under a state privacy law that predates most of the modern frameworks. And across all of it, the two biggest issues I see are either people ignoring the problem, or they think they’re protected because they installed one plugin a long time ago.
They were mistaken.
The three areas that matter most
1. Accessibility
Courts have consistently ruled that business websites fall under Title III of the Americans with Disabilities Act, the section that covers places of public accommodation. The standard most courts and plaintiff attorneys reference is WCAG 2.1 Level AA, a set of technical guidelines for making web content usable by people with visual, hearing, motor, and cognitive disabilities.
Lawsuits are filed over things like:
- Missing labels on form fields (a screen reader can’t identify what the field is for)
- Images without alternative text
- Poor color contrast that makes text unreadable for people with low vision
- Navigation that only works with a mouse, not a keyboard
- Videos without captions
The common issues aren’t exotic. They show up in ordinary web builds when accessibility isn’t part of the process.
The plugin problem. If you’re thinking the solution is an accessibility widget, a word of caution. In April 2025, the FTC fined AccessiBe $1 million for making deceptive claims about what their overlay tool actually does. Over 800 businesses using overlay tools like AccessiBe, UserWay, and EqualWeb were sued in 2023-2024. In the first half of 2025, nearly a quarter of all web accessibility lawsuits targeted sites that had an overlay widget installed. Courts consistently reject overlay installation as evidence of ADA compliance, and many settlement agreements specifically require removing the overlay and doing real remediation.
Automated tools can catch some issues. They can’t fix underlying code, and they don’t make a site accessible for the people who need it to be. There’s no substitute for building accessibility in from the start and testing with real users and assistive technology.
2. Privacy policies and data collection
If your website has a contact form, an analytics tool, a chat widget, or a newsletter signup, it’s collecting personal data. That data has to be disclosed.
Here’s the version that applies to almost every business regardless of size or state: virtually every major analytics and tracking tool (Google Analytics, Meta Pixel, HubSpot, etc.) requires you to have a privacy policy in its terms of service. If you’re running Google Analytics without one, you violate your agreement with Google, not just potentially with the law.
On the legal side, the landscape is more complicated. California’s CPRA applies to for-profit businesses that meet specific revenue or data volume thresholds, so not every small business is directly subject to it. But a growing number of states have passed their own privacy laws, and the trajectory is toward more requirements, not fewer.
What I tell clients: if you collect any data at all, and you do, you need a privacy policy that accurately describes what you collect, how you use it, who you share it with, and how users can request that their data be deleted. That policy needs to match what your site actually does today. A generic template from 2019 that hasn’t been touched since doesn’t cut it.
3. Cookie consent
Cookies are where things get the most complicated, because different laws apply in different places and the legal landscape is still actively developing.
GDPR, the EU regulation, has required active consent before any non-essential cookies are set since 2018. If your website has European visitors, this applies to you. Users have to actively accept before tracking begins. Pre-checked boxes and buried settings don’t count.
In the US, California’s Invasion of Privacy Act (CIPA) is where the most significant litigation pressure has been. Over 1,000 lawsuits were filed under CIPA in 2025 alone, targeting businesses that use session replay tools, analytics pixels, and tracking scripts that share data with third parties before getting consent. I personally know one agency that has fallen into this category. They were able to settle outside of court, but it still cost them a significant price to do so.
A California bill that would have narrowed the law’s scope failed to advance in 2025. That said, this area is genuinely unsettled. In April 2026, a California court rejected “trap and trace” cookie claims in one case, and courts are not ruling uniformly for plaintiffs. I mention this because I want to be accurate: the risk is real and the litigation volume is high, but this isn’t resolved law. It’s worth watching, and it’s worth not making it worse by running tracking without any consent framework at all.
The bigger problem with most cookie banners: They’re configured wrong. Most cookie consent plugins, set up the way most people set them up, still load tracking scripts before the user accepts anything. If the cookies fire before consent is given, the banner is a checkbox exercise, not actual consent management.
The thing most people get wrong
They install a plugin and stop thinking about it.
- An accessibility widget doesn’t fix missing alt text or broken keyboard navigation.
- A cookie consent banner that fires tracking scripts before acceptance doesn’t protect you.
- A generic privacy policy template that doesn’t describe what your site actually does is potentially worse than nothing, because it makes a false representation.
These tools are part of the picture. They’re not the picture.
Real risk reduction means understanding what your site actually does, fixing the underlying issues, setting up the right tools correctly, and revisiting all of it when the site changes, because your site is always changing.
What “risk reduction” actually looks like
I want to be careful about how I frame this, because a lot of content on this subject oversells what’s achievable.
You cannot guarantee that your website won’t be the subject of a lawsuit. You can reduce the likelihood and put yourself in a much better position if one does come. There’s a meaningful difference between a business that has made a good-faith effort to address accessibility and data privacy, and one that has done nothing. Courts and regulators notice that difference.
Practically, risk reduction means:
- An honest audit of what your site does, what data it collects, what tools it uses, and what issues exist.
- Fixing the underlying issues, not just installing a tool on top of them.
- Having accurate, site-specific policies in place: privacy policy, cookie policy, terms of service, and a disclaimer where relevant.
- Setting up cookie consent correctly so tracking actually waits for consent.
- Revisiting all of the above when the site changes.
Who this applies to
If your business has a website and it serves customers in the US (accessibility), has any European visitors (cookie consent under GDPR), is based in California or serves California customers (CPRA and CIPA), or uses any analytics tool at all (privacy policy per vendor terms), most of what I’ve described applies to you.
The practical answer: if you’re running a business website, assume it applies and work from there.
One more thing for agencies
If you manage websites for clients, or if you built the site they’re currently running, this is worth your attention too. When a client’s site has a compliance issue and a lawsuit or complaint follows, the question of who built and maintains the site tends to come up.
Clear scope in your agreements, and a clear conversation with clients about what compliance looks like and who’s responsible for what, protects everyone. It’s not about shifting liability. It’s about making sure nobody is caught off guard.
I put together a document for our own clients that explains these risk areas and outlines the options for addressing them. Happy to share it. It’s not legal advice, but it’s useful for starting the conversation. Send me a message in the contact form below, and I’ll send you a copy.
How we can help
We’re not lawyers. We won’t tell you whether your business is legally compliant with any specific law, and you shouldn’t trust any web developer who does.
What we can do: audit your site for real accessibility issues and fix them, set up cookie consent correctly so tracking actually waits for user action, help you get site-specific policies in place through tools like Termageddon, review the third-party scripts running on your site and clean up what doesn’t need to be there, and set up monitoring so compliance issues from future changes get caught.
If you want to talk through where your site stands, let’s start with a conversation.
Matthew Christensen is the founder of 40 North, a WordPress development and support team based out of Redding, California. 40 North builds and maintains websites for agencies and businesses. This post is not legal advice.
