Website Legal Risks Every Small Business Should Know

We build websites. We are not lawyers. So I asked Jim Chester, a business attorney who teaches law at SMU's Cox School of Business, a direct question. How do you build a website that doesn't get you sued?

His first answer was honest. "You can't do anything to not get sued." Anyone can sue anyone. The better question is how to lower the odds, and how to be in a position to win fast if it happens.

Here is what I took away. This is not legal advice. It's a list of things to bring to your own lawyer.

Accessibility: there is no checklist

I opened with the Fashion Nova lawsuit over its website's accessibility. Most owners assume there's a list somewhere. Do these eight things and you're compliant. Jim said that list doesn't exist. The ADA says your site has to be accessible. It doesn't spell out exactly how. That gets decided case by case in federal court, and courts don't all read it the same way. He pointed out that Texas sits in the Fifth Circuit, which tends to be more business friendly. California sits in the Ninth, which tends to be more protective. Some states also have their own versions that go further than federal law.

The catch is that your website isn't only in Texas. If you have one visitor in California, you are dealing with California expectations. His advice was to find the highest standard and build to that.

A few practical things he mentioned:

• Make sure the site works with screen readers. Test it.
• Watch your contrast. Light text on a light background is a real problem for people with low vision.
• Fix the cheap stuff. The test is often what's "reasonable." If a fix is simple and you skipped it, a jury may not see that as reasonable.

A perfect accessibility score in a tool doesn't mean you're protected. The law is broader than any score. Risk also depends on the site. A B2B site seen by a few businesses is different from an e-commerce store open to every consumer.

Who gets sued: you, your agency, or both

The business that benefits from the site is the main target, even if someone else built or hosts it. But the contract matters. If an agency promises an "ADA compliant" site and the client gets sued, the client may go after the agency to get paid back. Jim noted that promising to implement accessibility tools is a different commitment than promising compliance. Read what your builder is promising.

Your privacy policy has to match what your site actually does

Jim said privacy policies used to be easy. Now there are real rules. Europe has GDPR. California has its own law. By his count, somewhere between 13 and 17 states have their own data privacy laws, including Texas with the Texas Data Privacy and Security Act.

They aren't identical. One example he gave: in California, a consumer can sue a company directly. In Texas, the attorney general enforces it instead. His practical approach is to take the most protective rule in each area and apply it to everyone, rather than writing a separate section for every state.

The biggest mistake, in his words, is saying you do something you don't, or saying you won't do something and then doing it.

This is where your web team matters. Analytics, cookies and session recording tools all collect data, and most owners don't know what's running. We set up Microsoft Clarity on sites, which records how people move through a page. Useful, but it needs to be disclosed. Jim said the technical side is his weak spot on privacy policies, so he pulls in the web people to ask what the site actually does with data.

Don't let AI write your legal pages

A lot of people now ask ChatGPT to write their privacy policy. Jim uses AI in his own practice, but he said he treats its output like a first-year lawyer. Smart, but prone to mistakes, and someone has to review it.

He once had AI answer a sample contract question for his class. The answer looked great. It applied the wrong body of law in the first sentence, so everything after it was wrong. A non-lawyer would never catch that. AI is a starting point, not a finished policy.

Terms only protect you if people agree to them

Your terms and privacy policy are contracts. But a footer link nobody clicks is hard to enforce.

What works better is an affirmative action. A checkbox before someone submits an order that says they agree to the terms. Under federal law, a click can count as a signature as long as you can show the person agreed.

As Jim put it, "if I don't read it and I click agree, I just signed a contract."

A few related tips:

• Simple brochure site? One combined document may be fine. E-commerce or sign-ups? Keep terms and privacy separate.
• Put key terms, like limits of liability, in bold or caps.
• Review policies when you add features. A five-year-old policy is probably out of date.

You may not own your own website

This was the part that surprised me most. Under copyright law, the creator owns the work by default. Paying for it doesn't change that. "Work for hire" only covers actual employees, not freelancers or agencies.

If you hired someone to make your logo or website, you need a written agreement that transfers ownership to you. Without it, the creator could still own the copyright.

Jim told a story about a client whose freelancer pulled images off Google. A year later, a stock photo company sent a letter. The client had to pay because it was their site. The freelancer had no money to recover.

Make sure every image on your site is licensed. Make sure your contract says the builder has to cover you if they used something they didn't have rights to.

Regulated industries have extra rules

If you need a license to do what you do, your website likely has extra rules. In Texas, Jim said, a law firm's site has to be reviewed by the state bar's advertising committee before it goes live. Healthcare and finance have their own rules too.

Where to start

To find a lawyer, Jim said to ask a professional you trust, like your CPA or banker. Then check the lawyer's state bar profile for disciplinary history. You want to see nothing there.

A new site or rebuild is the right time to get your legal pages reviewed, not after a demand letter shows up. When we build sites at Omis, we flag what the site collects so your lawyer has what they need.

You can watch the full interview with Jim Chester for the rest of the conversation.

Questions people ask

Can a small business website get sued for accessibility? Yes. Jim's point was that the ADA applies to websites but doesn't give you a checklist. Your risk goes up if your site serves the general public. Fixing simple issues like contrast and screen reader support is a reasonable place to start.

Do I need a privacy policy if I only have a contact form? If your site collects any data, including through analytics or cookies, you should disclose it. What matters most is that the policy matches what your site really does.

Do I own the website or logo I paid someone to make? Not automatically. Under copyright law the creator owns it unless there is a written agreement that transfers ownership to you. Check your contract.