ADA & GDPR Website Compliance 2026: What Small Businesses Actually Need to Avoid Legal Risk

ADA demand letters and GDPR fines used to be an enterprise problem. They aren't anymore. Small business sites get flagged constantly, usually by automated scanners run by law firms or compliance vendors, and the first a business owner hears about it is a certified letter demanding a settlement. Here's what the law actually requires, what a cookie banner does and doesn't cover, and the checklist that closes the real gaps.

What the Law Actually Says

The ADA itself predates the modern web and never named a technical standard. What changed is case law: U.S. courts have repeatedly ruled that a commercial website is a "place of public accommodation" under Title III, the same category as a physical storefront. There's no official government checklist, but WCAG (Web Content Accessibility Guidelines) 2.1 or 2.2 Level AA is what plaintiffs' scans cite, what settlements reference, and what the DOJ points to when it weighs in. GDPR is more explicit — it's an actual EU regulation with defined consent requirements, and it applies to any site that can be visited by EU residents, not just EU-based businesses.

WCAG 2.2 Conformance Levels, Explained

WCAG defines three levels. Level A is the bare minimum — missing this means fundamentally broken access for some users. Level AA is the level referenced by nearly every law, lawsuit, and settlement, and the one your site should be targeting: sufficient color contrast, full keyboard navigation, descriptive alt text, properly labeled form fields, and visible focus states. Level AAA is the strictest tier and covers things like sign-language interpretation for video — almost no business site needs it, and chasing it is usually wasted effort better spent elsewhere.

GDPR Is More Than a Cookie Banner

Most sites bolt on a cookie banner and consider GDPR done. It usually isn't. Real compliance means non-essential cookies and tracking scripts don't fire until the visitor actively opts in — not an "I agree" button that was cosmetic while analytics and ad pixels were already running in the background. It means letting visitors accept or reject categories individually (analytics, marketing, functional) instead of one all-or-nothing toggle, no pre-ticked boxes, and a real, working process for an EU visitor to request their data be accessed, exported, or deleted.

The Real Cost of Getting This Wrong

ADA web lawsuits typically settle in the low-to-mid five figures once legal fees are added, even when the underlying fixes would have cost a fraction of that. GDPR fines scale with revenue and can be far higher, though for most small sites the more common cost is a demand to fix specific violations under threat of escalation. Either way, the fixes are almost always cheaper than the letter that shows up when you don't have them — and a site that's hard to use with a keyboard or screen reader is losing real customers regardless of legal risk.

A Practical Compliance Checklist

Run an automated WCAG scan (axe, WAVE, or Lighthouse) as a baseline, then manually test keyboard-only navigation and a screen reader on your key pages — automated tools catch maybe a third of real issues. Fix color contrast ratios, add real alt text to every meaningful image, label every form field properly, and make sure focus states are visible. Replace a cosmetic cookie banner with a real consent-management tool that blocks non-essential scripts until opt-in. Publish a privacy policy that actually describes what you collect and why, and confirm you have a working process to honor a data-deletion request if one comes in.

The Bottom Line

Neither ADA nor GDPR compliance is a one-time checkbox — new pages, new forms, and new third-party embeds all reintroduce risk. But closing the core gaps (WCAG 2.2 AA basics and real opt-in consent) removes the vast majority of legal exposure and, unlike most compliance work, actually makes the site better for every visitor who uses it.