PRIVACY COMPLIANCE · PRIVACY & COOKIE COMPLIANCE
Website Privacy and Cookie Compliance Review
Cookies, Notices, Copyright and Accessibility in One Engagement
A cookie banner is not consent, and an accessibility scan is not conformance. Privacy regulations including the EU GDPR, the UK GDPR as amended in 2026, the CCPA as amended by the CPRA, and the ePrivacy rules each define specific requirements for how a website handles cookies, tracking, notices and terms of service. Separate accessibility obligations apply depending on what kind of organization you are. Elevate Consult reviews all four dimensions and delivers documented findings with remediation paths, not a scan report.
2026 UPDATE
What changed and what most reviews miss
EU and UK cookie rules diverged in February 2026
The Data (Use and Access) Act 2025 exempts certain analytics cookies from the UK consent requirement where only aggregate, non-identifying data is collected. The EU continues to require prior consent for all non-essential cookies. A single banner configuration no longer serves both markets correctly, and a review that treats Europe as one jurisdiction will pass a site that is wrong in one of them.
California now requires opt-out confirmation
Under the CCPA regulations effective 1 January 2026, businesses must confirm to the consumer that a request to opt out of selling or sharing has been processed. A banner that accepts the request silently does not meet the requirement.
Opt-out preference signals are part of the test
California requires businesses to honor opt-out preference signals such as Global Privacy Control. This is a technical configuration question that a visual banner review will not surface, and it is among the more commonly failed items.
Accessibility deadlines moved, and the obligation did not
The Department of Justice extended ADA Title II compliance dates in an Interim Final Rule published 20 April 2026. State and local government entities serving populations of 50,000 or more now have until 26 April 2027, and smaller entities and special district governments until 26 April 2028. The extension shifted the dates, not the duty: Title II has prohibited disability discrimination for years and litigation continues during the extension. HHS Section 504 deadlines were not extended.
Trusted Tester moved to version 5.1.3
The Department of Homeland Security updated the Trusted Tester process in 2025 and 2026, refining evaluation of interactive elements, PDF accessibility and keyboard operability. An attestation should name the version it was produced under.
THE REGULATORY LANDSCAPE
Overlapping frameworks, one website to get right
Most organizations subject to privacy regulation operate under more than one framework at once. A website that satisfies the CCPA can still fail the EU consent standard, and neither framework addresses accessibility, which sits under an entirely separate body of law with different triggers.
Getting the trigger right matters more than getting the standard right. Which accessibility law applies to an organization depends on what that organization is, not on whether its website is public.
WHICH ACCESSIBILITY LAW APPLIES TO YOU
Four regimes, four different triggers
This is where most website compliance material goes wrong. Section 508, ADA Title II, Section 504 and ADA Title III are related but distinct, and they do not apply to the same organizations.
Section 508
Federal agencies, and vendors through procurement
Requires information and communication technology developed, procured, maintained or used by federal agencies to be accessible. The current standard references WCAG 2.0 Level AA. It does not apply to a private organization simply because it operates a public website, and it does not apply merely because an organization receives federal funding.
ADA Title II
State and local government entities
The Department of Justice final rule adopted WCAG 2.1 Level AA. Compliance dates were extended by the April 2026 Interim Final Rule to 26 April 2027 for entities serving 50,000 or more, and 26 April 2028 for smaller entities and special districts.
Section 504
Recipients of federal financial assistance
HHS rules require WCAG 2.1 Level AA, with deadlines that were not extended alongside Title II. Organizations that are both public entities and federal funding recipients are covered by both and must meet both.
ADA Title III
Private businesses open to the public
No formal federal WCAG deadline applies, but courts routinely apply WCAG 2.1 Level AA in litigation. The practical exposure is private lawsuits rather than a regulatory date.
EU Accessibility Act
Products and services placed on the EU market
Obligations applied from 28 June 2025. Relevant to organizations selling digital products or services into the EU regardless of where they are established.
Trusted Tester
Testing methodology, not a law
The DHS process qualifies testers to perform standardized, reproducible Section 508 conformance testing using assistive technology, currently at version 5.1.3. It produces an attestation against tested pages, not a site-wide certification.
WHAT WE REVIEW
Four areas covered in every engagement
Elevate combines automated scanning with manual assessment across four domains. Automated tools identify roughly 30 percent of accessibility issues; the remainder requires human judgment and assistive technology testing.
Cookie compliance
First-party and third-party cookie inventory, consent management platform configuration, tracking and pixel review across analytics, advertising and social, opt-in and opt-out mechanism validation, banner adequacy per jurisdiction, and opt-out preference signal handling including Global Privacy Control.
Copyright and image compliance
Review of image usage to identify unlicensed or improperly attributed assets, licensing status, attribution and rights documentation, tracking embedded in image assets, and alignment with what the privacy notice actually discloses.
Privacy and cookie policy review
All publicly available notices, Privacy Policy, Privacy Notice, Cookie Policy and Terms of Service, against the EU GDPR, the UK GDPR as amended, and the CCPA as amended by the CPRA. Covers disclosure completeness, legal basis documentation, data subject rights language, opt-out and Do Not Sell mechanisms, sensitive personal information handling, and retention and third-party sharing disclosures.
Accessibility testing
Trusted Tester methodology on the main page and associated compliance pages, combining automated and manual review, against the standard that applies to your organization. Includes accessibility of the cookie banner, consent forms and opt-out mechanisms, which are frequently excluded from general accessibility work and are exactly where a privacy control becomes unusable.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to assess your website's privacy and accessibility posture?
Elevate Consult reviews cookie configurations, privacy notices, copyright practices and website accessibility in a single engagement, against the regimes that actually apply to your organization, and delivers findings your legal, compliance and technical teams can act on.
FAQ
Common Questions
Does Section 508 apply to our company website?
Only if you are a federal agency, or if the obligation reaches you through a federal procurement contract. Section 508 does not apply to a private organization simply because it operates a public website, and it does not apply merely because an organization receives federal funding. Private businesses face ADA Title III exposure, which carries no federal WCAG deadline but does carry litigation risk, and federal funding recipients face Section 504. Establishing which regime applies is the first step of the review.
We already have a cookie banner. Do we need this?
Having a banner is not the same as being compliant. Common failures include pre-checked non-essential cookies, consent recorded but not enforced, cookies placed before consent, missing categories, no equivalent opt-out path, and unhandled opt-out preference signals such as Global Privacy Control. The review validates that the mechanism works, not that it exists.
Does GDPR compliance satisfy the CCPA?
Partially. There is real overlap on transparency, individual rights and notice disclosures, but the models differ. The GDPR requires a lawful basis and opt-in consent for most cookies. The CCPA operates on an opt-out model for sale and sharing, adds the right to limit use of sensitive personal information, and now requires businesses to confirm that opt-out requests have been processed. The review addresses each framework independently and reports gaps specific to each.
Do EU and UK cookie rules still match?
No. Since February 2026 the UK exempts certain analytics cookies from the consent requirement where only aggregate, non-identifying data is collected, while the EU continues to require prior consent for all non-essential cookies. Organizations serving both markets need jurisdiction-aware consent configuration and documentation of which exemption they rely on.
What is the Trusted Tester process?
A Department of Homeland Security certification process that qualifies testers to perform standardized, reproducible Section 508 conformance testing, currently at version 5.1.3. Unlike automated scanning, which identifies roughly 30 percent of issues, the methodology includes manual testing with assistive technology. It produces a formal attestation against the pages tested rather than a site-wide certification.
Is this a legal review?
No. This is a compliance review assessing website practices against documented regulatory requirements. It does not constitute legal advice and does not substitute for review by qualified counsel. Organizations with complex cross-jurisdictional exposure should engage legal counsel alongside the review.
How often should this be repeated?
Cookie configurations drift as marketing tools are added, so a review at least every six months is the common guidance, plus a review whenever new data collection, a new third-party integration, or a regulatory change lands. The EU and UK divergence in February 2026 and the California regulations effective January 2026 are both examples of changes that invalidated existing configurations without anything on the site changing.