Ecommerce compliance for agencies: managing client risk and building recurring revenue

Ecommerce agencies build and maintain the sites that get sued, fined and breached. Your clients own the legal liability, but they hold you accountable when compliance failures trace back to code you wrote or themes you installed. Understanding the full cost of ADA compliance helps frame the conversation with clients.

More practically: compliance is a revenue opportunity. Mid-market ecommerce brands need ongoing compliance monitoring, and most agencies are not offering it. The agency that builds compliance into its standard offering captures recurring revenue and becomes very difficult to replace.

Why agencies need to care about compliance

Three types of risk make compliance a priority for agencies:

Contractual liability

Most agency contracts include some form of warranty that delivered work will function correctly and meet applicable standards. When a client receives an ADA lawsuitand traces violations to a theme the agency built, the client's attorney will look at that warranty clause. "Applicable standards" increasingly includes WCAG 2.1 AA. Agencies without explicit accessibility disclaimers in their contracts face real exposure.

This is not theoretical. ADA web accessibility lawsuits hit 3,117 federal filings in 2025, up 27% year over year. Ecommerce sites are the most common targets. When the client's legal team investigates, the agency that built the checkout is in the conversation.

Reputational damage

A client that gets sued for an ADA violation will ask: why did my agency not catch this? Even with contractual protection, the reputational damage from being the agency that built an inaccessible site for a brand that was then sued is significant. In the Shopify Plus and BigCommerce partner communities, word travels fast.

The opportunity cost of not offering it

Compliance monitoring is a recurring revenue service. Our guide on continuous monitoring vs annual audits explains why ongoing scanning matters more than point-in-time checks. If you are not offering compliance monitoring, your clients are either paying another vendor for it or not doing it at all. The first scenario means you leave retainer revenue on the table. The second means your clients accumulate risk that eventually becomes a crisis you will be called to help with under emergency conditions.

The four compliance pillars agencies must know

Agencies do not need to be legal experts. But you do need working knowledge of four regulatory areas to build compliant sites and advise clients:

For deeper dives on each area, see our guides on WCAG 2.1 AA compliance, PCI DSS 4.0 requirements, Google Consent Mode V2 and US state privacy laws.

Building compliance into the development process

The most cost-effective approach is making compliance part of every project, not an optional add-on. Fixing accessibility at the design stage is 5-10x cheaper than retrofitting after launch.

• Compliance assessment at brief stage. When scoping a new project, assess which regulations apply. What markets will the store serve? US, EU, both? This determines the compliance scope. An EU store needs a CMP implementation from day one, not as an afterthought after launch.
• Accessibility in design review. Before a design goes to development, check color contrast ratios, focus state visibility, touch target sizes and font minimums. Catching these in design is trivial; fixing them in a built theme is expensive.
• Semantic HTML standards. Enforce semantic HTML as a development standard. Headings in order (h1 through h6), proper ARIA labels, accessible form markup and keyboard-navigable components. These are not extra work. They are correct HTML.
• Script audit for payment pages. Before launching any page that touches checkout, audit every script loaded on that page. No unapproved third-party scripts on checkout pages. This is a hard rule. One violation can trigger a PCI assessment. See our guide on tag manager PCI compliance.
• Pre-launch compliance scan. Every project before launch should include an automated scan. The scan output becomes part of the project deliverables. Critical violations are fixed before launch; moderate violations are documented and scheduled.
• Accessibility statement template. Provide clients with an accessibility statement as part of launch deliverables. A published statement demonstrates good-faith effort and is important for ADA defense.

Pre-launch compliance checklist

Use this as a standard pre-launch gate for every client project:

Print this, pin it to your project management board and make it a sign-off requirement. No project launches without clearing the "must-fix" items.

Compliance as a retainer service

Ecommerce stores change constantly. Theme updates, new apps, seasonal campaigns, A/B tests and content changes all introduce new compliance risk. A compliance scan at launch goes stale within weeks. Clients need ongoing monitoring, not a one-time certificate.

The retainer model works because:

• Recurring revenue. Monthly compliance monitoring at $500 to $1,500 per store creates predictable revenue. For an agency with 30 clients, that is $15,000 to $45,000 per month from compliance retainers alone.
• Stickiness. An agency that monitors a client's compliance and maintains their violation history becomes very hard to replace. The switching cost is not just the relationship. It is institutional knowledge of the client's compliance trajectory.
• Cross-sell to remediation. Every compliance scan generates remediation work. Critical violations discovered in monitoring become development tickets. Monitoring feeds development retainers. The compliance retainer is a self-generating sales pipeline for development work.
• Legal protection. If a client gets sued after you have been running compliance monitoring, the monitoring history is evidence of good-faith ongoing effort. It protects both the client and the agency.

What to include in a compliance retainer

• Weekly or monthly automated scanning (all four pillars: accessibility, PCI, privacy, AI transparency)
• Monthly one-page compliance report: score, score trend, new violations, resolved violations, top 3 priority fixes
• Regulatory update alerts when relevant laws change (new state privacy laws, EAA enforcement actions, PCI DSS clarifications)
• Priority access to remediation development (billed separately)
• Quarterly 30-minute compliance review call with the client's ecommerce lead

Pricing compliance services

Agency compliance ROI

A realistic calculation for a 20-store agency adding compliance services:

The monitoring retainer is the anchor. It generates predictable revenue and feeds the remediation pipeline. Remediation sprints are where the volume comes from. Combined, compliance services can represent 15-25% of a mid-size agency's total revenue within 12 months.

Tools for agency-scale compliance monitoring

The tooling requirements for an agency managing 10 to 50 stores:

• Multi-site scanning dashboard. A single interface that runs scans across all client stores and surfaces results in a central view. You should not need to log into each client's site separately. Look for tools that support agency accounts with per-client subaccounts and white-label reporting.
• Automated scheduling. Scans should run on a schedule (weekly or monthly) without manual triggering. Results should be emailed to the account manager and client contact automatically.
• Severity prioritization. The scan output must distinguish critical violations (block purchase, lawsuit risk) from moderate and minor issues. Account managers are not accessibility specialists. They need the tool to surface what requires immediate action.
• Historical comparison. Compare current scan results to previous scans. This shows clients whether compliance is improving, stable or degrading. It also identifies when a theme update or app install introduced new violations.
• Multi-pillar coverage. A tool that scans only accessibility is not enough. Agencies need scanning across accessibility, PCI DSS, privacy and cookie consent to provide comprehensive monitoring. Four separate tools for four pillars is operationally unsustainable at scale.
• Client-ready reports. Reports that can be sent directly to clients without requiring translation by account managers. A compliance score, severity summary and top-priority fixes are what clients need. Technical details should be available but not be the default view.
• API access. For agencies that want to integrate compliance data into their existing reporting stack or client portals. API access lets you pull scan results into Databox, Google Data Studio or custom dashboards.

Client education and reporting

Most ecommerce brand contacts do not understand compliance regulations in detail. Your job is to translate technical violations into business risk they can act on:

• Frame violations in business terms. "Your checkout form has 7 WCAG violations matching the pattern cited in 43% of 2025 ADA complaints" lands better than "you have missing form labels." The lawsuit risk framing gets attention and budget approval.
• Monthly compliance report. One page: compliance score, score change from last month, new violations introduced, violations resolved, top three priority fixes this month. Short enough to read in five minutes. Specific enough to be actionable.
• Quarterly compliance review call. A 30-minute call with the client's Head of Ecommerce. Review the quarter's compliance performance, preview upcoming regulatory changes and set priorities for the next quarter. This is the most valuable touchpoint for justifying the retainer.
• Regulatory change alerts. When a material regulatory change happens (new state privacy law, EAA enforcement action, PCI DSS deadline), send clients a brief summary of what it means for their store. Position your agency as the proactive compliance partner, not a task executor.
• Annual compliance summary. A year-end report showing compliance improvement over 12 months, violations prevented and regulatory changes navigated. This is your retainer renewal document. The data sells itself.

Platform-specific considerations

The compliance requirements are the same regardless of platform. The implementation details differ:

Shopify / Shopify Plus

• Accessibility. Shopify themes have baseline accessibility, but custom sections, apps and checkout customizations frequently introduce violations. Common Shopify accessibility issues include missing skip navigation, inaccessible dropdown menus and poor cart update announcements.
• PCI. Shopify handles PCI compliance for the checkout by default when using Shopify Payments. But stores using custom checkout scripts, third-party payment gateways or checkout extensibility apps can introduce PCI risks. Audit scripts on checkout pages.
• Privacy. Use a CMP app (Pandectes, CookieYes or Cookiebot) with Consent Mode V2. Shopify's native consent management is insufficient for GDPR compliance.

WooCommerce

• Accessibility. WooCommerce accessibility depends heavily on the WordPress theme. Premium themes vary widely. Audit the theme, all plugins that output frontend content and the WooCommerce checkout flow specifically.
• PCI. WooCommerce stores using direct payment integrations (not hosted checkout) have higher PCI scope. Ensure hosted payment pages or iframed payment fields are used. Audit all plugins on checkout pages.
• Privacy. Use Complianz (WordPress-native) or CookieYes plugin. Configure Consent Mode V2 via GTM4WP. WordPress plugin updates can silently introduce new cookies. Monitor after every plugin update.

Magento / Adobe Commerce

• Accessibility. Magento's Luma theme has known accessibility gaps. Magento accessibility requires custom work for WCAG compliance. Headless Magento (PWA Studio, Hyvae) introduces additional headless accessibility challenges.
• PCI. Magento stores have broader PCI scope than hosted platforms. CSP headers, SRI and payment page script inventories are critical. Magento 2.4+ has built-in CSP support but requires configuration.
• Privacy. Magento's CMP options are less plug-and-play. Usercentrics or OneTrust have the strongest Magento integrations. Expect more implementation time than Shopify or WooCommerce.

BigCommerce

• Accessibility. BigCommerce accessibility depends on the Stencil theme. Default themes have reasonable baseline accessibility. Custom themes and third-party apps need auditing.
• PCI. BigCommerce handles PCI for the checkout by default. Script injection risks are lower than WooCommerce or Magento. Still audit scripts loaded via Script Manager on checkout pages.
• Privacy. CMP implementation via Script Manager or Stencil theme code. Cookiebot or CookieYes via JavaScript embed. Less native integration support than Shopify or WooCommerce.

Liability and contract protection

Agency contracts need explicit compliance-related clauses. Without them, you are exposed:

• Client responsibility for regulatory compliance. State clearly that the client, not the agency, is responsible for ensuring their store meets all applicable legal requirements. The agency delivers work meeting specified technical standards. Compliance with specific legal requirements is the client's obligation.
• Accessibility scope definition. Define what your accessibility work covers. "Automated WCAG 2.1 AA scan passing" is a different scope than "manual accessibility audit by a certified specialist." Be specific about what your pre-launch scan does and does not cover. Automated tools catch ~30-40% of WCAG violations; manual testing catches more.
• Third-party app exclusion. Explicitly exclude third-party apps installed by the client from your compliance warranty. You built the theme. You did not vet every app the client installed after handoff. Your warranty should not cover app-introduced violations.
• Monitoring scope and limitations. If you offer compliance monitoring as a retainer, define what is monitored, at what frequency and what the agency's obligation is when violations are detected. Typically: alert the client within X business days. Remediation is a separate scope of work billed separately.
• Limitation of liability. Cap your compliance-related liability at the fees paid for the specific service. Without a cap, a client's $50,000 ADA settlement could become your liability if the violation traces to your code.

Using compliance to win new clients

Compliance capability is a differentiator in pitches and RFPs. Most competing agencies cannot articulate a compliance strategy:

• Run a free scan on the prospect's current site. Include the results in your pitch deck. "Your current site has 47 WCAG violations, including 12 critical issues on your checkout page" is a compelling opening slide. It demonstrates capability and creates urgency.
• Include a compliance section in RFP responses. Cover how you handle accessibility in the build process, how you scope PCI compliance and what ongoing monitoring you offer post-launch. Most RFP responses from competing agencies will not have this section.
• Reference specific regulations for the prospect's market. If the prospect sells to EU customers, mention EAA, GDPR and your Consent Mode V2 implementation approach. Regulatory-specific knowledge signals expertise that generic "we build accessible sites" claims do not.
• Show a sample compliance report. A sample monthly report is a concrete, tangible differentiator. It shows the prospect what ongoing monitoring looks like, not just what it says in a scope of work.
• Quantify the risk. "3,117 ADA lawsuits were filed against ecommerce sites in 2025. Average settlement: $15,000. Your checkout has the same violation pattern as 43% of those cases." Numbers win budget approvals.

Frequently asked questions

Are ecommerce agencies liable for client website compliance?

Agencies face contractual liability when violations trace back to code they wrote or themes they installed. Most contracts include warranties that work meets applicable standards. WCAG 2.1 AA is increasingly considered applicable in ADA lawsuits. Without explicit disclaimers, agencies are exposed when clients are sued.

How much can agencies charge for compliance monitoring?

Monthly retainers typically range from $500 to $1,500 per store. For an agency with 30 clients, that is $15,000 to $45,000/month in recurring revenue. One-time audits run $3,000 to $8,000. Remediation sprints are $2,000 to $10,000 per sprint.

Should agencies include accessibility in every project?

Yes. Building compliance into the standard process is 5-10x cheaper than retrofitting. Include it in design review, development standards, pre-launch scanning and script review for payment pages. A pre-launch compliance scan should be a mandatory deliverable.

What regulations do ecommerce agencies need to know?

Four areas: WCAG 2.1 AA accessibility (ADA in the US, EAA in the EU), PCI DSS 4.0 for payment page security (requirements 6.4.3 and 11.6.1), GDPR and cookie consent for EU stores, and US state privacy laws (CCPA/CPRA plus 24+ state laws) for US stores.

How do agencies manage compliance across multiple stores?

Use centralized scanning with per-client dashboards. Run automated weekly or monthly scans. Generate client-ready reports with compliance scores and prioritized violations. One compliance lead at the agency can manage 20-30 accounts with the right tooling.

What should a compliance retainer include?

Automated scanning (weekly or monthly), a monthly one-page report (score, trends, top fixes), regulatory update alerts, priority access to remediation development (billed separately), and a quarterly review call with the client's ecommerce lead.

How do agencies protect themselves from compliance liability?

Four contract clauses: (1) client owns regulatory compliance responsibility, (2) define the specific standard your work targets (e.g., automated WCAG 2.1 AA testing), (3) exclude client-installed third-party apps from your warranty, and (4) cap compliance-related liability at fees paid.

What is the ROI of adding compliance services?

For a 20-store agency at $750/store/month average retainer plus remediation work, compliance services add roughly $480,000/year in revenue. Costs are one compliance lead ($50-80K) plus tooling ($5-15K/year). Gross margin on monitoring retainers is 60-75%.

How do agencies handle Shopify Plus vs WooCommerce compliance?

Requirements are identical. Implementation differs: Shopify has a more controlled environment (lower PCI risk) but limited customization. WooCommerce offers more control but more plugin-related risks. Agencies should maintain platform-specific checklists for each.

How do agencies use compliance to win new clients?

Run a free scan on the prospect's current site and include results in your pitch. Include a compliance section in RFP responses. Show a sample monthly report. Reference specific regulations for the prospect's market. Quantify the risk with ADA lawsuit statistics.