Multi-jurisdiction website compliance: one site, many laws

For most modern SMB websites, the practical question is not “which law applies” , it is “which laws apply.” A site sold across the EU, UK, US, and Canada triggers six or seven distinct legal frameworks, each with its own technical requirements, disclosures, and enforcement mechanism. Building seven compliance programmes is impossible for an SMB. Multi-jurisdiction compliance is about doing the right work once and reporting it correctly to each authority.

The law-by-law summary

European Union

• GDPR + ePrivacy Directive: opt-in consent for non-essential trackers, lawful basis for personal-data processing, data-subject rights, transparency.
• European Accessibility Act (EAA): WCAG 2.1 AA via EN 301 549, from 28 June 2025, for in-scope products and services. Microenterprise exemption applies.
• Digital Services Act: transparency, content moderation, and advertising disclosures (mostly relevant for marketplaces and platforms).

United Kingdom

• UK GDPR + PECR: close to the EU regime, but no longer identical. The Data (Use and Access) Act 2025 amended PECR: since 5 February 2026 several low-risk cookie categories are exempt from consent — first-party aggregate analytics among them — and the PECR penalty ceiling rose from £500,000 to £17.5m or 4% of global turnover. The ICO publishes detailed cookie guidance.
• Equality Act 2010: an anticipatory duty to make reasonable adjustments. The Act names no technical standard, and no UK court has ever ruled on web accessibility — every claim brought so far has settled. WCAG 2.1 AA is named in UK law only by PSBAR 2018, which binds the public sector. Private service providers are assessed against it because it is the practical yardstick everyone uses, not because a judgment says so.

United States

• ADA Title III: applies to websites of public accommodations. Technical standard de facto WCAG 2.1 AA.
• State privacy laws: California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), Texas (TDPSA), and a growing list. Each has notice requirements, consumer-rights workflows, and a sale/sharing opt-out (Global Privacy Control). Penalties vary.
• Section 5 FTC Act: misleading marketing claims about privacy or accessibility (the basis for the 2025 accessiBe enforcement).

Canada

• PIPEDA (federal): consent and disclosure for personal information.
• AODA (Ontario): WCAG 2.0 AA for organisations with 50+ employees; the threshold is sometimes lower under provincial human-rights law.
• Quebec Law 25: stricter privacy rules, including DPIA-like assessments for new technologies.

Australia

• Privacy Act 1988: Australian Privacy Principles, currently undergoing reform that will tighten consent and bring it closer to GDPR.
• Disability Discrimination Act: case law cites WCAG 2.0/2.1 AA as the practical standard.

The compliance pyramid: what overlaps

Most of the work is shared across regimes. The diagram a useful audit produces:

• Accessibility: one WCAG 2.1 AA programme serves the EAA, ADA, UK Equality Act, AODA, and the DDA — but for different reasons in each, and the difference matters when someone asks you to justify the target. The EAA names 2.1 AA through EN 301 549; AODA sets a statutory floor of WCAG 2.0 AA, which 2.1 AA clears. The UK Equality Act and ADA Title III name no technical standard at all, so there 2.1 AA is evidence rather than compliance: the yardstick a claim would be assessed against, not a bar written into the law. A single technical baseline is still the right call. Just do not tell a lawyer that 2.1 AA is what the Equality Act requires.
• Cookies and trackers: GDPR + ePrivacy is the strictest consent regime, and meeting the EU bar carries you most of the way through UK PECR and Brazil’s LGPD. It does not carry you into US state law, which runs on a different model. Twelve states now require a Global Privacy Control signal to be honoured server-side, and California requires a separate Notice at Collection. An EU opt-in banner does neither of those things for you. The reverse does not hold either, a CCPA-compliant cookie banner usually fails GDPR.
• Privacy disclosures: a GDPR-compliant privacy policy is over-inclusive for most other regimes. State-specific addenda (California-resident rights, Quebec-resident rights) are the standard add-ons.
• Consumer-rights workflows: a single intake (right of access, correction, deletion, portability, objection) routes to per-jurisdiction handlers.
• Required pages: privacy policy, accessibility statement, cookie policy, imprint (for DACH visitors). Universal.

The practical playbook

1. Adopt the strictest standard as your baseline. For accessibility, WCAG 2.1 AA. For privacy, GDPR-grade consent and disclosures. Other regimes get a jurisdiction-specific overlay.
2. Run one technical audit, generate per-regulation reports. The same missing alt text shows up in your EAA report, your ADA report, and your AODA report with the relevant clause and remediation steps. This is how a one-developer SMB compliance team is feasible.
3. Localise the front-end of the user experience, not the back-end. The cookie banner the user sees can adapt to their region (banner content, default state, available toggles). The underlying tag manager logic does not need to change.
4. Document jurisdiction in the privacy programme. One privacy policy with regional sections beats six separate policies that drift out of sync. A single data-subject request workflow with a routing layer beats six.
5. Continuously monitor. Multi-jurisdiction means the surface area for regression is six times what a single-jurisdiction site faces. A new tag, a new widget, a new third-party can break compliance in three regimes simultaneously.

The trap of single-jurisdiction tooling

Most accessibility scanners only report against WCAG. Most privacy auditors only check GDPR or only check CCPA. An SMB that hires three separate vendors for three jurisdictions ends up with three reports that disagree, three SLAs, three invoices, and no consolidated remediation backlog. A multi-jurisdiction tool reduces this to one audit feed, one ticket queue, one weekly cadence.

How Veracly approaches it

Veracly was specifically built for this pattern. One scan generates simultaneous reports against five rule packs: EAA, GDPR and ePrivacy, ADA, UK Equality Act, and AODA. Each issue is mapped to the specific clause in each regulation, with one remediation backlog. US state privacy law is not on that list — we do not grade against CCPA, CPRA, or their successors, and the report says so rather than implying coverage we do not have. Reports are localised to the jurisdiction that requires them, German EAA output for the German reporting authority, English ADA output for a US settlement negotiation, French RGPD output for the CNIL. Run a free scan.

See also: What is a website compliance audit? · EAA compliance for SMBs · ADA website compliance audit · Impressum requirements for Swiss websites