Ecommerce compliance glossary
Definitions for the accessibility, security, privacy and AI compliance terms that matter for ecommerce stores. Each term links to a deeper guide where available.
#
- 3D Secure 2.0
- An authentication protocol for online card payments that adds a verification step (biometric, SMS code, app approval) during checkout. Shifts fraud liability from the merchant to the card issuer. Required under EU PSD2 Strong Customer Authentication rules. Read more
A
- Accessibility overlay
- A JavaScript widget that claims to fix accessibility violations automatically by injecting UI modifications at runtime. Overlays cannot fix missing alt text, broken heading structure or inaccessible custom components. Courts have ruled they do not prevent ADA lawsuits. Read more
- ADA (Americans with Disabilities Act)
- US federal civil rights law prohibiting discrimination against people with disabilities. Title III covers public accommodations, which courts have extended to websites and ecommerce stores. 3,117 ADA web accessibility lawsuits were filed in 2025. Read more
- ARIA (Accessible Rich Internet Applications)
- A set of HTML attributes that define ways to make web content more accessible to people using assistive technologies. ARIA labels, roles and states supplement native HTML semantics. The first rule of ARIA: do not use ARIA if a native HTML element will do the job. Read more
- axe-core
- An open-source JavaScript accessibility testing engine maintained by Deque Systems. It tests web pages against WCAG 2.1 AA success criteria and returns violations with fix suggestions. Used by Lighthouse, browser extensions and CI/CD pipelines. Catches roughly 30-40% of WCAG violations automatically. Read more
C
- CAN-SPAM Act
- US federal law governing commercial email. Requires a physical mailing address, clear unsubscribe mechanism and accurate subject lines. Unlike GDPR and CASL, CAN-SPAM allows sending without prior consent as long as opt-out is honored within 10 business days. Read more
- CASL (Canadian Anti-Spam Legislation)
- Canadian federal law regulating commercial electronic messages. Requires express consent (opt-in) before sending marketing emails. Fines up to $10M CAD per violation. Stricter than US CAN-SPAM, which only requires opt-out. Read more
- CCPA (California Consumer Privacy Act)
- California state privacy law giving consumers the right to know what personal data is collected, request deletion and opt out of data sales. Applies to businesses with $25M+ revenue, 100K+ consumer records or 50%+ revenue from data sales. Amended by CPRA in 2023. Read more
- CMP (Consent Management Platform)
- Software that manages cookie consent banners, records user preferences and controls which scripts fire based on consent status. Examples: OneTrust, Cookiebot, Osano, Usercentrics. Required for GDPR compliance on sites using tracking cookies. Read more
- Consent Mode v2
- Google's framework for adjusting Google tag behavior based on user consent status. Required for EU ad features since March 2024. Basic mode blocks tags entirely without consent. Advanced mode sends cookieless pings for conversion modeling. Read more
- COPPA (Children's Online Privacy Protection Act)
- US federal law protecting the privacy of children under 13. Requires verifiable parental consent before collecting personal information from children. Applies to toy stores, children's clothing brands and any site with actual knowledge of child users. Epic Games paid $520M in COPPA violations. Read more
- CPRA (California Privacy Rights Act)
- Amendment to CCPA effective January 2023. Added the right to correct data, right to limit sensitive data use and created the California Privacy Protection Agency. Introduced data minimization and purpose limitation requirements. Read more
- CSP (Content Security Policy)
- An HTTP response header that controls which resources (scripts, styles, images) a browser is allowed to load on a page. PCI DSS 4.0 requirement 6.4.3 uses CSP to restrict and inventory scripts on payment pages. Prevents unauthorized script injection and Magecart attacks. Read more
D
- DKIM (DomainKeys Identified Mail)
- An email authentication method that attaches a digital signature to outgoing emails. The receiving server verifies the signature against a DNS record to confirm the email was not altered in transit and came from an authorized sender.
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
- An email authentication protocol that builds on SPF and DKIM. It tells receiving mail servers what to do when SPF or DKIM checks fail (none, quarantine or reject) and sends reports back to the domain owner.
- DSA (Digital Services Act)
- EU regulation effective February 2024 requiring transparency in algorithmic recommendations, advertising and content moderation. Online marketplaces must disclose recommendation system parameters and provide at least one option not based on user profiling.
- DSAR (Data Subject Access Request)
- A request from an individual to an organization asking what personal data is held about them. GDPR Article 15 requires a response within 30 days. Ecommerce stores must search across all systems: CRM, email platform, analytics, payment processor and customer service tools. Read more
E
- EAA (European Accessibility Act)
- EU directive (2019/882) requiring digital products and services to meet accessibility standards from June 2025. Ecommerce stores selling to EU customers must comply with EN 301 549. Fines reach up to 4% of annual revenue per member state. Read more
- EN 301 549
- European standard for accessibility requirements of ICT products and services. Incorporates WCAG 2.1 AA for web content plus additional requirements for software, hardware and documentation. Referenced by the EAA as the standard ecommerce stores must meet. Read more
- EU AI Act
- European regulation classifying AI systems by risk level and imposing obligations accordingly. Ecommerce AI (chatbots, recommendation engines, dynamic pricing) falls under limited or minimal risk tiers. Article 50 requires transparency when customers interact with AI. Penalties reach 35M euros or 7% of global turnover. Read more
F
- Focus trap
- A keyboard accessibility pattern where Tab key focus is contained within a modal dialog or overlay. When a modal opens, focus moves into it and cycles between its interactive elements. When it closes, focus returns to the triggering element. Required by WCAG 2.4.3 (Focus Order). Read more
G
- GDPR (General Data Protection Regulation)
- EU regulation (2016/679) governing the collection, processing and storage of personal data from EU residents. Requires lawful basis for processing, explicit consent for marketing, data minimization and breach notification within 72 hours. Fines up to 4% of global annual turnover or 20M euros. Read more
- GPC (Global Privacy Control)
- A browser-level signal that communicates a user's opt-out preference for data selling and sharing. Legally binding under CCPA/CPRA and recognized by Colorado, Connecticut and other state privacy laws. Sephora paid $1.2M for ignoring GPC signals. Read more
H
- Heading hierarchy
- The logical structure of heading elements (h1 through h6) on a web page. WCAG requires exactly one h1 per page with headings descending in order without skipping levels. Screen reader users navigate by headings to understand page structure. Read more
- HSTS (HTTP Strict Transport Security)
- An HTTP response header that forces browsers to use HTTPS for all future requests to a domain. Prevents protocol downgrade attacks and cookie hijacking. PCI DSS 4.0 requirement 11.6.1 checks for HSTS on payment pages. Read more
L
- Landmark regions
- Semantic HTML5 elements (header, main, nav, footer, aside) or ARIA landmark roles that define the structural sections of a page. Screen reader users navigate between landmarks to skip repeated content. WCAG 2.4.1 requires a mechanism to bypass blocks of repeated content. Read more
M
- Magecart
- A collective term for cybercriminal groups that inject card-skimming JavaScript into ecommerce payment pages. Named after early attacks on Magento stores. British Airways lost 380,000 card numbers. PCI DSS 4.0 requirements 6.4.3 and 11.6.1 were created specifically to address Magecart-style attacks. Read more
P
- PCI DSS (Payment Card Industry Data Security Standard)
- Security standard for organizations that handle credit card data. Version 4.0 became mandatory in March 2025. Requirements 6.4.3 (script inventory and integrity) and 11.6.1 (change detection on payment pages) apply to all ecommerce merchants. Read more
- PCI DSS 4.0 Requirement 11.6.1
- Requires a change-detection mechanism on payment pages that alerts on unauthorized modifications to HTTP headers and script content. Must run at least weekly. Targets Magecart-style script injection attacks. Read more
- PCI DSS 4.0 Requirement 6.4.3
- Requires merchants to maintain an inventory of all scripts on payment pages, justify each script's presence and implement integrity verification (SRI hashes or CSP). Became mandatory March 31, 2025. Read more
S
- SAQ-A (Self-Assessment Questionnaire A)
- The simplest PCI DSS self-assessment for merchants who fully outsource cardholder data to a PCI-compliant third party (hosted payment page). PCI DSS 4.0 added new script management eligibility requirements. Visa issued a March 2025 FAQ clarification. Read more
- Screen reader
- Assistive technology software that reads screen content aloud for blind and visually impaired users. Common screen readers: NVDA (Windows, free), JAWS (Windows, paid), VoiceOver (macOS/iOS, built-in), TalkBack (Android, built-in). Tests with screen readers reveal accessibility issues that automated tools miss. Read more
- Skip link
- A hidden navigation link that becomes visible on keyboard focus and allows users to skip directly to the main content, bypassing repeated navigation menus. Required by WCAG 2.4.1 (Bypass Blocks). Should be the first focusable element on the page. Read more
- SPF (Sender Policy Framework)
- An email authentication DNS record that specifies which mail servers are authorized to send email on behalf of a domain. Receiving servers check SPF records to detect forged sender addresses.
- SRI (Subresource Integrity)
- A security feature that lets browsers verify that third-party resources (scripts, stylesheets) have not been tampered with. An integrity attribute containing a cryptographic hash is added to the script tag. If the file content does not match the hash, the browser blocks it. Read more
T
- Touch target
- The tappable area of an interactive element on a touchscreen. WCAG 2.5.8 (added in 2.2) requires a minimum 24x24 CSS pixel target size. Apple HIG recommends 44x44 points. Small touch targets on mobile product pages and checkout forms are a common ecommerce accessibility violation. Read more
V
- VPAT (Voluntary Product Accessibility Template)
- A document that explains how a product or service conforms to accessibility standards (Section 508, WCAG, EN 301 549). Enterprise buyers and government agencies often require VPATs during procurement. Not legally required for ecommerce stores but useful for B2B sales.
W
- WCAG (Web Content Accessibility Guidelines)
- W3C standard defining how to make web content accessible to people with disabilities. Organized around four principles: perceivable, operable, understandable and robust. WCAG 2.1 AA is the standard referenced by most laws (ADA, EAA, Section 508). 96% of ecommerce sites fail WCAG 2.1 AA. Read more
- WCAG 2.2
- The latest version of WCAG, published October 2023. Added 9 new success criteria including focus not obscured (2.4.11), minimum target size (2.5.8) and accessible authentication (3.3.8). The EAA references WCAG 2.1 but EN 301 549 is expected to update to 2.2. Read more
- Web skimming
- The injection of malicious JavaScript into ecommerce payment pages to steal credit card data in real time. Also called formjacking or e-skimming. Magecart is the most well-known web skimming operation. PCI DSS 4.0 requirements 6.4.3 and 11.6.1 directly target web skimming prevention. Read more