The rules that matter are those of the countries whose visitors your site serves. Here is a short summary of what the main standards and laws expect.
Laws vary from country to country, but the benchmark for websites is largely the same: WCAG.
The current version of the W3C’s Web Content Accessibility Guidelines. In 2025 it became an international standard as ISO/IEC 40500:2025.
The level most laws and organizations set as the target. A site that conforms to WCAG 2.2 also conforms to 2.1 and 2.0.
Europe’s accessibility standard; for web content, it includes the WCAG 2.1 AA criteria.
Since June 28, 2025, it has required services such as e-commerce, banking, e-books, transport ticketing and communications to be accessible. Companies outside the EU may also fall within its scope if they serve consumers in the EU. Microenterprises with fewer than 10 employees and annual turnover not exceeding €2 million are exempt with regard to services. The technical benchmark is the EN 301 549 standard (which includes WCAG 2.1 AA).
Learn more →Courts have applied the Americans with Disabilities Act (ADA) to private businesses’ websites as well, and thousands of lawsuits are filed every year. In 2024, the Department of Justice published a rule requiring WCAG 2.1 AA for state and local government entities. Section 508 covers the digital services of federal agencies.
Requires service providers to make reasonable adjustments for disabled people, and this includes websites. Public sector sites are also assessed against WCAG 2.2 AA under the 2018 accessibility regulations.
In Ontario, websites of organizations with 50 or more employees must meet WCAG 2.0 AA. At the federal level, the Accessible Canada Act covers federally regulated organizations.
Australia, Israel, Japan, India and many other countries have accessibility rules. Most of them also reference WCAG Level AA.
Any site that uses analytics or advertising cookies should pay attention to the privacy rules of the visitor’s country.
Non-essential cookies (analytics, advertising) require prior, explicit and freely given consent. Rejecting must be as easy as accepting, pre-checked boxes must not be used, and the consent given must be recorded.
The Turkish Personal Data Protection Authority’s “Guide on Cookie Practices” expects explicit consent for non-essential cookies and expects visitors to be informed.
Learn more →Many states, led by California, give visitors the right to opt out of the sale or sharing of their personal data. Sites are expected to honor the Global Privacy Control signal sent by browsers.
For visitors in the European Economic Area, Google’s advertising and measurement tools expect a signal showing the visitor’s consent choice. Without this signal, ad measurement and audience features are limited.
Brazil’s LGPD and the privacy laws of Canada, Australia and many other countries also require transparency and choice for cookies and tracking technologies.
That is why we position GoWay as a tool that speeds up your compliance work and makes it visible. For fixes on your site, we recommend working with your web team or agency.