1. Accessibility Laws will Require Regular Sitewide Audits
Accessibility is at the forefront of regulation going into 2025, and it will require a fundamental shift in focus for teams responsible for website management. The effort to reach compliance will present a formidable challenge; however, the real battle might be in finding the balance between maintaining compliance without utilizing entire teams for hours on end.
- Europe: The EAA, coming into effect June 28, 2025, requires businesses providing digital products and services in the EU to meet WCAG 2.1 Level AA standards
- US: While ADA enforcement may be deprioritized for the moment, compliance with this federal law is mandatory.
- US: The obligations of state and local government websites and mobile apps to comply with accessibility standards were clarified on April 8, 2024.
Prediction: Your marketing team and ad agency have probably heard of EAA (best-case scenario) but may not have a clear idea as to what that means for them (likely scenario). Organizations will spend hundreds of hours expending resources to audit current materials and communicate the specifics of WCAG 2.1 (compliance will require both automated and manual testing).
What this Means: The bigger your brand, the more likely you are to be a target for fines. The larger your enterprise, the more webpages you will have to audit (ObservePoint estimates at least 6 months of manual auditing for organizations with 200+ webpages).
*Note: There are 56 WCAG guidelines and some of them can be verified using automated tools — but the EAA has specifically noted that other requirements will require manual, human testing. By utilizing a third-party platform such as ObservePoint to scan your site and surface WCAG violations that can be detected automatically, you’ll greatly reduce the time and effort required to reach accessibility compliance.
2. Privacy Fines are SO in
The dominant privacy laws for website governance are different from many of the accessibility regulations in that they now have a few years of experience under their belts. 2025 may see a large push for privacy compliance thanks in large part to global and national security concerns in highly regulated industries, the expansion of state-level privacy laws, and of course the Attorney General of California hinting at stronger enforcement of CCPA.
- State-level Laws: Many states have enacted new privacy laws that have already taken or will take effect in 2025. These include Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland.
- The American Privacy Rights Act (APRA) faces fundamental issues on state law preemption that have prevented it from passing into law; however, Congressional members are forming a committee to pass some sort of federal privacy law in the near future
- GDPR and CCPA: 2025 will likely feature increased crackdowns on privacy violators in the EU and California
The most common privacy violations include:
- Non-compliant cookie banners. ObservePoint has found that 95% of scanned consent-management platforms still allow unapproved cookies
- Unauthorized Tags collecting information are not only outside compliance but pose a massive privacy risk
- Inaccessible or Incomplete Privacy Policies, which have been clearly listed as a violation under both CCPA and GDPR
Prediction: Both GDPR and CCPA will be examples of other notable brands in 2025.
What this Means: GDPR fines can range from €10- €20 million or 2-4% of annual revenue (Meta notably faced a €1.2 billion fine in 2023), while the CCPA states fines shall be imposed at $2,500 per violation or $7,500 for “intentional” incidents. But, Sephora famously faced a $1.2M fine because each affected person’s data is considered a violation.
Privacy breaches also bring devastating losses from which companies must try to recover with great effort:
- 65% of consumers lose trust in an organization1
- 31% of consumers discontinue their relationship with the company2
- 85% of consumers share their negative experiences with others3
3. ESG Takes a Backseat to Privacy
As a new administration plows ahead in the United States, Environmental, Social, and Governance (ESG) website transparency initiatives that have been a priority for the previous administration might now be deprioritized to more directly focus on the regulation of Artificial Intelligence and Data Privacy.
ESG initiatives include:
- Publishing ESG reports, sustainability statements, and compliance disclosures
- Public disclosure of carbon footprint, diversity metrics, ethical sourcing, and social responsibility efforts directly on corporate websites
- Regulations like the UK Modern Slavery Act & German Supply Chain Act require companies to disclose how they monitor human rights violations in supply chains—often via their websites
Prediction: In the United States, regulation surrounding ESG at the federal level will be nearly nonexistent with a much stronger focus being placed on data privacy. While it’s yet to be seen how large of a priority ESG will be for the European Union and State-level lawmaking, expect rollouts to be both small and limited in scope.
What this Means: The three major lawsuits from 2024 surrounding ESG were all centered around false claims and misguided messaging rather than website compliance. Companies operating in the EU and beyond will need to find the balance or weigh the consequences between privacy compliance, accessibility compliance, and ESG compliance.
- Invesco (SEC): $17.5 million fine for misleading ESG integration statements
- WisdomTree (SEC): $4 million fine for misleading ESG marketing
- Vanguard (Australia): $8.89 million fine for misleading claims about its “ethically conscious” bond index fund
_______________________________________________________________
Footnotes
1HIPAAJournal
2HIPAAJournal
3https://www.metacompliance.com/blog/data-breaches/5-damaging-consequences-of-a-data-breach?utm_source=chatgpt.com
