Accessibility & privacy
Find out where you stand before somebody else tells you.
Accessibility and tracking are the two places where a website stops being a design question and becomes a legal one — under the ADA in the United States, the European Accessibility Act in the EU, and a widening set of state privacy laws in between. All of it is measurable, most of it is failing quietly, and it is far cheaper to find yourself than to have reported to you.
Sample report · 3 September 2026
northfield-outfitters.com
- Visibility
- 38
- Conversion
- 76
- Security
- 42
- Compliance
- 86
- Speed
- 62
- Usability & Design
- 84
Two legal systems, one standard
The European Accessibility Act has applied to consumer-facing ecommerce since June 2025 and points at WCAG. US law has no codified web standard for private business, but ADA Title III claims and the Justice Department's own rulemaking both consistently reference the same guidelines. Whatever your jurisdiction, WCAG 2.2 AA is the target you can defend — so one test answers both.
In the US it arrives as a letter
The practical risk for an American retailer is not a regulator. It is a demand letter, often from a firm that files these at volume, citing screen-reader failures on a checkout that nobody internally has ever tested. The first you hear of the problem is usually the claim, and by then the remediation is on someone else's schedule.
Consent in the EU, opt-out in the US
Europe requires a choice before anything non-essential is set. California, Colorado, Connecticut, Virginia, Texas and a growing list of states instead require a working way out of sale, sharing and targeted advertising. Both regimes hinge on the same question, and it is a question about your actual pages: which trackers fire, and when.
Named checks
What the compliance scan actually does
Five probes against the live page. Each one names the specific element, cookie or vendor that failed, so a finding is something you can hand to a developer rather than a score with nothing under it.
- WCAG 2.2
- Automated conformance testing against the guidelines the EAA points at and US claims consistently cite, on the rendered page.
- Cookies before consent
- We load the page, touch nothing, and record every cookie set anyway — each listed by name, with session and security flags.
- Trackers before consent
- Named vendors, not a count: Meta Pixel, Google Analytics, Hotjar, TikTok Pixel and others, with whether they fired before any choice.
- Consent platform
- Whether a recognised consent management platform is present, and whether it is actually gating anything or only displaying a notice.
- Policy link
- Whether a privacy policy is reachable from the page, and whether it names the tools you are actually running.
Questions
Before you run it
I am in the US. Does the European Accessibility Act apply to me?
Only if you sell to consumers in the EU — it follows the customer, not the company. But the accessibility question does not go away domestically: ADA Title III claims over inaccessible websites are filed in volume every year, and they target ordinary retailers rather than large corporations. The same WCAG failures drive both, so the same scan serves both.
Is there an official US standard for website accessibility?
Not a codified one for private businesses under ADA Title III. Federal agencies and their contractors work to Section 508, and the Justice Department's 2024 rule set WCAG 2.1 AA for state and local government with compliance dates in 2026 and 2027. For everyone else, courts and settlements have converged on WCAG as the reference, which is why WCAG 2.2 AA is the defensible target even without a statute naming it.
Is an automated check enough on its own?
No, and we will not pretend otherwise. Automated testing reliably catches a large share of WCAG failures — contrast, labels, structure, alternative text, keyboard traps — but some criteria need human judgement, and no scan produces a conformance certificate. Treat this as the fast, free first pass that tells you the scale of the problem and what to fix first. It is not legal advice, and it is not a substitute for counsel where you already have a claim.
We have a cookie banner already. Are we fine?
Often not. Having a banner and gating behaviour behind it are different things, and the gap between them is the most common finding on this page. We test what actually happens on load rather than whether a notice is present, which is why a site with a properly configured platform can still fail — usually because a tag was hard-coded into the template years earlier and never reviewed.
What about the pixel and session-recording lawsuits?
Those claims turn on which third-party tools received visitor data and whether anyone agreed to it, so the useful thing is an inventory. We name the vendors we detect and record whether each one fired before consent, which is the fact underneath the argument. What you do with that is a conversation for your counsel, not for us.
Run it on your own site.
Your score, and every finding ranked by what it costs you. If it comes back clean, that is a useful thing to know too.