What Is Digital Compliance?

Most business owners hear the word compliance and picture a lawyer, a binder, and a bill. On a website it is simpler than that. It comes down to two plain questions, and neither one is visible when you glance at your homepage.

Both questions are law. Both are invisible until somebody checks. And both get answered in the same place, which is the code and configuration of the site you already have. That is the whole reason to treat them as one subject rather than two separate scares.

Accessibility, and why you cannot see it from your own laptop

Accessibility is the lane most people have at least heard of, usually as a rumour about fines. The useful version is less dramatic. A page can look perfectly normal and still be impossible to complete with a keyboard, or read out as a meaningless jumble by a screen reader, or fail on contrast for anyone reading it outdoors.

None of that shows up when you look at your own site on your own laptop, which is exactly why it goes unnoticed for years. It surfaces the day someone who is shut out tries to use it, and by then you are finding out from a customer instead of from a check.

Tracking, and why almost nobody chose it on purpose

Almost nobody chose their tracking on purpose. It arrived with a theme, a marketing plugin, a booking widget, or a developer who set up analytics years ago and moved on. Nobody has looked since, and the site has been collecting the whole time.

Two things turn up again and again once you do look. The first is a privacy policy that belongs to the agency who built the site rather than to the business running it, wrong name and wrong domain and all. The second is a consent banner that does not actually consent, where the tags fired before it ever appeared and the reject button changes nothing.

There is also a bill in the background. Bill C-36The Protecting Privacy and Consumer Data Act, tabled June 2026 and still before Parliament was introduced in June 2026 and is at second reading, and it would replace the private sector half of PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law and add penalties measured against global revenue. It is a bill, not a law, and it can still change or die on the order paper. It is worth knowing about and it is not a reason to panic.

Why they belong together

Because they live in the same place. Both gaps are in your site's code, your templates and your tag setup, so one person looking at your site can find both in a single pass. Splitting them into two engagements with two suppliers is how you end up with two half answers that do not talk to each other.

You may not be exposed on both

This is the part almost nobody gets told. Ontario's website accessibility rule keys off headcount: it applies to the public sector and to organizations with 50 or more employees. Privacy law has no such line. A two person shop running Google Analytics can sit outside the accessibility rule and squarely inside the privacy one, while a fifty person company selling into the United States is inside both.

Being under 50 is not the same as being off the hook, and anyone who tells you the AODAAccessibility for Ontarians with Disabilities Act applies to every business with an employee is selling something. What does apply at any size is the Ontario Human Rights CodeOntario's human rights law, which applies at any size and has no employee threshold, which has no threshold and gives a person who is shut out of your site an actual route to a tribunal. That is a quieter argument than a fine, and it is the true one.

So the honest first question is not what does compliance cost. It is which of these two actually applies to me, and the answer is worth knowing before anyone quotes you for anything.