Your Website Looks Great. But Is It Putting Your Business at Risk?

Your website can look professional, work beautifully, and still expose your business to problems you never considered. Privacy disclosures, accessibility barriers, copyrighted content, and improperly configured tracking tools can create responsibilities that go well beyond website design.

I was recently reminded of this while rebuilding a website for a former client.

What started as a modernization project turned into a much deeper look at what it really means to own and operate a website.

I recently had an opportunity to rebuild a website I had worked on years earlier. The client wanted a modern look, updated functionality, and a better experience for today's visitors.

As we worked through the rebuild, we also revisited the website's accessibility, privacy policies, and the technologies operating behind the scenes. The client had recently introduced a booking link, which added another important part of the customer journey that deserved attention.

What I discovered wasn't necessarily that the old website was doing something wrong. It was that the website had evolved, technology had changed, and we now had an opportunity to examine responsibilities that might otherwise have been overlooked.

That experience sent me researching website accessibility, privacy laws, consent requirements, copyright notices, and the growing number of ways a business can find itself facing legal questions over its website.

And I came away with a message worth sharing.

Adding a booking feature may seem like a small improvement, but it can introduce additional questions about accessibility, privacy, and third-party services.

That was particularly relevant to the client rebuild that started this entire discussion.

A booking service may request names, email addresses, phone numbers, appointment details, or other information. Depending on its configuration, that information may be processed by another company.

The website owner should understand what the service collects, how visitors access it, and whether the website's privacy disclosures accurately describe the arrangement.

A third-party booking link does not automatically create a new ADA obligation or establish a privacy violation. But it is a good reason to review how the customer's experience and information are handled.

Your Privacy Policy Could Be Making Promises You Cannot Keep

This was one of the most interesting discoveries from my research.

Many websites have privacy policies because a developer installed one, a plugin generated one, or someone copied language from another website.

But a privacy policy is not a magic shield against legal responsibility.

It is a statement about what your business does with visitor information. And when that statement doesn't match reality, it can create problems.

Imagine that your policy says your business never shares personal information with outside companies.

Meanwhile, your website sends form submissions to a customer relationship management system, uses an email marketing provider, and runs advertising or analytics services that receive visitor data.

Whether a particular transfer legally qualifies as sharing or selling personal information depends on the circumstances and applicable law. But the business still needs to know what information moves between systems and whether its promises are accurate.

Here's the important part:

Do Google Analytics, Google Ads, and Email Forms Create Privacy Responsibilities?

These tools can create disclosure, consent, and contractual responsibilities depending on how they are used.

A business running Google Analytics needs to understand the Google Analytics privacy and data policies. Advertising features and certain uses of customer information may introduce additional requirements.

Google Ads, Meta advertising tools, email marketing platforms, contact forms, and CRM integrations can also involve information collection or transfer.

Consider a customer who completes a form asking for a quote.

You may need that information to respond to the inquiry. But automatically enrolling the same customer in promotional emails raises a different set of questions involving marketing permissions, notices, and applicable rules.

We covered the tracking side of this problem in our earlier article, Cookies in 2026: What Small Businesses Need to Know About Tracking, Consent and Privacy.

For this discussion, the lesson is simple: installing a marketing tool is not the same as reviewing the responsibilities that come with using it.

Does Your Cookie Consent Banner Actually Work?

A cookie banner should do more than appear on the screen and offer a few buttons.

Where consent is required, the website must correctly implement the applicable visitor choices.

A business may install a banner that says Accept, Reject, and Customize, but never verify whether the website's tracking tools respond properly.

That leads to a practical question: What happens behind the scenes when someone clicks Reject?

Depending on the implementation, analytics and advertising technologies may need to stop, change their behavior, or avoid storing particular identifiers. Some configurations, including advanced Google Consent Mode, can permit limited cookieless signals, so an outgoing request is not automatically evidence of a violation.

The way to understand the difference is to test the website's actual behavior.

How Can You Check Whether Consent Choices Are Working?

Start by examining four situations:

For each situation, check browser storage, network activity, and the behavior of your connected tracking technologies.

Developers can use browser inspection tools and automated testing platforms to record these differences. Server-side integrations also deserve attention because they may transmit information that a browser inspection cannot reveal.

A test can identify potential problems, but interpreting the legal significance requires knowledge of the applicable requirements.

Does Passing an ADA Scanner Mean Your Website Is ADA Compliant?

No. Automated accessibility checks are valuable, but a clean report is not a universal legal compliance certificate.

During the client rebuild, we ran the updated website through automated checks and achieved passing results. That was encouraging and reflected the attention given to accessibility during modernization.

But research into the testing process reinforced an important limitation.

The World Wide Web Consortium's accessibility evaluation guidance explains that no testing tool can independently determine whether a website meets all accessibility requirements. Knowledgeable human evaluation is also necessary.

For example, a scanner may confirm that an image contains alternative text, but it may not determine whether that description meaningfully communicates the image's purpose.

A scanner may also miss difficulties people encounter when using a screen reader, navigating with a keyboard, or completing a complicated booking process.

Tools such as WAVE, axe, and Lighthouse can provide useful evidence. Manual testing of important visitor journeys provides another essential perspective.

The goal is not simply to earn a passing score. It is to make the website usable for the people it serves.

What About Copyright Claims Against Your Website?

Copyright deserves attention because website owners often assume that an image is safe to use simply because it was available online or provided by someone working on their website.

That assumption can be expensive.

Photos, videos, music, illustrations, written content, and other creative works may be protected by copyright. The fact that an image appears in search results does not establish permission to use it commercially.

Even purchasing a license does not necessarily grant unlimited rights. Licenses can restrict permitted uses, websites, distribution methods, or other conditions.

I recommend maintaining records of where important website assets came from, who supplied them, and what rights the business has to use them.

Those records can become particularly useful if someone later challenges the business's use of an image.

What Should You Do If You Receive a Copyright Demand Letter?

First, don't panic. But don't automatically ignore it either.

Some copyright notices are legitimate. Others are mistaken, exaggerated, or fraudulent. Even a real enforcement company can make an incorrect allegation when its system fails to recognize a valid license.

There are two separate questions to investigate.

Is the sender genuine? Independently verify the business, law firm, rights holder, or enforcement company making the claim. Avoid relying solely on contact information or payment links in the notice.

Is the allegation valid? Identify the specific work, the page where it appears, the asserted owner, and the evidence supporting the claim. Compare those details with your licenses, receipts, permissions, and publication records.

A matching image on your website may establish that you used it. It does not, by itself, establish infringement.

Also, remember that a demand letter is not a court judgment. If someone claims a lawsuit has been filed, independently verify the court and case information and seek appropriate legal advice.

Before You Pay the Fine, Make Sure There's a Case

That's the way I would summarize the process.

Preserve the correspondence and supporting records, verify who is making the allegation, examine the claim, and obtain legal guidance when appropriate.

Do not assume that an official-looking email establishes liability. And do not assume that a notice is fake simply because it arrived electronically.

The goal is to respond intelligently rather than emotionally.

How Can a Small Business Audit Its Website?

You don't need to become a programmer or an attorney to start asking the right questions.

I recommend reviewing five areas:

The best assessment is one that identifies specific issues, explains their potential consequences, and provides an actionable path to address them.

Some findings can be resolved by a website developer. Others may require legal, privacy, security, or accessibility specialists.

Frequently Asked Questions About Website Compliance

The Website Was Modernized. So Was My Perspective.

I started this project with a familiar goal: take an older website and give it a modern look and better functionality.

What made the project especially worthwhile was the opportunity to look beyond design.

We revisited accessibility, privacy, and the customer journey, including the newly introduced booking feature. The website passed the automated checks we ran, and the process gave us a better understanding of the responsibilities that come with operating it.

The larger lesson is that website ownership is not a one-time event.

Think back to that renovated restaurant. New furniture and fresh paint are great, but they don't replace the responsibility to maintain the building and make it usable and safe for the people who visit.

Your website deserves the same attention.

This article provides general educational information and is not legal advice. Legal obligations depend on the facts and applicable law. Consult qualified professionals for legal determinations.

Last fact-checked: November 5, 2026.