After conducting compliance audits across hundreds of websites — from small local businesses to international brands – certain findings appear with such consistency that they are almost predictable. These are not obscure edge cases. They are fundamental issues that the majority of websites share, often because web developers are not trained in compliance and business owners do not know what to ask for.
1. No Language Declaration on the HTML Element
This is the single most consistent finding across every audit we conduct. The HTML element – the root tag of every web page — should declare the primary language of its content using the lang attribute. This allows screen readers to apply the correct pronunciation rules when reading the page aloud.
Without a language declaration, a screen reader reading an Icelandic website will attempt to pronounce Icelandic words using English pronunciation rules. The result is incomprehensible. For a visually impaired user, the page is effectively inaccessible.
The fix: Add lang=”en” (or the appropriate language code) to the html tag. This takes under five minutes and has zero visual impact.
2. No Cookie Consent Banner – or a Non-Compliant One
The second most consistent finding. Many businesses either have no cookie consent mechanism at all, or have implemented one that does not meet the legal standard. The most common non-compliant implementations are banners with no opt-out option, banners that fire analytics before consent is given, and “by continuing to browse” language that has been explicitly rejected by European regulators.
The fix: Install a GDPR-compliant consent management platform. For WordPress sites, Complianz, CookieYes and Borlabs Cookie are all solid options. Ensure the banner blocks non-essential cookies until after consent is given.
3. Form Fields Without Proper Labels
Contact forms, search boxes, booking fields and newsletter sign-ups very frequently rely on placeholder text – the grey text that appears inside the input field — as the sole means of identifying what the field requires. When a user starts typing, the placeholder disappears. For screen reader users, and users with cognitive disabilities, this creates a significant barrier.
The fix: Add HTML label elements associated with every input field using the for and id attributes. Labels can be visually styled to be small or subtle without losing their accessibility function.
4. Images Without Alt Text
Portfolio images, team photos, product images and hero graphics frequently have no alt text — the text description that screen readers announce when they encounter an image. For a visually impaired user, these images are invisible. For businesses whose primary value proposition is visual — interior designers, restaurants, hotels — this means the most compelling content on the site is completely inaccessible.
The fix: Add descriptive alt text to all meaningful images. Write it as if describing the image to someone on the phone. Decorative images – dividers, backgrounds, purely aesthetic elements — should have alt=”” so screen readers skip them.
5. No Skip Navigation Link
Keyboard users navigate websites by pressing Tab to move through interactive elements. On a site with an extensive navigation menu, a keyboard user must Tab through every navigation item on every page before reaching the main content. This is the equivalent of making a wheelchair user climb a flight of stairs on every floor of a building.
A skip navigation link – typically a visually hidden link at the very top of the page that becomes visible when focused — allows keyboard users to jump directly to the main content. It is one of the most impactful accessibility fixes available and takes approximately 15 minutes to implement.
The fix: Add a skip to main content link at the top of every page. A single line of CSS makes it visually hidden by default but visible when focused by keyboard.
6. Privacy Policy Not Prominently Linked
Under GDPR Article 13, data subjects must be informed about data processing activities at the point of data collection. A privacy policy that exists but is buried three levels deep in a site, accessible only from the cookie banner and not linked from the footer of every page, does not meet this standard.
We regularly find privacy policies that exist but are not linked from the main footer, that were last updated before GDPR came into force, or that are copied from generic templates and do not accurately describe the business’s actual data processing activities.
The fix: Link your privacy policy clearly from the footer of every page on your site. Review the policy to ensure it accurately covers your current data processing — including any third-party tools, booking systems, analytics platforms and email marketing tools you use.