What this article covers
This is a plain-language overview of the legal topics that touch a small business website. It is not legal advice, and it is not a compliance checklist for your business. Laws differ by state and by what your site does. Use this to know what to ask, then have a lawyer review your privacy policy, forms and terms.
We build websites and we are not a law firm. For the pages themselves, see web design for service businesses and the website checklist.
The five topics, in the order owners ask about them:
- Accessibility (ADA and WCAG)
- Privacy policy and state privacy laws
- Cookie and tracking notices
- Text-message consent on forms (TCPA)
- Website terms
Accessibility: the ADA, WCAG and the 2024 rule
Title II: governments, not private businesses
The Justice Department published a rule on web and mobile app accessibility under Title II of the ADA on April 24, 2024. It applies to state and local governments, including their agencies, departments and special districts. It sets WCAG 2.1 Level AA as the technical standard. On April 20, 2026, the Department published an interim final rule that extended the compliance dates: April 26, 2027 for governments with a population of 50,000 or more, and April 26, 2028 for smaller governments and special district governments. (Source: the Department’s ADA.gov fact sheet, read in October 2026. Check it for updates.)
The rule is written for governments, not for private businesses. The one place it reaches a private company is when that company provides web content or an app for a government: ADA.gov says governments that contract out services must make sure their contractors follow Title II, and gives the example of a city parking app run by a private company. So if you run a plumbing company, a salon or a dental office and do no work of that kind, the Title II rule is not your rule.
Title III: businesses open to the public
Title III of the ADA covers businesses that serve the public. ADA.gov lists restaurants, shops, doctors’ offices, gyms and similar places as examples. The Justice Department’s March 18, 2022 guidance on web accessibility says that Title III applies to goods and services businesses offer on the web too, that there is no regulation setting detailed technical standards for websites, and that businesses have flexibility in how they comply. The guidance names WCAG as one existing technical standard that can help. It describes itself as informal guidance and not legally binding.
What that means in practice, stated carefully:
- There is no federal rule that tells a private business “use WCAG 2.1 AA by this date.”
- The Justice Department’s position is that the ADA’s obligations reach a business’s online services.
- WCAG 2.1 AA is the standard the Justice Department adopted for state and local government sites, which is one reason it is a common target for businesses.
- Whether a particular site meets a legal duty is a question for a lawyer.
What to do about it
You do not need a legal opinion to fix the common problems. WCAG 2.1 is built on four principles: content must be perceivable, operable, understandable and robust. Start here:
- Text alternatives for images. Meaningful images need descriptive alt text (WCAG success criterion 1.1.1).
- Color contrast. Text needs a contrast ratio of at least 4.5:1 against its background, or 3:1 for large text (criterion 1.4.3, Level AA).
- Keyboard use. Every link, menu and form field works without a mouse.
- Form labels and clear error messages.
- Captions or transcripts for video you publish.
We build sites to WCAG 2.1 AA. A scan tool will not find everything. Test with the keyboard and a screen reader on your key pages: home, service pages, contact and booking.
Privacy policy and state privacy laws
Why you should have one
If your site collects names, phone numbers, emails or messages through forms, chat or booking, or runs analytics or advertising pixels, you are handling personal information. A privacy policy tells visitors what you collect, why, who receives it and how to reach you.
Three points to know:
- The FTC holds you to your promises. The FTC’s business guidance says that if you make privacy promises, express or implied, the FTC Act requires you to live up to them. A policy copied from another site that says things you do not do can create a problem.
- California requires one for many sites. The California Attorney General says the California Online Privacy Protection Act (CalOPPA) applies to operators of commercial websites and online services that collect personally identifiable information from California consumers, and requires a conspicuously posted privacy policy.
- A broader state law may apply. California’s CCPA applies to for-profit businesses that do business in California and meet one of three tests. The Attorney General’s page lists them: annual gross revenue over $25 million (check the current adjusted figure), buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50% or more of annual revenue from selling personal information. A small local business may not meet them, but check, especially if you run ads that share visitor data.
Massachusetts and other states
States have been passing their own consumer privacy laws, each with its own thresholds, and the IAPP keeps a tracker of them. Massachusetts is still working on one. Foley Hoag reported on June 17, 2026 that the House passed H.5479 on June 4, 2026, and that a House-Senate conference committee would reconcile it with the Senate’s bill, S.2619. The two versions had different applicability thresholds (for example, 100,000 consumers in the House version against 60,000 in the Senate’s), and the House version would take effect July 1, 2027. When we checked in October 2026, we found no report of a final bill signed into law. Check the Massachusetts Legislature’s site for the current status before you rely on this.
What a privacy policy should say
Write it from what your site really does:
- What you collect (form fields, call recordings, chat transcripts, booking details, analytics data)
- Why you collect it and how you use it
- Which services receive it (booking tool, email service, CRM, analytics, ad platforms)
- How long you keep it
- How a person can ask to see, correct or delete their data, where a law gives that right
- How to reach you
- The effective date
If you are a clinic, patient information tied to an appointment request can be protected health information under HIPAA, which has its own rules. If you are a law firm, attorney advertising and confidentiality rules apply to your forms and chat. Ask your lawyer.
Cookie and tracking notices
There is no single US law that says “every website needs a cookie banner.” What exists is a set of rules tied to what you do with data:
- Some state laws give people the right to opt out of the sale or sharing of their personal information. The California Attorney General says covered businesses must treat a Global Privacy Control signal as a valid opt-out request.
- If you advertise or run analytics that share visitor data with third parties, those disclosures belong in your privacy policy.
- If you have visitors from outside the US, other rules may apply. Ask a lawyer.
A practical way to start: list every script on your site (analytics, ad pixels, chat, maps, video, fonts, booking widgets). Remove what you do not use. For what remains, say in your privacy policy what it does. Then ask your lawyer whether a consent banner or opt-out link is needed for your situation.
Text-message consent on your forms (TCPA)
If a form collects a phone number and you plan to text, consent matters. Under the Telephone Consumer Protection Act (TCPA) rules at 47 CFR 64.1200, calls and texts that advertise or are telemarketing and are made with an autodialer or an artificial or prerecorded voice require the prior express written consent of the person called. The rule defines that consent as a signed written agreement (an electronic signature counts if the law recognizes it) that lists the number and includes a clear disclosure: it authorizes those messages, and signing is not a condition of buying anything. Texts that are not marketing, such as appointment reminders, still need the person’s prior consent when they are sent with an autodialer, though not necessarily in writing.
Revocation is just as important. A person can withdraw consent in any reasonable way, and a reply such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE is automatically reasonable. The rule requires honoring a reasonable revocation within ten business days. Do not make one method the only way to opt out.
For a website form, the practical steps are:
- An unchecked checkbox next to the phone field. Do not pre-check it.
- Plain wording that names your business, says what kind of texts (appointment reminders, offers) and how often, adds “Message and data rates may apply,” and explains how to stop.
- Consent separate from the submission. Do not make it a condition of getting a quote or booking.
- A link to your privacy policy next to the checkbox.
- STOP and HELP handling that works. We set up opt-in and STOP handling when we connect texting.
- A record of who agreed, when, and to what wording.
- Carrier registration. Business texting numbers must be registered with carriers (A2P 10DLC). Registration and message fees are not included in our prices.
Whether a given text is marketing or informational, and whether the tool you use counts as an autodialer, are legal questions. Have a lawyer approve the wording before launch.
Email has its own federal rules. The FTC says the CAN-SPAM Act covers commercial email, including business-to-business email, and requires truthful headers, no deceptive subject lines, a clear ad disclosure, your valid postal address and a way to opt out that you honor within 10 business days.
Website terms
Terms of use or terms of service are the rules for using your site, booking or paying online. They are not required by a single federal rule, but they help when you take deposits, have cancellation or no-show policies, or accept uploads. Cover who you are, what the site offers, payments and cancellation, your liability limits, and how to contact you. Have a lawyer draft or review them.
One clause to avoid: the FTC says the Consumer Review Fairness Act makes it illegal to use a form-contract term that bars or restricts reviews, penalizes a reviewer, or takes the reviewer’s intellectual property rights in a review. That includes terms of use. The illegal clause is unlawful even if you never enforce it.
A short checklist
- Accessibility: test key pages by keyboard, fix contrast and alt text
- Privacy policy: match it to what your site does, and date it
- Trackers: list them, remove what you do not use, disclose the rest
- Forms: unchecked consent box, clear wording, STOP handling, a consent record
- Terms: lawyer-reviewed, with no review-gag clause
How Magnet Mint fits
We build to WCAG 2.1 AA, add the consent checkbox and opt-out handling to forms and texting, and put your privacy policy and terms on the site. We do not write legal text for you; you or your lawyer provide the final policy and terms, and we publish them. If you want to see where your current site stands, ask for a free demo, or read about small business website design.
This is not legal advice. Laws change and depend on your state, your industry and what your site does. The sources above were checked in October 2026.
Published . Updated .