Every framework Plumb scans your site against, with jurisdiction, what it means for your site, and what enforcement actually looks like in practice. Each one links to a longer blog deep-dive for the full treatment.
U.S.-scoped. We deliberately do not market against EU / Canadian equivalents (EAA, GDPR, AODA) — see our About page for why.
AccessibilityGlobal · de-facto US standard
WCAG 2.2 (Levels A, AA, AAA)
The Web Content Accessibility Guidelines from the W3C. The legal standard most US courts and agencies reference for digital accessibility. WCAG 2.2 (Oct 2023) added nine new criteria including Focus Not Obscured, Target Size, and Accessible Authentication.
What it means for your site
Every interactive element, form, page, and media asset must meet the level you target. AA is the typical bar.
Enforcement reality
Through ADA Title III litigation, DOJ guidance (April 2024), and state-level consumer-protection statutes.
The Americans with Disabilities Act prohibits discrimination by "places of public accommodation." The DOJ and federal courts now interpret this to cover commercial websites and apps.
What it means for your site
Your website must be usable by people with disabilities — typically demonstrated via WCAG conformance. Private right of action with statutory damages.
Enforcement reality
Plaintiff-driven lawsuits (thousands filed per year in NY, CA, FL). Settlement ranges from $10k for small businesses to $1M+ for class actions.
Federal procurement standard requiring electronic/IT products to be accessible. Section 508 references WCAG 2.0 AA as its conformance benchmark.
What it means for your site
If your organization sells to or contracts with a US federal agency, your public-facing site and procured tools must conform. You will be asked for an ACR / VPAT.
Enforcement reality
Through procurement (lost contracts) and individual federal complaints.
The California Consumer Privacy Act, as amended by CPRA, gives California residents rights over their personal information: notice at collection, deletion, opt-out of sale, limit use of sensitive PI.
What it means for your site
You must display a clear "Do Not Sell or Share My Personal Information" link, a "Limit the Use of My Sensitive Personal Information" link if applicable, honor Global Privacy Control, and maintain a complete privacy policy.
Enforcement reality
California Privacy Protection Agency (CPPA) enforcement actions; private right of action for data breaches. Sephora ($1.2M) and DoorDash ($375k) are recent benchmark settlements.
The intersection of privacy law and tracker-firing UX. Compliant banners offer equally-prominent reject paths, granular categorization, and a way to withdraw consent. Most banners we audit fail at least one of these.
What it means for your site
No non-essential trackers fire until consent. Banner shows accept/reject equally. Granular categories. Persistent re-consent path. Honor Global Privacy Control.
Enforcement reality
Same as CCPA / CPRA — plus class-action pixel litigation against sites that loaded ad pixels on pages with PHI or other sensitive context.
PerformanceGoogle ranking signal · industry commercial standard
Core Web Vitals (LCP / INP / CLS)
Google's three page-experience metrics: Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift. Used as ranking signals and a leading predictor of bounce.
What it means for your site
LCP < 2.5s, INP < 200ms, CLS < 0.1 — at the 75th percentile of real-user field data, measured by the Chrome User Experience Report (CrUX).
Enforcement reality
Not regulatory. Commercial — ranking-signal demotion and increasingly part of enterprise vendor questionnaires.
The Health Insurance Portability and Accountability Act protects PHI. The web-component subset covers transmission and disclosure — PHI in URLs, form security, browser autofill, session handling.
What it means for your site
If your site touches PHI (patient portals, appointment forms, billing), PHI must never appear in URLs, forms must use POST + HTTPS, browser autofill of PHI fields must be disabled, no non-BAA third-party scripts on PHI pages.
Enforcement reality
HHS Office for Civil Rights fines up to $2.07M per category per year (2024 indexed). Willful neglect violations can be criminal.
The Payment Card Industry Data Security Standard. Required by Visa, Mastercard, Amex, Discover, JCB for any organization that accepts cards.
What it means for your site
Checkout must be HTTPS only. Payment forms must POST to HTTPS endpoints. To qualify for the simplest validation level (SAQ-A) you should use a tokenization iframe so the card number never touches your origin.
Enforcement reality
Card-brand fines, increased transaction fees, loss of merchant processing privileges, mandatory forensic audits after a breach.
The Family Educational Rights and Privacy Act protects student education records held by federally-funded institutions.
What it means for your site
If your site handles student records, student PII must never appear in URLs, all student-record pages must enforce HTTPS, forms must use POST, and third-party scripts must be on a strict allowlist.
Enforcement reality
The US Department of Education can withhold federal funding from institutions that violate FERPA. State AGs have parallel authority via state-level ed-data privacy laws.
An AICPA framework for service-organization controls. Buyers in regulated industries (finance, healthcare, federal) often require a SOC 2 Type II report before signing.
What it means for your site
The web-verifiable subset of SOC 2 — CC6.6 boundary protection, CC6.7 restricted transmission, CC6.8 malicious software prevention, CC9.1 risk mitigation — overlaps directly with the HTTP-security and privacy findings on this list.
Enforcement reality
Not a regulation — contractual. A failed SOC 2 audit blocks enterprise deals and triggers re-audit costs.