GDPR and Website Accessibility: What It All Actually Means in Plain English
If you run a business and have a website, you have probably heard terms like GDPR, EAA, WCAG and ADA thrown around. You may have received emails warning you about compliance deadlines. You may have been told your website needs to be updated. And you may have found that most of the explanations you have encountered are written by lawyers or developers for other lawyers and developers.
This post is not that. This is an explanation of what is actually going on, written for people who run businesses and need to understand what these rules mean for them, not for people who enjoy reading legislation.
Start Here: Why Websites Have Rules
Governments have decided that websites need to follow certain rules, for two main reasons.
The first is privacy. When you visit a website, that website can collect a lot of information about you. Your name and email if you fill out a form. Your location. What pages you look at and for how long. What device you are using. In some cases, information about your health, your finances, or your political views. Governments decided that people should have more control over this, and that businesses need to be transparent about what they collect and why.
The second is accessibility. Millions of people have disabilities that affect how they use the internet. Someone who is blind uses software that reads website content aloud. Someone with limited hand mobility uses a keyboard instead of a mouse. Someone with dyslexia needs text to be presented in a certain way. For a long time, many websites were built without considering these users at all, effectively locking them out. Governments decided this is not acceptable.
These two concerns have produced a set of regulations that businesses need to follow. The main ones affecting websites are GDPR, the European Accessibility Act, and the ADA in the United States.
GDPR: The Privacy Rules
What it is
GDPR stands for General Data Protection Regulation. It is a European law that came into force in 2018. It sets out rules about how businesses can collect, store, and use personal data about people.
Personal data means
Any information that can identify a person. This includes obvious things like names, email addresses and phone numbers. It also includes things like IP addresses, location data, and cookie identifiers, because these can be linked back to specific individuals.
What it requires in simple terms
You must tell people what data you collect and why. You must have a genuine reason for collecting it. You must not collect more data than you actually need. You must not keep it longer than necessary. You must keep it secure. You must let people see, correct or delete their data if they ask. And if you use cookies, you must ask permission before using the ones that are not strictly necessary for the website to function.
Who it applies to
Any business that collects personal data from people in the European Union. This includes businesses based outside Europe. If someone in Germany visits your website and fills out a contact form, GDPR applies to that interaction regardless of where your business is based.
What happens if you ignore it
Fines can reach 20 million euros or 4% of your annual global revenue, whichever is higher. These maximum figures apply to serious violations by large companies. For smaller businesses, fines are typically in the range of a few thousand to a few hundred thousand euros depending on the nature and severity of the violation.
The European Accessibility Act: The Rules About Disabled Users
What it is
The European Accessibility Act is a European law that requires certain types of digital services to be accessible to people with disabilities. It came into force for new products and services in June 2025. Existing products and services had until June 2030 to comply.
What accessible means in practice
It means a blind person using screen reader software can navigate your website and use all its features. It means a person who cannot use a mouse can do everything with a keyboard instead. It means images have text descriptions. It means videos have captions. It means the contrast between text and background is high enough to read. It means forms are clearly labeled so someone using assistive technology knows what to fill in where.
Who it applies to
Businesses that sell goods or services to consumers in the EU and fall into certain categories. These include e-commerce websites, banking and financial services, transport booking services, streaming services, and e-books. If you sell products or services online to European customers, there is a reasonable chance the EAA applies to your website.
What happens if you ignore it
Enforcement is handled by national authorities in each EU member state. Penalties vary by country but can include fines and orders to make your website accessible within a set timeframe. Repeated failures or refusal to comply result in more serious consequences.
WCAG: The Technical Standard Behind Accessibility
What it is
WCAG stands for Web Content Accessibility Guidelines. It is a set of technical guidelines developed by the W3C, the organization that sets standards for the web. WCAG is not a law in itself. It is the technical framework that laws like the EAA and the ADA refer to when they say a website needs to be accessible.
What the levels mean
WCAG has three levels: A, AA and AAA. Level A is the minimum. Level AA is what most laws require. Level AAA goes beyond what is legally required for most businesses.
What it means for you
If you need to comply with the EAA or ADA, you need your website to meet WCAG 2.1 Level AA. A compliance audit checks your website against the specific criteria in this standard and tells you what needs to be fixed.
ADA: The US Equivalent
What it is
The Americans with Disabilities Act is a US law that prohibits discrimination against people with disabilities. Courts have consistently ruled that it applies to websites, meaning businesses must make their websites accessible to people with disabilities.
How it differs from European law
The ADA does not specify a technical standard in the way that the EAA does. Instead, courts have treated WCAG 2.1 Level AA as the relevant benchmark. Enforcement is primarily through lawsuits filed by individuals or advocacy organizations, rather than through regulatory investigation as in Europe.
The lawsuit reality
Thousands of ADA website accessibility lawsuits are filed every year in the United States. Many target small businesses. A lawsuit typically begins with a demand letter, followed by a settlement negotiation if the business engages. Settlements typically involve a payment and an agreement to fix the website.
Putting It All Together
If you run a business with a website and you have customers in the EU or the US, here is what these rules mean for you in practical terms.
- Your website needs a working cookie consent system that asks permission before tracking visitors
- Your privacy policy needs to explain clearly what data you collect and why
- Your website needs to be navigable by people using assistive technology
- Images need text descriptions, videos need captions, and forms need clear labels
- People need to be able to request their data, correct it, or have it deleted
None of these are impossible requirements. They are achievable through a combination of good website design and appropriate policies. The challenge for most businesses is knowing which specific things on their particular website need to change, and in what order to address them.
That is what a compliance audit identifies. It looks at your specific website against the specific requirements of the relevant laws and tells you exactly what needs to be fixed and how.
Frequently Asked Questions
Do I need to comply with all of these rules at the same time?
The rules that apply to you depend on where your customers are located and what type of business you run. GDPR applies if you have EU customers. The EAA applies if you provide certain types of digital services to EU consumers. The ADA applies if you have US customers. Many businesses fall under all three frameworks simultaneously.
How do I know if my website currently complies?
The only reliable way to know is through a professional compliance audit that checks your website against the specific requirements of each applicable regulation. Automated scanning tools can identify some issues but miss many others that require manual assessment.
Is compliance a one-time task?
No. Compliance needs to be maintained. Every time you update your website, add new features, change your data practices, or start using new tools, you need to ensure that the changes remain compliant. An annual audit combined with compliance checks during website updates is the recommended approach.
What is the first thing I should do?
Start with a cookie audit. Cookie consent is the most common source of GDPR complaints and is visible to anyone who visits your website. If your cookie consent is not working correctly, it is both a legal risk and a signal to visitors about how seriously you take their privacy.
Get a Plain-English Compliance Report for Your Website
Request a compliance audit at veritroncompliance.com • Packages from $599