Discover the Laws You Need to Know to Protect Yourself
When you search for website law, you are usually asking a simple question: which rules actually apply to my site, and what happens if I ignore them? The answer is less dramatic than the headlines suggest but more layered than most owners expect.
No single statute governs American websites. Instead, roughly a dozen federal laws each cover one activity, such as sending email, collecting data from kids, hosting user comments, or making pages accessible, and the ones that apply to you depend on what your site does.
This guide walks you through each major piece of federal website law in the order you are most likely to encounter them. You will learn what each law requires, who enforces the rule, and what businesses have actually paid for getting things wrong. The goal is to leave you able to look at your own site and know which rules deserve your attention this month and which ones you can set aside.
What Website Law Means for a Small Business
Website law is the practical shorthand for the statutes, regulations, and court decisions that govern how a website collects information, communicates with visitors, displays content, and treats people who use assistive technology. Congress wrote most of these laws for specific problems at specific moments, which is why the rules feel scattered. The FTC Act dates to 1914, the CFAA to 1986, CAN-SPAM to 2003, and the FTC’s fake review rule to 2024, yet all of them can apply to the same small business site on the same day.
A useful way to organize website law is by the activity that triggers each rule. Marketing claims and privacy promises trigger the FTC Act. Collecting data from children triggers COPPA. Sending email triggers CAN-SPAM, and collecting phone numbers for texts triggers the TCPA. Letting the public use your site triggers the ADA, and letting users post content triggers the DMCA and Section 230. Once you match your activities to the triggers, the list of rules you actually need shrinks to a manageable handful.
The FTC Act, Section 5: The Catch-All of Website Law
Section 5 of the Federal Trade Commission Act bans unfair or deceptive acts or practices in commerce, and that single sentence does more work in website law than any other. The FTC uses Section 5 to pursue privacy policies you do not follow, security promises you cannot back up, dark patterns that trick visitors into subscriptions, hidden fees, and misleading product claims. Because the law targets the gap between what you say and what you do, the cheapest compliance step is often to make your website’s promises accurate rather than ambitious.
Enforcement cases show the pattern. In 2023, GoodRx paid $1.5 million and BetterHelp paid $7.8 million after the FTC found both companies shared users’ health information with advertising platforms through tracking pixels while their privacy policies suggested otherwise. In 2022, Fashion Nova paid $4.2 million for suppressing negative customer reviews on its site. The FTC’s business guidance on advertising and marketing makes clear that truth-in-advertising rules apply to every commercial website regardless of size, and the agency regularly pairs Section 5 with the more specific statutes described below.
The FTC Endorsement Guides and the Fake Review Rule
Two FTC rules sit inside Section 5 and matter to almost every site that sells anything. The Endorsement Guides require you to clearly disclose material connections in testimonials, affiliate links, sponsored posts, and influencer content. A “#ad” buried in a caption or an affiliate disclosure hidden on a separate page does not satisfy the standard; the disclosure has to be hard to miss. The FTC updated the guides in 2023 to address social media and to state plainly that the rules apply to small businesses and individual creators, not only large brands.
The fake review rule, effective October 2024, goes further by banning the purchase, sale, or creation of fake reviews and testimonials, review suppression, and undisclosed insider reviews, with civil penalties available of more than $50,000 per violation. If you have ever considered buying reviews to seed a new product page or asking staff to post as customers, this rule is aimed at you. Genuine reviews, including negative ones, remain the safest path.
COPPA: Website Law for Children Under 13
The Children’s Online Privacy Protection Act requires verifiable parental consent before you collect personal information from a child under 13, and applies both to sites directed at children and to general sites that know a particular user is a child. Personal information under COPPA includes names, emails, photos, voice recordings, geolocation, and persistent identifiers like cookies used for behavioral advertising. If your site sells toys, offers tutoring, runs a youth sports league, or hosts kid-friendly games, assume COPPA applies.
The FTC amended the COPPA Rule in 2025, with a compliance deadline of April 22, 2026, to require written data security programs, retention limits, and separate consent before sharing children’s data with third parties for advertising. Enforcement has been steady and expensive. Disney paid $10 million in 2025 for mislabeling child-directed YouTube videos in a way that allowed children’s data to be collected without consent, and game developer Cognosphere paid $20 million in January 2025 for collecting children’s data and failing to act when the company knew specific users were children. Both cases involved ordinary content and advertising practices rather than anything exotic.
CAN-SPAM and the TCPA: The Rules for Email and Text Marketing
The CAN-SPAM Act governs every commercial email you send, whether from a marketing platform or your own inbox. The law requires accurate header information, a subject line that reflects the content, a visible physical mailing address, a working unsubscribe mechanism, and processing of opt-out requests within ten business days. Each separate email that violates the law can carry a penalty of more than $50,000, which turns a sloppy campaign into a serious risk. The good news is that mainstream email tools handle most of the mechanics if you configure them correctly.
The Telephone Consumer Protection Act covers a different channel with higher stakes. If your website collects phone numbers for appointment reminders, order updates, or promotional texts, the TCPA requires prior express consent, and for marketing messages, prior express written consent. Private plaintiffs can recover $500 per message, tripled to $1,500 for willful violations, and class actions against businesses with undocumented consent regularly settle for millions. The consent language on your web form, the checkbox design, and your record of who agreed and when are the pieces that decide these cases.
The ADA and Section 508: Accessibility as Website Law
The Americans with Disabilities Act is the source of more small business lawsuits than any other piece of website law. Title III requires places of public accommodation to be accessible to people with disabilities, and the Department of Justice has consistently treated business websites as covered. The DOJ’s guidance on web accessibility points to the Web Content Accessibility Guidelines, WCAG 2.1 Level AA, as the reference standard, which translates into alt text on images, keyboard-only navigation, sufficient color contrast, captioned video, and properly labeled forms.
Thousands of ADA website suits are filed every year, and small retailers, restaurants, medical practices, and service businesses are frequent targets because a plaintiff can test a site in minutes. Most claims begin with a demand letter seeking a settlement in the $5,000 to $25,000 range, and in states like California, where the Unruh Act adds $4,000 in automatic damages per violation, the stakes climb higher. Overlay widgets that promise instant compliance have not stopped these suits and have appeared as defendants’ tools in some of them. Real fixes to your code and content are the only reliable defense.
Section 508 of the Rehabilitation Act applies a similar accessibility standard to federal agencies and to contractors that build or supply technology to the government. If you sell software, web services, or digital content to a federal agency, Section 508 compliance will appear in your contract requirements. For a business that does not sell to the government, Section 508 is a useful benchmark rather than a legal obligation, though the underlying WCAG standard is the same one the ADA cases rely on.
The DMCA and Section 230: Rules for User Content
If your site lets other people post anything, two laws determine your exposure. The Digital Millennium Copyright Act provides a safe harbor from copyright liability for content uploaded by users, but only if you register a designated agent with the U.S. Copyright Office, post the agent’s contact details on your site, and promptly remove material when you receive a valid takedown notice. Registration costs $6 and renews every three years, making this one of the cheapest steps in all of website law. Skipping registration means a single infringing photo posted by a customer could expose you to statutory damages of up to $150,000 per work.
Section 230 of the Communications Decency Act shields you from liability for most third-party content on your site, such as defamatory reviews or comments, as long as you did not create or materially contribute to the content. The Supreme Court left the law intact in Gonzalez v. Google in 2023, and Congress continues to debate reforms, but for now Section 230 remains one of the strongest protections a small site operator has. The protection does not cover intellectual property claims or federal criminal law, which is why the DMCA registration matters alongside Section 230 rather than instead of the safe harbor.
The CFAA and ECPA: Hacking, Scraping, and Intercepted Communications
The Computer Fraud and Abuse Act is the federal anti-hacking statute, and for you as a site owner the law is mostly a shield: unauthorized intrusions into your systems can be prosecuted. The CFAA also shapes disputes about web scraping and terms-of-service violations. In Van Buren v. United States in 2021, the Supreme Court held that the CFAA punishes accessing areas of a system a person is not allowed to enter, not misusing access a person already has, which narrowed the law considerably. The Ninth Circuit’s hiQ v. LinkedIn decisions reinforced that scraping publicly available pages generally does not violate the CFAA, so if you want to stop scrapers, your terms of service and technical controls matter more than the criminal statute.
The Electronic Communications Privacy Act and its companion, the Stored Communications Act, limit the interception and disclosure of electronic communications. These laws surface in website law through a growing wave of lawsuits claiming that session replay tools, chat widgets, and tracking pixels intercept visitor communications without consent. Federal ECPA claims typically fail when the site operator is a party to the communication, but state analogues like California’s Invasion of Privacy Act allow damages of $5,000 per violation and have proven far more dangerous. Clear consent before non-essential trackers load reduces risk under both federal and state versions.
Sector-Specific Website Law: HIPAA, GLBA, FCRA, FERPA, and the VPPA
Several federal laws apply only when your business handles a particular kind of data, and if none of them describes you, you can skip this section. HIPAA governs protected health information held by healthcare providers, health plans, and their business associates, and reaches your website through appointment forms, patient portals, and tracking technologies. The HHS guidance on online tracking technologies warns that analytics and advertising pixels on patient-facing pages can violate HIPAA, and although a federal court in Texas narrowed that guidance in 2024 for public pages, the rules still apply to authenticated portals. HIPAA penalties reach $1.5 million per violation category per year.
The Gramm-Leach-Bliley Act covers lenders, financial advisors, and some fintech businesses, requiring privacy notices and a written information security program under the FTC’s Safeguards Rule. The Fair Credit Reporting Act governs how you obtain and use consumer reports, including background checks on tenants, employees, or customers, and requires specific disclosures and adverse action notices. FERPA protects student education records, which matters if you build or operate tools for schools. Each of these laws carries agency enforcement and, in the case of FCRA, private lawsuits with statutory damages.
Why the VPPA Suddenly Matters for Any Site With Video
The Video Privacy Protection Act, passed in 1988 after a newspaper published a Supreme Court nominee’s video rental history, has become one of the most active areas of website law. Plaintiffs argue that when a site with video content runs the Meta Pixel or similar tracking, the site discloses users’ viewing history to a third party without consent, triggering statutory damages of $2,500 per person. Courts have split on who counts as a “subscriber” and what counts as a “video tape service provider,” but the Second Circuit’s 2024 decision in Salazar v. National Basketball Association allowed a newsletter subscriber’s claim to proceed, and hundreds of similar suits followed against media companies, retailers, and nonprofits. If your site hosts videos and runs advertising pixels, consider consent banners or removing the pixel from video pages.
Putting Website Law Into Practice
With the individual laws mapped out, the practical question becomes where to start. Nearly every commercial site answers to the FTC Act, the Endorsement Guides, CAN-SPAM, and the ADA, so those four deserve your first attention. The TCPA joins the list the moment you text customers, COPPA applies if children use your site, and the DMCA and Section 230 matter if users can post content. The sector laws depend entirely on your industry. The steps below cover the actions that resolve most risk across all of these laws.
- Read your privacy policy and marketing claims against what your site actually does, and fix every mismatch.
- Confirm your email and text programs capture documented consent and honor opt-outs promptly.
- Test your site against WCAG 2.1 AA with a free tool and repair alt text, contrast, keyboard access, and form labels.
- Inventory every tracking script, and remove or gate behind consent any that touch health, video, or children’s data.
- Register a DMCA agent if users can post content, and disclose affiliate and sponsored relationships clearly.
Once those five steps are complete, website law becomes a maintenance habit rather than a project. Every time you add a marketing tool, launch a campaign, or redesign a page, ask which of the laws above that change touches. That question takes a minute to answer and prevents the drift that turned routine tracking pixels into seven-figure settlements for companies far larger than yours.
Key Takeaways
Website law in the United States is a patchwork of federal statutes, each triggered by a specific activity on your site. The FTC Act and its Endorsement Guides and fake review rule apply to nearly every commercial site and have produced penalties from $1.5 million to $7.8 million for privacy and review violations. COPPA governs children’s data with fines reaching $20 million in recent cases. CAN-SPAM and the TCPA govern email and texts, with TCPA damages of $500 to $1,500 per message driving large class actions. The ADA drives thousands of accessibility lawsuits each year, and the DMCA safe harbor costs $6 to secure. Sector laws like HIPAA, GLBA, FCRA, FERPA, and the VPPA apply only to specific data types, but the VPPA now reaches any site combining video with tracking pixels.
Frequently Asked Questions
Is there one federal website law that covers everything?
No. The United States has no comprehensive federal internet or privacy statute. Website law consists of separate laws for advertising, children’s data, email, texts, accessibility, copyright, and specific industries, plus a growing layer of state privacy laws.
Which website laws apply to a business with no employees?
The FTC Act, CAN-SPAM, the TCPA, COPPA, and the ADA contain no small business exemption. If you sell to the public online, these laws apply. Sector laws like HIPAA and GLBA apply only if you handle the specific data those laws cover.
Do I need a lawyer to comply with website law?
Most of the core rules can be handled with careful reading and the tools built into mainstream website and email platforms. Bring in an attorney if you receive a demand letter or agency inquiry, handle health or financial data, market to children, or operate in a regulated industry.
Does the ADA really apply to websites?
The DOJ and most federal courts say yes for businesses open to the public, and thousands of lawsuits each year proceed on that basis. Some circuits require a connection to a physical location, but relying on that distinction is risky and does not stop demand letters.
What is the cheapest website law step I can take today?
Registering a DMCA agent costs $6 and protects you from copyright claims over user content. Close behind are fixing your privacy policy to match reality and confirming your unsubscribe link works, both of which cost nothing but an hour of attention.
Conclusion
Website law can look like an alphabet soup of acronyms, but the underlying rules are consistent and mostly reasonable: tell the truth in your marketing and privacy policy, get consent before you email, text, or track, make your site usable for everyone, protect the data you hold, and set up the cheap safeguards that shield you from liability for what others post. Every major penalty in this guide came from a business that said one thing and did another. Match your practices to your promises, and you have satisfied most of federal website law before you ever open a statute.
Take the Next Step
Spend one hour this week reviewing your site the way a regulator or plaintiff’s attorney would. Read the privacy policy and check each claim. Click the unsubscribe link in your last campaign. Tab through your checkout without a mouse. Look at your video pages and note which tracking scripts fire. Whatever fails becomes your first project. For more plain-language guidance on federal and state rules, browse our compliance library, scan your website for your risk score below and subscribe so you are updated about changes in website law before they take effect.