Most small-business websites were launched fast, and their legal pages — if they exist at all — were copied from a competitor years ago. In 2026 that’s a bigger risk than it used to be. Privacy law now covers most of the U.S. market state by state, web accessibility has moved from lawsuit-only territory into formal federal rulemaking, and payment processors and ad platforms increasingly require policies as a condition of doing business.
Here’s what actually changed, and the seven items every business website should have in place this year.
What changed heading into 2026
State privacy laws reached critical mass. Around twenty states now have comprehensive consumer privacy laws, and the newest wave — including Indiana, Kentucky, and Rhode Island — took effect on January 1, 2026. Most of these laws only bind businesses above certain revenue or data-volume thresholds, but the practical effect reaches everyone: customers expect a privacy policy, ad platforms require one, and if you sell to consumers in multiple states, the strictest applicable law tends to set your baseline.
Web accessibility became regulation. The Department of Justice’s rule under ADA Title II requires state and local government websites to conform to WCAG 2.1 Level AA on a phased schedule. Private business sites aren’t covered by that specific rule — but ADA lawsuits and demand letters against business websites continue in volume, and the DOJ rule effectively confirmed WCAG 2.1 AA as the standard courts and plaintiffs reference. Conformance plus a published accessibility statement is the strongest practical protection available.
Enforcement got real about cookie banners. Regulators in California and elsewhere have pursued companies whose consent banners didn’t actually stop tracking, or whose “reject” buttons did nothing. A broken banner is worse than no banner.
The seven pages every business website needs
- Privacy Policy. Accurate — describing what you actually collect and which providers you actually use — and linked in your footer and next to every form. Include a rights section (access, deletion, correction, opt-out) with a working contact method.
- Terms of Service. Your rules of the road: licenses for digital products, disclaimers, limitation of liability, governing law. Linked at checkout.
- Cookie disclosure. A short page listing the categories of cookies you set and how visitors can control them. Only run a consent banner if it genuinely controls your cookies.
- Refund policy. Card processors expect it, disputes get decided by it, and customers buy more confidently because of it. State it before purchase, not after.
- Disclaimer. Especially if you publish educational content, examples, or anything adjacent to legal, financial, or health topics: no professional advice, no guaranteed results, affiliate links disclosed.
- Accessibility statement. Name the standard you aim for (WCAG 2.1 AA), what you’ve done, and how someone can reach you if a page doesn’t work for them.
- Copyright/DMCA policy. How rights holders can report infringement — and if you host user content, register a designated agent with the U.S. Copyright Office to keep safe-harbor protection.
Beyond the pages: three habits that keep you compliant
Match your policies to reality. The most common failure isn’t a missing policy — it’s a policy that describes a business you aren’t running. If your privacy policy says “we don’t use analytics” while Google Analytics loads on every page, the policy hurts rather than helps. Re-read your pages once a year against what your site actually does.
Keep proof of consent. For email and especially SMS marketing, store when and how each subscriber opted in. Under CAN-SPAM every marketing email needs your postal address and a working unsubscribe; under the TCPA, texting without documented prior consent is one of the most expensive mistakes a small business can make.
Treat compliance as a moving target. More state privacy laws take effect each year, and standards like WCAG get updated. Put a recurring calendar reminder — twice a year is plenty — to review your legal pages, your forms, and your cookie setup.
Where to start
If you have none of this in place, don’t try to do it all at once. Publish a privacy policy and terms of service first, add the refund policy and disclaimer next, then work through accessibility. When you want a professional set of eyes on the result, our Compliance Readiness Assessment reviews your site end to end.
This article is general information, not legal advice. Laws vary by state and industry — consult a licensed attorney about your specific situation.