Q&A-style explainers on GDPR, EAA, ADA, WCAG, cookie consent, and tracking, written for SMB founders, marketers, and developers who need the real version, not the legal-blog version.
Most of what applies to an SMB website in 2027 is already law. This is the calendar of dates that matter, the rules that do not change, and a checklist that says which items a scan can verify and which need a person.
A website compliance audit checks accessibility, privacy, and tracking practices against the laws that apply where your visitors live. Here is the practical version for small and medium businesses.
A GDPR cookie audit checks consent before any non-essential cookie or tracker fires. Here is what regulators actually look for, the failures we see most often, and how to pass.
Level AA is the bar every regime converges on, but no two of them name the same WCAG version. Here is what an audit actually checks, what only humans can verify, and the five fixes that move the needle on most SMB sites.
The EAA has applied to private companies in the EU since 28 June 2025. Here is the SMB-shaped version: who is in scope, who is exempt, and the four things you actually need to do.
A cookie banner audit checks design, defaults, dark patterns, and what loads before any consent gesture. The Accept and Reject paths themselves have to be walked by hand. Here is the 2026 checklist.
Tracking pixels share visitor data with ad networks the moment they fire. Here is what an audit checks, why pixels are the most-fined item on SMB sites, and how to keep them and stay compliant.
Germany and Austria require an Impressum on every commercial website; Switzerland only for sites offering goods or services online. Here is the legal basis, the field-by-field checklist, and the common failures that trigger Abmahnung letters.
Switzerland requires a legal notice (Impressum) on commercial websites under Art. 3(1)(s) UWG, narrower than Germany’s rule, but the email address is explicitly mandatory. Here is the field-by-field checklist and how Swiss law differs from the German DDG.
ADA website accessibility lawsuits hit a record in 2025: 5,114 filings, 3,195 of them federal. SMBs are the main target. Here is how the law applies, the WCAG 2.1 AA bar, and the realistic SMB defence plan.
EU, UK, US, and Canadian visitors trigger different laws. Here is the practical playbook for satisfying GDPR, EAA, ADA, UK Equality Act, and AODA with one programme.
The Netherlands applies the same EU rules as everyone else, but through its own statutes and regulators. The cookie rule is in the Telecommunicatiewet, where the ACM supervises Art. 11.7a itself and the Autoriteit Persoonsgegevens covers the GDPR side, and accessibility is now law under the Implementatiewet.
Finland splits cookie oversight between two regulators and was one of the last EU states to abandon browser-settings consent, in 2021. Here is how the cookie rule, GDPR and the European Accessibility Act actually apply to a Finnish website.
Australian web compliance is not a translated version of the GDPR. There is no statute naming WCAG, no prior-consent rule for cookies, and a small-business exemption that excuses most SMBs from the privacy-policy duty entirely. Here is what actually applies.
Australian businesses install consent banners because European advice tells them to. There is no Australian rule requiring one for ordinary analytics. But sensitive information is a real exception, and the Privacy Commissioner enforced it against tracking pixels in June 2026.
A widely repeated claim says the small business exemption dies on 10 December 2026. That date is real, but it belongs to another provision. Here is what section 6D actually does, who it does not protect, and why we know the mistake well.
Most "free compliance scanners" are lead-gen tools dressed as audits. Here is the difference between a useful free scan and a marketing trick, and what to do with the results.
Your first Veracly report is dense by design. Here is the section-by-section tour, the numbers that actually matter, and a triage plan for the first week.
Most SMB sites trip on the same short list of compliance issues. Nine of them a scanner can catch; one it cannot, and we say which. All are fixable in under a day with the right snippet.
The free scan is not a teaser. It is a real audit of one page, one snapshot in time. Here is exactly what it tests, what it does not, and the signal that says it is time to upgrade.
A compliance report is only useful if its reader trusts it. Every Veracly PDF is cryptographically signed and independently verifiable, for a defined window. Here is the mechanic, and the expiry, in plain English.
Most compliance bugs are introduced after the original audit, not during it. A scheduled re-scan plus a score-drop alert is how you catch them in the cycle they ship.
The same PDF gets read very differently by your developer, your lawyer, and the regulator who asked for it. Here is the three-audience guide to handing it over.
GA4 is not strictly illegal in the EU, but it is also not a drop-in default. Two distinct questions decide its fate: did you get consent, and does the EU-US Data Privacy Framework still hold?
GDPR did not invent the cookie banner. ePrivacy did, nine years earlier. Understanding which framework requires what is the difference between a defensible CMP setup and a banner that fails on first inspection.
The EAA microenterprise exemption is widely cited and widely misunderstood. It does exempt a microenterprise online shop from the service requirements. The limits are on the product side, in national law, and in the definition itself.
A cookie banner that puts "Accept all" on the front page and buries "Reject all" two clicks deep is not a defect, it is the violation. Banner parity is among the most-enforced consent rules in the EU.
You can skip the cookie banner if you only use essential cookies. The catch: "essential" excludes almost every cookie most websites actually use, including most analytics tools that market themselves as "privacy-friendly."
"It is not a cookie, so it does not need consent." This is the most common technical misconception in cookie compliance. The storage rule covers every mechanism that writes to terminal equipment.
Session recording tools sell themselves on the legitimate-interest argument: "we anonymize, we are GDPR-friendly, no consent required." EU DPAs have consistently rejected this. The recording itself is the storage event, and the storage is non-essential.
WCAG 2.2 is the current standard. EAA cites EN 301 549 which cites 2.1. ADA case law cites 2.0 and 2.1. AODA mandates 2.0. The standard and the law are not the same in 2026, and the gap matters.
GPC is a browser signal that tells sites "do not sell or share my data." California treats it as a binding opt-out. The EU has not legislated it, and the draft ePrivacy Regulation that would have was withdrawn in 2025. Honoring GPC in the EU is optional, and defensible on Article 21(5) GDPR alone.
A chatbot that answers product questions is one thing. A chatbot that screens leads, takes bookings, or makes underwriting decisions is another. The compliance surface depends on what the bot does, not on what model powers it.
GDPR has no small-business exemption. EAA has one but only for service providers. CCPA kicks in at $25M revenue or 100k consumers. Each regulation draws the line differently, here is the map.
A complaint to a data protection authority is the start of a process, not a verdict. Most SMBs imagine the worst; the actual workflow is a letter, a response, and usually a closure, provided the response is well-prepared.
A country-by-country map of what Veracly monitors, what the automated scan detects, and the requirements that still need manual verification. Including the parts we cannot check.