State Privacy Laws and Accessibility Rules

For a business in the United States, “Does our website comply with the law?” rarely has a simple answer. It depends on where the business operates, whose data it processes, and which services it provides online.

In 2026, new privacy laws took effect in Indiana and Kentucky, while updated regulations under California’s existing privacy law came into force. State and local governments also face approaching deadlines for website accessibility. These rules apply to different organizations, so the first step is to identify which ones are relevant.

What Changed in State Privacy Laws?

Indiana and Kentucky’s consumer privacy laws took effect on January 1, 2026. Updated regulations under the California Consumer Privacy Act, or CCPA, took effect on the same date.

All three address how personal data is handled, but they differ in their applicability thresholds, exemptions, and specific obligations:

• Indiana’s law gives consumers rights over their personal data and places obligations on businesses that meet the law’s criteria.
• Kentucky’s law provides rights that include accessing, correcting, and deleting personal data, as well as opting out of certain types of processing.
• California’s updated regulations clarify aspects of the existing CCPA, including how certain consumer requests and risk assessments must be handled.

A website does not become subject to every provision of a state’s privacy law simply because someone in that state can visit it. A business needs to examine its activities, the amount of data it processes, and any applicable exemptions.

What Should Website Owners Check?

Once a business knows which rules apply, it can compare those requirements with how its website actually works. Five questions provide a useful starting point:

1. What data does the website collect? Include contact forms, analytics, customer accounts, and other features.
2. Where does the data go? Review advertising tools, payment providers, and other third-party services connected to the site.
3. How are consumer requests handled? Where an applicable law provides rights to access, correct, or delete data, the business needs a way to process those requests.
4. Are users’ choices respected? If a user exercises an applicable right to opt out, the relevant systems must act on that choice.
5. Does the privacy notice reflect reality? Its description of data practices should match what the website and its integrations actually do.

Changing the wording of a privacy policy will not fix a mismatch between the choices shown to users and the way connected systems process their data. Data access, storage, and sharing should therefore be considered when the website and its integrations are designed. Webdelo takes all applicable legal requirements into account when planning the website’s structure and developing the website design. Privacy-by-design practices help teams build those considerations into a digital product’s architecture and day-to-day operation.

Accessibility Deadlines for Government Websites

Privacy is not the only issue to review. In 2024, the US Department of Justice adopted a rule setting technical accessibility requirements for websites and mobile apps provided by state and local governments. WCAG 2.1 Level AA is the standard for content covered by the rule, subject to limited exceptions.

The compliance deadlines were extended in 2026:

• April 26, 2027 for state and local government entities serving populations of 50,000 or more;
• April 26, 2028 for entities serving populations below 50,000 and for special district governments.

The rule also matters when a government agency hires a vendor to build or maintain a website or app. Outsourcing the work does not remove the agency’s responsibility for making its digital services accessible.

These deadlines do not apply to every commercial website. Businesses that serve the public still need to consider their accessibility obligations under the Americans with Disabilities Act, or ADA, but the government website rule and its deadlines should not be presented as a new requirement for all private businesses.

How to Check Essential Website Features

An accessibility review should focus on what visitors can actually do. Can someone find information, complete a form, and submit a request using a keyboard instead of a mouse? Can a screen reader convey the meaning of the page?

Priority checks include:

• keyboard access to navigation and forms;
• clear field labels and error messages;
• readable text when the page is enlarged;
• descriptions for images that convey important information;
• accessible documents and video content.

These considerations are easier to address when pages and user journeys are being built. Making accessibility part of corporate website development also gives teams a basis for checking new forms, content, and features as the site grows.

How to Keep the Website Up to Date

Websites change after launch. Teams add pages, forms, analytics tools, and integrations. Privacy and accessibility checks should be part of those updates.

A practical process is to:

1. Determine which federal and state rules apply to the organization.
2. Map the data the website collects and where it is shared.
3. Translate applicable requirements into specific website functions and workflows.
4. Assign responsibility for reviewing new pages and services.
5. Recheck essential user journeys after significant changes.

The takeaway: there is no single “2026 US website compliance checklist” for every organization. Businesses need to identify the rules that apply to them, then verify that their websites work accordingly for users and their data.