Website legal requirements for US small businesses (2026)

What most small business websites need

Most small business sites do not face a long list of website-specific laws. But a handful of rules reach almost everyone who has a contact form, sends marketing email, shows reviews or earns affiliate commissions. The common gaps are an accessible design, an accurate privacy policy, compliant email, and honest reviews and endorsements.

Here is each area, followed by a checklist you can work through in an afternoon.

Accessibility and the ADA

Web accessibility means people with disabilities can use your site, including people who rely on screen readers, keyboard navigation or captions. The Americans with Disabilities Act (ADA) is the main US law in play, and it treats governments and businesses differently.

Private businesses (Title III)

Title III covers “public accommodations,” which includes most businesses open to the public. The Department of Justice has not issued a specific technical rule for business websites. Its March 2022 guidance says businesses open to the public must make their websites accessible, gives them flexibility in how to do it, and points to the Web Content Accessibility Guidelines (WCAG) as helpful guidance.

The lack of a fixed rule has not stopped lawsuits. According to the law firm Seyfarth Shaw, plaintiffs filed 3,117 website accessibility lawsuits in federal court in 2025, up 27% from 2,452 in 2024 (and 2,794 in 2023). Total ADA Title III federal filings in 2025 were 8,667. Those numbers leave out state-court cases and demand letters, so the real volume is higher.

State and local governments (Title II)

For governments, DOJ did set a rule. Its April 2024 final rule requires state and local government websites and mobile apps to meet WCAG 2.1 Level AA. An interim final rule published April 20, 2026 pushed the deadlines back one year, according to ADA.gov:

This rule does not apply to private businesses. It matters to you if you build or run sites for a city, county, school district or other public body. It is also a sign of where expectations are heading: WCAG 2.1 Level AA is the most practical target for any business site.

Selling to Europe

The European Accessibility Act has applied since June 28, 2025 to covered products and services sold to EU consumers, including e-commerce. That can include US companies selling into the EU. Microenterprises providing services are exempt.

Practical accessibility steps

• Give every meaningful image short alt text that says what it shows.
• Make sure text has strong contrast against its background.
• Check that you can reach every menu, button and form field with the Tab key alone.
• Label every form field, and do not rely on color alone to show errors.
• Caption videos and use real headings (H2, H3) in order.
• Add an accessibility page with a way for visitors to report problems, and respond to them.

Privacy laws

The US has no single comprehensive federal consumer privacy law. Instead, states pass their own. According to a 2026 count by the law firm Husch Blackwell, 24 states now have comprehensive consumer privacy laws, up from 20, after Alabama, Louisiana, Oklahoma and Vermont were added. The IAPP keeps a tracker of enacted and pending state laws.

Most of these laws apply only above a size or data threshold, and the thresholds differ by state. Many small businesses fall below them. Check the states where you have the most customers.

California: CCPA

The California Consumer Privacy Act (CCPA), as amended by the CPRA, is the best known. According to the California Attorney General, it applies to for-profit businesses that do business in California and meet any one of these tests:

• Gross annual revenue above the threshold. The law says $25 million; the California Privacy Protection Agency adjusted it for inflation to $26,625,000 from January 1, 2025, and adjusts it every odd-numbered year.
• Buy, sell or share the personal information of 100,000 or more California residents or households.
• Earn 50% or more of annual revenue from selling California residents’ personal information.

Covered businesses must explain in their privacy policy what they collect and why, and describe consumers’ rights to know, delete, opt out, correct, limit and not be discriminated against. Businesses that sell or share personal information must post a clear “Do Not Sell or Share My Personal Information” link and must honor opt-out signals sent by browsers, such as the Global Privacy Control. The 2025 adjusted fines are up to $2,663 per violation or $7,988 per intentional violation.

California: CalOPPA reaches small sites too

A smaller, older California law catches far more websites. Under the California Online Privacy Protection Act, operators of commercial websites that collect personal information from California consumers must post a privacy policy, according to the California Attorney General. A contact form that asks for a name and email address counts as collecting personal information. The policy must list the categories of personal information you collect and the kinds of third parties you share them with, and explain your online tracking practices, including how you respond to “Do Not Track” signals.

Because nearly every business site gets some California visitors, a privacy policy is the safe default for everyone.

Cookie banners: do you need one?

US law has no general federal rule that requires a cookie consent banner. The pressure comes from two places.

• State privacy laws. If your site uses advertising pixels or tracking cookies that count as “selling” or “sharing” data under a state law, you may need a way for visitors to opt out. In California, that includes honoring browser opt-out signals such as the Global Privacy Control.
• Visitors from Europe. If you market to people in the EU or UK, their rules generally require consent before non-essential cookies are set.

Most builders and WordPress plugins offer cookie or consent tools. If you run only basic analytics and no ad tracking, a clear privacy policy may be enough in many states. If you run ad pixels, set up an opt-out.

Children: COPPA

The Children’s Online Privacy Protection Act applies if your site or service is directed to children under 13, or if you know you are collecting personal information from children under 13. It requires verifiable parental consent before you collect that information. The FTC’s amended COPPA Rule took effect June 23, 2025, with a compliance deadline of April 22, 2026. Most small business sites are aimed at adults and avoid COPPA by not targeting kids. If you run a tutoring service, a toy shop or a kids’ activity business, read the rule closely.

Email marketing: CAN-SPAM

If your site collects email addresses for newsletters or promotions, the CAN-SPAM Act applies to the emails you send. The FTC’s compliance guide lists the main rules:

• Use accurate “From,” “To” and routing information.
• Do not use deceptive subject lines.
• Identify the message as an ad.
• Include a valid physical postal address.
• Offer a clear way to opt out, and honor opt-outs within 10 business days.

There is no exception for business-to-business email. You also stay responsible if an email marketing vendor sends on your behalf. Penalties can reach $53,088 for each email that breaks the rules.

Reviews, testimonials and affiliate links

Disclose paid relationships

The FTC revised its Endorsement Guides in June 2023. If you have a “material connection” to something you recommend, such as an affiliate commission, a free product or a payment, you must disclose it clearly and conspicuously. The FTC’s endorsement FAQ says the closer the disclosure is to the recommendation, the better. It says a line such as “I get commissions for purchases made through links in this post” works, and that “paid link” next to a link can work, but that vague labels such as “affiliate link” alone may not be enough. Our own affiliate disclosure shows one approach.

No fake reviews

The FTC’s rule banning fake reviews and testimonials was announced August 14, 2024 and took effect October 21, 2024. It prohibits:

• Fake reviews and testimonials, including AI-generated ones and reviews from people who never used the product.
• Offering rewards for reviews that must express a particular sentiment, positive or negative.
• Reviews from owners, managers or employees that do not disclose the connection.
• Company-controlled “independent” review sites.
• Suppressing negative reviews through groundless legal threats or intimidation.
• Buying or selling fake social media followers or views.

The FTC can seek civil penalties against knowing violators. In practice: ask every customer for an honest review, not just the happy ones, and never post reviews written by staff or friends without saying so.

Privacy policy and terms pages

Privacy policy. Treat this as required. It should describe what you actually do: what you collect (form entries, analytics, cookies, payment details), why, who you share it with (email platform, payment processor, analytics provider), how long you keep it, and how people can contact you. Do not copy another company’s policy. Under CalOPPA, failing to follow your own stated policy can itself be a violation.

Terms of use. No general law requires them for a simple business site, but they help. They can set out who owns your content, your refund or cancellation terms, and limits on your liability. They matter more if you sell online, take bookings or let users post content.

Other pages worth having: an accessibility statement with a contact method, and a clear refund and shipping policy if you sell products.

A practical checklist

Review this list once a year, and whenever you add a new tool that collects data, such as a chat widget, booking system or ad pixel.

What to do next

• Learn what accessible design looks like in practice in our web accessibility glossary entry.
• Choosing a platform? Our guide to choosing a website builder covers the built-in tools that make these tasks easier.
• Building with AI? Read the security and privacy cautions in our AI website builders guide.
• Hiring someone? Ask the accessibility question from our list of questions to ask a web designer.
• See how we source facts like these on our how we research page.