Lesson 5 of 107 minutes
Your website and customer data: accessibility claims, privacy policies, biometrics, and breach notification
Your website is a place of business and a store of personal information, and the law treats it as both. Four things generate claims against small businesses: a website people with disabilities cannot use, a privacy policy that does not match what you do, collecting biometric data without consent, and a data breach handled without the notices the law requires.
Accessibility claims
Title III of the Americans with Disabilities Act, 42 U.S.C. § 12181 and following, requires places of public accommodation to be accessible to people with disabilities. Courts have applied it to business websites, though they differ on whether the website needs a connection to a physical location. The result is a steady volume of demand letters and lawsuits, mostly from a small number of plaintiffs' firms, against businesses whose sites cannot be used with a screen reader or keyboard.
The federal statute does not provide money damages to private plaintiffs; it provides an order to fix the site and the plaintiff's attorney's fees, which is what the demand is really for. Some state laws add damages on top. The common yardstick for whether a site is accessible is the Web Content Accessibility Guidelines, which are a technical standard rather than a law, but which courts and settlements use. An audit against that standard and a remediation plan are the defense and the fix. If a letter has already arrived, the first week is handled like any other claim: see when a demand letter arrives.
Privacy policies
A privacy policy is a promise. It says what personal information you collect, why, who you share it with, how long you keep it, and how a person can contact you about it. Several states require one for any website that collects personal information from their residents, and a growing number of states have broader privacy laws that give residents rights over their data above certain business-size thresholds. The universal rule, from Section 5 of the FTC Act, is simpler: do what your policy says. A policy that promises not to share data while your analytics and advertising tools share it is a deceptive practice.
Inventory what your site actually does before writing the policy. Forms, analytics, advertising pixels, chat widgets and payment processors all collect or share data. The policy has to describe them.
Biometrics: Illinois and beyond
The Illinois Biometric Information Privacy Act, 740 ILCS 14, requires written notice and consent before collecting a biometric identifier such as a fingerprint, face geometry or voiceprint, and a public retention and destruction policy. It allows the person to sue, with liquidated damages of $1,000 per negligent violation and $5,000 per reckless or intentional one. Timeclocks that scan fingerprints and cameras that run facial recognition have produced a large volume of claims. Other states have biometric laws without a private right of action. If you collect biometric data from anyone in Illinois, including employees, get written consent first.
Breach notification
Every state has a law requiring a business that suffers a breach of personal information to notify the affected people, and in many cases the state attorney general, within a defined time. The definitions of personal information, the triggers and the deadlines differ from state to state, and the applicable law is the law of each affected person's state of residence, not yours. This course does not quote a timeline; find the statute through your state attorney general's website and, after a breach, through counsel.
Practical preparation is the same everywhere: know what data you hold and where, keep it only as long as you need it, use a password manager and multi-factor authentication, and have a short written plan for who to call when something goes wrong. The cost of a breach is mostly the cost of not being ready.
Lesson 10 puts these into a calendar.
What you should now know
- ADA Title III has been applied to business websites. Private plaintiffs get an order to fix the site and attorney’s fees; some states add damages.
- A privacy policy must describe what you actually collect and share. Breaking your own policy is a deceptive practice.
- Illinois BIPA requires written consent before collecting biometrics and allows suits for $1,000 or $5,000 per violation.
- Every state has a breach notification law with its own definitions and deadlines, keyed to where the affected person lives.
Questions from this lesson
We are a small local business. Does the ADA really apply to our website?
Courts have applied it to businesses of all sizes, and the demand letters are sent without regard to size. An accessibility audit is inexpensive relative to a claim.
Can I copy a privacy policy from another site?
You can use one as a model, but it has to describe your actual practices and meet the requirements of the states whose residents you serve. A copied policy that promises things you do not do creates liability.
Our fingerprint timeclock is only for staff. Does BIPA apply?
Yes, in Illinois. Employees are covered and have brought many of the claims. Get written consent and publish a retention policy.
How quickly do we have to report a breach?
It depends on the law of each affected person’s state. This course does not quote a number. Find your state attorney general’s guidance and involve counsel immediately after a breach.