Is your website accessible and privacy-compliant? A plain-language guide for Canadian small businesses
Most small business owners have a nagging feeling their website should be "compliant" with something, without being sure what. Here's what the main Canadian rules ask of a typical small business website, and the simple steps that cover most of it.
This is general information, not legal advice. If you're unsure how a rule applies to your organization, check with a lawyer or the regulator.
Accessibility: can everyone use your site?
According to Statistics Canada, 27% of Canadians aged 15 and over, or 8.0 million people, had one or more disabilities that limited their daily activities in 2022. If someone can't read your text, use your menu with a keyboard, or understand an image without seeing it, they can't become your customer.
The common standard is the Web Content Accessibility Guidelines (WCAG), Level AA. What the law requires depends on where you are:
- Ontario: the Accessibility for Ontarians with Disabilities Act (AODA) covers businesses and non-profits with 50 or more employees, plus designated public sector organizations. Their public websites, and web content published after January 1, 2012, must meet WCAG 2.0 Level AA (live captions and pre-recorded audio descriptions are exempt). This has been required since January 1, 2021.
- British Columbia: the Accessible British Columbia Act covers government and prescribed public sector organizations. There are no website rules for private businesses yet; standards for service delivery and employment are in development.
- Federal: the Accessible Canada Act covers federally regulated organizations, such as banks, telecoms and airlines, and asks for accessibility plans and progress reports.
Even where no law requires it yet, an accessible site reaches more customers, works better on phones, and tends to do better in search. Most of the work is basic:
- Text that contrasts clearly with its background, and that can be enlarged without breaking the page
- Descriptive alt text on meaningful images ("Our team at the Nanaimo shop", not "IMG_2041")
- Headings in a logical order, and link text that says where it goes (not "click here")
- A site you can use with a keyboard alone, with forms that label every field
- Captions on videos
Privacy: what you collect, and what you tell people
If your website has a contact form, a newsletter sign-up, online booking or analytics, you're collecting personal information. Which law applies depends on where you operate:
- PIPEDA covers private-sector organizations that collect personal information in the course of commercial activity, across most of Canada.
- British Columbia and Alberta have their own private-sector privacy laws (PIPA in each province) that are substantially similar to PIPEDA and apply instead for information collected within the province.
- Quebec's Law 25 goes further. Since September 2023, businesses must publish a privacy policy in clear, simple language on their website, name the person in charge of protecting personal information with their contact details, and keep any technology that can identify, locate or profile visitors (such as some tracking cookies) turned off until the visitor chooses to turn it on. If you serve Quebec customers, check how it applies to you.
The common thread: tell people what you collect and why, collect only what you need, protect it, and give people a way to ask about it.
Email marketing: Canada's anti-spam law
If your site has a newsletter sign-up, Canada's Anti-Spam Legislation (CASL) applies to the marketing emails you send. You need the recipient's consent (express, or implied in limited cases), you must identify who's sending, and every message needs a free, working unsubscribe option. Unsubscribe requests must be honoured without delay, and within 10 business days at most.
A quick checklist
- A privacy policy, linked from every page, that says what you collect, why, and who to contact
- Forms that ask only for what you need, with a note on how you'll use it
- Newsletter sign-ups that are clearly opt-in, and emails with a working unsubscribe link
- No tracking or analytics scripts you don't use. Old plugins often load third-party trackers you've forgotten about.
- If you serve Quebec: the privacy contact named on the site, and profiling or tracking cookies off until visitors opt in
- Readable contrast, alt text on images, captions on videos, and forms that work with a keyboard
- If you're in Ontario with 50 or more employees: a WCAG 2.0 AA review of your public site
Where SiteFlo comes in
SiteFlo™ makes the routine parts easier to keep on top of:
- Photo descriptions from Slack. Ask "Describe the photos on the About page" and SiteFlo writes alt text for every photo missing one, for your team to check and approve. You can review and correct descriptions the same way.
- Analytics only if you want them. Choose Cloudflare, Google Analytics, Plausible, Fathom, Matomo or others, or none at all. There are no plugins quietly adding trackers.
- Easy policy updates. When your privacy policy or contact person changes, updating the page is a Slack message.
Not sure where your site stands? Run a free SiteFlo Fit check. In about a minute it checks your site's accessibility and privacy basics, along with its security, speed, search visibility and upkeep.
Sources: Statistics Canada, Government of Ontario, Province of British Columbia, Office of the Privacy Commissioner of Canada, Commission d'accès à l'information du Québec, Justice Laws Website (CASL). Linked above.