Safe is about the visitor. It means the site collects nothing it does not need, can be used by anyone, and does what it says, and each of those is checkable wherever your buyers are.
Security is about the attacker. Safety is about the visitor. A site can be locked down and still track people without asking, shut out anyone who cannot use a mouse, or promise what the page does not deliver. Here is what we mean by safe, what the law requires where our clients’ buyers are, in the UK, the EU, the USA and Australia, and how to check your own site.
A safe site collects nothing from a visitor that it does not need, and says plainly what it does collect. It can be used by anyone, whatever device they have and however they need to use it. And it does what it says: the form sends, the number rings, the price is the price. An owner can check each in a few minutes.
The rules differ by country, but they point the same way: collect less, and say what you collect. The UK and the EU also ask for a reason before anything is set on a visitor’s device.
United Kingdom. The rules changed on 5 February 2026. They now cover any technology that stores or reads information on a device, and also “collecting or monitoring information automatically emitted” by it, which catches the cookieless analytics tools sold as needing no consent. A new exception allows a site to measure its own use without asking, provided the sole purpose is improving the site, the visitor is told plainly, and there is a simple, free way to object.
European Union. The rule is stricter. Storing or reading anything on a visitor’s device needs consent after clear information, unless it is strictly necessary for a service the visitor asked for. The European Data Protection Board confirmed in October 2024 that this covers tracking pixels and device fingerprinting, not only cookies. The GDPR applies to any company, wherever it is, that offers goods or services to people in the EU, so a UK or US manufacturer selling into Europe is covered. It must process only the data necessary for its purpose and must tell people who it is, why it collects the data, on what legal basis, for how long, and what their rights are, in clear and plain language.
United States. There is no federal privacy law for business websites. California’s law applies to for-profit businesses that do business in California and have over $26.6 million in revenue, or hold data on 100,000 or more Californians, or make half their revenue selling personal information. Those businesses must give a notice at collection, treat a browser’s Global Privacy Control signal as an opt-out and, if they sell or share data for advertising, show a “Do Not Sell or Share My Personal Information” link. A second California law has no threshold: any site that collects personal information from Californians must post a privacy policy that says what it collects, whether other companies can track visitors through it, and how it responds to a browser’s Do Not Track signal. Other states have passed laws on the same pattern. Below those thresholds the Federal Trade Commission still acts against hidden fees, subscriptions that are hard to cancel, and privacy settings defaulted to maximum collection.
Australia. The Privacy Act covers organisations with annual turnover over AUD 3 million, and smaller ones that trade in personal information or provide health services. A covered organisation must have a clear privacy policy, tell people what it collects and why at the point of collection, and take reasonable steps to protect what it holds. There is no cookie-consent rule of the European kind.
So a business site can run with no consent banner in all four places, if it uses nothing that needs consent. Ours uses nothing that needs consent, so it has no banner, and the privacy notice says exactly what is collected. If we add analytics, it will ask first. A marketing pixel, an embedded video that sets its own cookies or a chat widget that profiles visitors needs the same real choice before it loads in the UK and the EU. In the United States it may load first, but a business that California’s law covers must let visitors refuse it and must honour the browser’s privacy signal. We build to the UK rule wherever the visitor is.
A contact form collects your name, your address and your message because you asked for a reply. We keep it as long as the conversation needs and say so. A form that quietly adds you to a mailing list is not a safe form anywhere.
Many people use the web in ways designers forget: on a mobile phone in sunlight, with text zoomed to twice its size, with a screen reader, with a keyboard alone. The standard that makes “usable by anyone” concrete is the Web Content Accessibility Guidelines, version 2.2, at level AA. The law behind it differs by country; the standard does not.
United Kingdom. The Equality Act 2010 puts a duty on anyone providing a service to the public to make reasonable adjustments. A website is a service.
European Union. The European Accessibility Act applies to products and services placed on the market after 28 June 2025, and online shops are covered. Service businesses with fewer than 10 employees and under EUR 2 million turnover are exempt.
United States. The Department of Justice’s position is that the Americans with Disabilities Act applies to the goods and services a business offers on the web. No version of WCAG is mandated for businesses. For state and local governments the Department has set WCAG 2.1 AA, with deadlines in 2027 and 2028.
Australia. The Disability Discrimination Act 1992 makes it unlawful to discriminate in providing goods, services and facilities. The Australian Human Rights Commission’s April 2025 guidelines recommend WCAG 2.2 Level AA or higher for websites, online shops and apps.
WCAG 2.2 added nine criteria to the previous version. The ones that catch business sites most often are target size (things you tap must be at least 24 pixels across), dragging movements (anything you drag must also work without dragging), focus not obscured (a sticky header must not hide what the keyboard has selected), and redundant entry (a form must not ask for the same thing twice). We build to 2.2 AA, which meets or exceeds what any of the four requires, and publish an accessibility statement that says what was tested, what is known not to pass yet, and how to report a problem. A statement that claims full compliance with no list of exceptions is a statement nobody tested.
The third part of safe is the plainest. The form should deliver the message and tell you it has. The phone number should ring. A price shown should be the price charged. A button marked “Download the data sheet” should download the data sheet, not open a form. The company behind the site should be identifiable; UK companies must show their registered name and number on their websites, and a site anywhere that hides who runs it is telling you something. Surveys of industrial buyers say they leave supplier sites over gated content, missing prices and forms that do not work.
The Websites page builds to all six. The Privacy page is the notice this definition requires, and the Accessibility statement is the dated record. The Website Risk Analysis checks your site against the same list and tells you what fixing each failure would take.
If the five-minute check turned up something you did not expect, talk to an engineer. Tell us what you found and where your buyers are. We will tell you whether it matters and what it would take to put right.