plumb

Reference

Standards we audit — in plain English

Every framework Plumb scans your site against, with jurisdiction, what it means for your site, and what enforcement actually looks like in practice. Each one links to a longer blog deep-dive for the full treatment.

U.S.-scoped. We deliberately do not market against EU / Canadian equivalents (EAA, GDPR, AODA) — see our About page for why.

AccessibilityGlobal · de-facto US standard

WCAG 2.2 (Levels A, AA, AAA)

The Web Content Accessibility Guidelines from the W3C. The legal standard most US courts and agencies reference for digital accessibility. WCAG 2.2 (Oct 2023) added nine new criteria including Focus Not Obscured, Target Size, and Accessible Authentication.

What it means for your site

Every interactive element, form, page, and media asset must meet the level you target. AA is the typical bar.

Enforcement reality

Through ADA Title III litigation, DOJ guidance (April 2024), and state-level consumer-protection statutes.

ADA LawUnited States — federal

ADA Title III

The Americans with Disabilities Act prohibits discrimination by "places of public accommodation." The DOJ and federal courts now interpret this to cover commercial websites and apps.

What it means for your site

Your website must be usable by people with disabilities — typically demonstrated via WCAG conformance. Private right of action with statutory damages.

Enforcement reality

Plaintiff-driven lawsuits (thousands filed per year in NY, CA, FL). Settlement ranges from $10k for small businesses to $1M+ for class actions.

Section 508United States — federal contractors

Section 508

Federal procurement standard requiring electronic/IT products to be accessible. Section 508 references WCAG 2.0 AA as its conformance benchmark.

What it means for your site

If your organization sells to or contracts with a US federal agency, your public-facing site and procured tools must conform. You will be asked for an ACR / VPAT.

Enforcement reality

Through procurement (lost contracts) and individual federal complaints.

SecurityIndustry baseline · multi-framework

HTTP security headers

Six baseline response headers — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — that prevent XSS, clickjacking, traffic downgrade, and tracker injection.

What it means for your site

Set the right header values site-wide. Most sites we audit miss at least three of the six.

Enforcement reality

Not a regulation, but a documented control under SOC 2 CC6.7, HIPAA § 164.312, PCI-DSS Req 4, and every enterprise vendor security questionnaire.

PrivacyUnited States — California

CCPA / CPRA (California)

The California Consumer Privacy Act, as amended by CPRA, gives California residents rights over their personal information: notice at collection, deletion, opt-out of sale, limit use of sensitive PI.

What it means for your site

You must display a clear "Do Not Sell or Share My Personal Information" link, a "Limit the Use of My Sensitive Personal Information" link if applicable, honor Global Privacy Control, and maintain a complete privacy policy.

Enforcement reality

California Privacy Protection Agency (CPPA) enforcement actions; private right of action for data breaches. Sephora ($1.2M) and DoorDash ($375k) are recent benchmark settlements.

PrivacyMulti-state · privacy umbrella

Cookie consent & trackers

The intersection of privacy law and tracker-firing UX. Compliant banners offer equally-prominent reject paths, granular categorization, and a way to withdraw consent. Most banners we audit fail at least one of these.

What it means for your site

No non-essential trackers fire until consent. Banner shows accept/reject equally. Granular categories. Persistent re-consent path. Honor Global Privacy Control.

Enforcement reality

Same as CCPA / CPRA — plus class-action pixel litigation against sites that loaded ad pixels on pages with PHI or other sensitive context.

PerformanceGoogle ranking signal · industry commercial standard

Core Web Vitals (LCP / INP / CLS)

Google's three page-experience metrics: Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift. Used as ranking signals and a leading predictor of bounce.

What it means for your site

LCP < 2.5s, INP < 200ms, CLS < 0.1 — at the 75th percentile of real-user field data, measured by the Chrome User Experience Report (CrUX).

Enforcement reality

Not regulatory. Commercial — ranking-signal demotion and increasingly part of enterprise vendor questionnaires.

HIPAAUnited States — federal (healthcare)

HIPAA — web component

The Health Insurance Portability and Accountability Act protects PHI. The web-component subset covers transmission and disclosure — PHI in URLs, form security, browser autofill, session handling.

What it means for your site

If your site touches PHI (patient portals, appointment forms, billing), PHI must never appear in URLs, forms must use POST + HTTPS, browser autofill of PHI fields must be disabled, no non-BAA third-party scripts on PHI pages.

Enforcement reality

HHS Office for Civil Rights fines up to $2.07M per category per year (2024 indexed). Willful neglect violations can be criminal.

PCI-DSSGlobal — card-brand contractual

PCI-DSS — web component

The Payment Card Industry Data Security Standard. Required by Visa, Mastercard, Amex, Discover, JCB for any organization that accepts cards.

What it means for your site

Checkout must be HTTPS only. Payment forms must POST to HTTPS endpoints. To qualify for the simplest validation level (SAQ-A) you should use a tokenization iframe so the card number never touches your origin.

Enforcement reality

Card-brand fines, increased transaction fees, loss of merchant processing privileges, mandatory forensic audits after a breach.

FERPAUnited States — federal (education)

FERPA — web component

The Family Educational Rights and Privacy Act protects student education records held by federally-funded institutions.

What it means for your site

If your site handles student records, student PII must never appear in URLs, all student-record pages must enforce HTTPS, forms must use POST, and third-party scripts must be on a strict allowlist.

Enforcement reality

The US Department of Education can withhold federal funding from institutions that violate FERPA. State AGs have parallel authority via state-level ed-data privacy laws.

SOC 2Global — auditor-attested

SOC 2 (Trust Services Criteria)

An AICPA framework for service-organization controls. Buyers in regulated industries (finance, healthcare, federal) often require a SOC 2 Type II report before signing.

What it means for your site

The web-verifiable subset of SOC 2 — CC6.6 boundary protection, CC6.7 restricted transmission, CC6.8 malicious software prevention, CC9.1 risk mitigation — overlaps directly with the HTTP-security and privacy findings on this list.

Enforcement reality

Not a regulation — contractual. A failed SOC 2 audit blocks enterprise deals and triggers re-audit costs.