What Actually Happens If You Are Not Compliant

The Real Numbers, Not the Scary Ones

By Tyler Hackbart• 3 weeks ago •9 min read

Search for what happens if your website is not compliant and you will find the same number nearly everywhere: one hundred thousand dollars a day. It usually appears in bold, and usually near a button.

It is a real number. It is written in the legislation. As far as the public record shows, it has also never been issued to anyone.

We build and test websites for compliance, so telling you the fines are terrifying would be good for our business. Here is the honest version instead, and then the part that actually matters.

Almost every number you see is a ceiling

Most compliance marketing quotes maximums. A maximum is what a court could impose after a prosecution, in the worst case anyone drafting the law could imagine. It is not a price list, and it is not what regulators reach for.

What they reach for instead is an administrative penalty, graded by severity and history, usually preceded by an order telling you to fix the thing. Here is how each regime looks once you separate the two.

What each regime quotes, and what it actually issues
Regime	The number you will see	What actually happens
	$100,000 a day	Hundreds to low thousands, and usually just an order to comply. Every reported penalty has been for failing to file the report, not for an inaccessible website
	Rarely mentioned by anyone	Damages, remediation orders and published reasons, at any company size
	Court determined	A published finding. The Commissioner cannot fine, but the Federal Court can award damages, and a class action is the real financial risk
	$10 million or 2 percent, plus penal fines to $25 million or 4 percent	A $15,000 minimum penal fine for corporations, doubling on a repeat offence. The sharpest of these on paper. Its regulator says it reaches businesses outside Quebec; no court has tested that
	$10 million per violation	About $1.4 million payable across the whole program since 2014, per the 's May 2021 summary
	Proposed $10 million or 3 percent	Introduced 15 June 2026 and at second reading. Not law, and it can still change or die
United States	Varies widely by source	No size exemption, and demand letters are routine
European Accessibility Act	Set by each member state	Applies if you sell into the EU, whatever your address. Accessibility only; the EU consent rules are separate

A few of those deserve a sentence more than the table can hold.

The ones worth knowing in detail

Under the , the penalties actually issued have been small, in the hundreds to low thousands of dollars, and most of the time what arrives is an order to comply rather than a penalty at all. The part worth knowing is what they were for. Every reported AODA penalty has been for failing to file an accessibility compliance report. There is no publicly reported case of an Ontario business being fined over an inaccessible website. The cost of an order to comply is the remediation you should have done anyway.

The part nobody markets is the part that is real. If you have twenty or more employees in Ontario, you file an accessibility compliance report with the province by December 31, 2026. It is a self attestation. A person signs it. That obligation is dated, certain, and personal in a way that no penalty maximum is.

The has no employee threshold at all. Someone who cannot use your site can bring an application to the Human Rights Tribunal, and there is no twenty or fifty employee carve out, because it is not the . For a small business this is a larger practical exposure than the AODA route, and almost nobody sells against it.

is the opposite of what the marketing implies. The Privacy Commissioner has no order making power and no power to issue fines at all. The route to money is a Federal Court application, and the precedent is modest: in Chitrakar v Bell TV the Federal Court awarded $10,000 in general damages, $10,000 in exemplary damages and $1,000 in costs, and in Nammo v TransUnion the award was $5,000. Neither was about website tracking. The real risk in this lane is a class action, not the regulator.

is the sharpest of these on paper. It has been in force in stages since September 2022, with the private right of action and data portability following in September 2023. On whether it reaches a business outside Quebec, the position to know is the regulator's: Quebec's privacy regulator takes the view that the law applies to organizations outside Quebec that collect the personal information of people in Quebec. That is the regulator's stated position and it has not been tested by a court, so treat it as a live risk rather than a settled rule. Its cookie provisions are separately contested. If Quebec is a real market for you, get a lawyer to look. If it is not, it is not your problem today.

The United States is the asymmetry Canadians consistently underrate. Title III has no size exemption whatsoever, enforcement comes from individual plaintiffs rather than a regulator, and demand letters are a functioning industry. Selling to American customers from Canada puts you within reach.

The European Accessibility Act has applied since 28 June 2025 to anyone offering digital products and services into the EU, wherever they are based. It is worth being precise about what it is: an accessibility statute. It sets accessibility requirements, and it contains no consent or tracking rule at all. The prior consent requirement people tend to attach to it comes from somewhere else, the ePrivacy Directive and the , which is what obliges a site to ask before it sets a non essential cookie. If you sell into Europe both sets of rules reach you, but they are separate instruments and conflating them leads businesses to fix the wrong thing. The European consent model is a different build from Canada's notice and opt out approach, not an adjustment.

And is the one that inverts the pattern. The maximum is ten million dollars per violation, and unlike the Privacy Commissioner the genuinely does issue penalties. Yet in its May 2021 enforcement summary the CRTC put the total across the whole program since 2014 at just over one point four million dollars, and its own word is payable rather than collected. Enforcement has continued since, including a one hundred and twenty thousand dollar undertaking with Hudson's Bay in 2024. The most active regulator in this space has still, across a decade, seen less than one seventh of a single maximum become payable.

Now count how many apply to you

Here is the part the individual numbers hide. Nobody is subject to one of these.

Take an ordinary Ontario shop selling online. It has employees, so the and the Human Rights Code are live. It collects customer information, so applies at any size. It sends marketing email, so applies. It ships to American customers, so the applies with no size exemption. If it has Quebec customers, add Law 25. If it ships to Europe, add the Accessibility Act.

That is four to six regimes at once, and the same handful of gaps sits underneath all of them. No privacy policy is a problem and a Law 25 problem and a problem. An unusable checkout is an problem and a Human Rights Code problem and an problem and a European one. You are not rolling one die a year. You are rolling several, every year, and the odds stack even when each individual one is low.

Which is also the good news, and the actual reason to do this. The work overlaps almost completely. One privacy policy that honestly names what your site collects satisfies most of the privacy side at once. One properly built checkout satisfies the accessibility side across every jurisdiction you sell into. You are not buying compliance with six regimes. You are fixing a small number of things once.

So why do this at all?

Four reasons. Fines are one of them, just not the version you were sold.

The penalties are real, and every movement in the last five years has made them stricter rather than lighter. Quebec introduced administrative penalties where there had been none, and carries a fifteen thousand dollar minimum penal fine that doubles on a repeat offence. The has been issuing penalties since 2014 and continues to. Europe's accessibility rules came into force in 2025 and reach Canadian businesses selling there. , which is not law and is only at second reading, proposes ten million dollars or three percent of gross global revenue. Nothing in that list has moved in the other direction.

Someone signs the form. If you are over twenty employees in Ontario, the December 31 report is a self attestation. Not a corporate abstraction, a person putting their name to a statement about whether your site meets a standard. Worth knowing the answer before you sign rather than after.

You are already losing customers. Statistics Canada's 2022 Canadian Survey on Disability put the share of Ontarians aged 15 and over with one or more disabilities at 28 percent, which is closer to one in four than the one in five figure still quoted from its earlier survey. If your checkout cannot be completed with a keyboard, that is not a risk you might one day face. It is revenue you have not been collecting for years.

And it costs a fraction now. Every remediation we have done against a deadline, a complaint or an American demand letter cost several times what the same work costs on an ordinary Tuesday. The demand letter is the one you cannot plan around, because it arrives on somebody else's schedule.

What that looks like

We test your site against the standards that actually apply to you, and hand you the evidence. Every criterion checked, what passed, what failed, a screenshot of each failure, and what it takes to fix. Fixed fee, quoted before we start, so you know the number going in.

If you want the fixes done too, that is a separate quote once we both know what is actually there. We would rather scope that from evidence than from a guess, and so would you.

What you get is a test report, not a legal opinion. It says what was tested, on what date, by what method, and what the results were. That is a document you can hand to your lawyer, your board, or whoever signs the December filing, and they can rely on it because it does not overreach.

This is general information about how these regimes work. It is not legal advice about your situation, and it does not determine your compliance status. If you are relying on any of it for something that matters, have a lawyer review it.