Online shops: the four exposures where the money changes hands
A shop's website is its till. It takes card details, tracks visitors for advertising, and since June 2025, in most cases, it must work for customers with disabilities. Here is where each of the four exposures costs shops most, with real decisions to show it.
of about 100 of the largest Dutch webshops were not accessible to customers using assistive technology (such as software that reads the screen aloud) when the Dutch consumer authority, the ACM, checked them in 2026.
ACM, 24 Mar 2026fine from France's data protection regulator, the CNIL, on Fnac Darty and Fnac Direct in October 2026: a tracker used without visitors' consent, and refusals that were ignored.
CNIL, 29 Oct 2026of the top one million home pages had accessibility failures that could be detected automatically, in February 2026.
WebAIM, updated 30 Mar 2026What each one looks like in your business
Email in your name
A customer asks where their refund is. A reply arrives from your exact address and asks them to confirm their card on a page that looks like your checkout. Unless your domain's email settings tell mail servers to refuse fakes, nothing stops that email from being delivered.
- Order, shipping and refund emails are what customers expect from you, so a fake one is believed.
- Gmail, Yahoo and Outlook now turn away or send to spam bulk mail from domains without SPF, DKIM and DMARC, three public email settings that say who may send in your name, prove a message is really yours and tell mail servers what to do with fakes. The same settings decide whether your newsletters arrive (DMARC Report, 2025).
- In France, 72% of monitored domains had no effective DMARC protection against fake email in September 2026 (DmarcDkim.com, Sep 2026).
Tracking before consent
Your product pages carry tracking code from Meta and Google Ads, which records what visitors do for your advertising. If it starts before the visitor answers the cookie banner, or if refusing takes more clicks than accepting, that is the breach regulators fine most often.
- The Dutch data protection authority (AP) fined the company behind Kruidvat €600,000 for tracking visitors through cookie boxes that were ticked in advance; the company objected (Autoriteit Persoonsgegevens, 16 Jul 2024).
- The CNIL fined Fnac Darty and Fnac Direct €7 million in October 2026 over a tracker used without consent and refusals that were ignored (CNIL, 29 Oct 2026).
- A shop that adds a social media plugin, such as a Like button, to its pages can share responsibility for the visitor data the plugin collects: the EU Court of Justice said so about Fashion ID, an online clothing retailer (Court of Justice of the EU, 29 Jul 2019).
Customers with disabilities
A blind customer shops with a screen reader, software that reads the page aloud. The size picker is an image it cannot read, the basket button has no name, and the keyboard gets stuck in the address form. The sale is lost, and since 28 June 2025 the law is involved.
- Online shops selling to consumers are squarely within the European Accessibility Act, an EU law that requires them to work for people with disabilities, unless they have fewer than 10 staff and no more than €2 million in turnover or balance sheet total (EUR-Lex, 17 Apr 2019).
- In June 2026 a French court ordered Carrefour France to make its website and app fully accessible, with a penalty of €500 for each day late after six months (Tribunal judiciaire de Caen, 4 Jun 2026).
- The ACM found 61% of about 100 of the largest Dutch webshops not accessible in 2026 (ACM, 24 Mar 2026).
Payment and site security
Your checkout page loads code from other companies: a chat window, a statistics tool, a payment form. If any of that code is changed by someone else, it can copy card details as customers type, and the orders still go through.
- The UK's data protection regulator, the ICO, fined Ticketmaster UK £1.25 million after a chat tool from another company, running on its payment page, was used to take card data in 2018 (Hunton Andrews Kurth, 16 Nov 2020).
- Since 31 March 2025, the card industry's security rules (PCI DSS, set by the card companies and applied through your contract with your bank) require shops that host their own payment pages to list, approve and monitor every script, each piece of code, on them: PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 (Deepstrike, 4 Nov 2026).
- In 2024 a widely used piece of outside code, polyfill.io, changed owner and began sending malicious code to more than 100,000 sites (Sansec, 25 Jun 2024).
Does the European Accessibility Act apply to you?
Yes, in most cases. Selling to consumers online is one of the services the Act names.
The Act covers e-commerce services: services provided at a distance, through websites and apps, at a consumer's request, with a view to concluding a consumer contract (in short, selling to consumers online). It has applied since 28 June 2025. Microenterprises providing services are exempt: fewer than 10 staff and no more than €2 million in annual turnover or balance sheet total. Service contracts agreed before 28 June 2025 may continue unchanged until they expire, for five years at most (EUR-Lex, 17 Apr 2019).
Likely in scope
- A webshop selling to consumers, with 10 or more staff or more than €2 million in turnover and balance sheet total.
- The same shop's app, customer accounts, checkout and returns.
Likely outside it
- A microenterprise: fewer than 10 staff and no more than €2 million in turnover or balance sheet total.
- Sales to businesses only, where no consumer contract is made.
In the UK the Act does not apply to UK shops selling in the UK, but the Equality Act 2010 does: a service provider must not discriminate and must make reasonable adjustments, changes that let disabled customers use the service, whatever its size (Equality Act 2010, checked 8 Nov 2026).
Our reading of the directive and the regulators' guidance, not legal advice. If your case sits close to the line, ask a lawyer.
Checks you can do in a minute
Can someone send email as you?
Run the free email check on your shop's domain (the part after the @). Look for DMARC at p=quarantine (fakes go to spam) or p=reject (fakes are refused), and a DKIM key, the signature that proves an email is yours, for every service that sends your order and newsletter emails.
Does tracking start before the visitor answers?
Open your shop in a private window and leave the cookie banner alone. In the browser's developer tools (in most browsers: right click, then Inspect), the Network tab lists everything the page loads: look for Meta, Google Ads or analytics loading anyway. Is Refuse as easy to find as Accept?
Can you buy with the keyboard alone?
Put the mouse away. With Tab, Shift+Tab and Enter, choose a product and a size, add it to the basket, fill in the address and reach the payment step.
Who approved each outside tool on your checkout?
On the payment step, list every outside address the page loads code from (developer tools, Network tab), such as a chat or statistics provider. Each one should have a name, a reason and someone in charge of it.
When was the shop software last updated?
Check the version of your shop software and of every plugin (add-on). Software past its end of life, no longer supported by its maker, gets no security fixes: Magento 1 stores were hacked by the thousand in one weekend in September 2020, three months after support ended (Sansec, 14 Sep 2020, updated 18 Sep 2020).
Is there an accessibility statement?
If the Act applies to you, you must publish how your shop meets its accessibility requirements, in your terms and conditions or an equivalent document (EUR-Lex, 17 Apr 2019).
The padlock and the security settings
Type http:// and your domain: it should move to https://, the padlock that shows the connection is encrypted, with no warning. A free online header checker shows which security headers your shop sends: the settings that tell browsers how to protect your visitors.
What owners in this sector tell themselves
Website Exposure Bundle
The three fixes in one: your email protected, no tracking before visitors say yes, and your key pages made accessible. Plus an introduction to our partner lawyer for your legal notices and privacy policy, at their fixed fee and billed by them.
Keep it fixed: from €39 a month
Confirm it with a real scan
We read only what any visitor can see, and your domain's public settings: no login, no testing of your systems. You get a private report by email with screenshots, a score for each of the four exposures, and fixed prices.
The detail, for those who want it
Two thousand shops in an afternoon
On 11 June 2024 Adobe published a fix for a flaw in the software behind many Magento and Adobe Commerce shops. A week later, a security firm found that 75% of stores had still not installed it. On 14 October, more than 2,000 stores were hacked in a few hours, in what the firm called the largest automated hack to date (Sansec, 2024).
None of those shops was picked by a person. A program found them, because they had not installed the update.
What applies, market by market
Cookies and trackers
The CNIL, France's data protection regulator, enforces consent: trackers a site does not strictly need may only run once the visitor says yes, and refusing must be as easy as accepting. Its cookie fines reach €325 million (CNIL, 2025 to 2026), and its simplified procedure, a fast-track fine for smaller cases, fines smaller firms a few thousand euros at a time (Journal de l'économie, 7 Jul 2026).
Accessibility
The European Accessibility Act has applied in France since 28 June 2025, and French courts now hear claims under it: in June 2026 one ordered a retailer to make its site and app fully accessible (Tribunal judiciaire de Caen, 4 Jun 2026).
Card payments
PCI DSS, the card companies' security rules, applies in every country. Even a shop that sends all payments to its provider must show it complies, usually by filling in a self-assessment questionnaire (PCI Security Standards Council, checked 8 Nov 2026).
Decisions and rulings in this sector
| Market | Date | Who decided | Against | Outcome | Why | Source |
|---|---|---|---|---|---|---|
| FR | Sep 2025 | CNIL | Shein (Infinite Styles Services) | €150,000,000 | Cookies placed without consent | CNIL |
| FR | Jun 2026 | Caen court | Carrefour France | Order to be fully accessible within six months, with a sum to pay for each day late | Online shop and app not accessible to customers with disabilities (European Accessibility Act) | PinMeTo |
| FR | May 2026 | Lille court | Auchan | Claim rejected on a point of procedure; appeal pending | Court noted the site did not meet accessibility standards | PinMeTo |
| FR | Dec 2025 | CNIL | A retailer (kept anonymous by the CNIL) | €3.5 million | Loyalty members' data sent to a social network for ad targeting without valid consent | CNIL |
| FR | Oct 2026 | CNIL | Fnac Darty and Fnac Direct | €7 million | Cookies and trackers, including in the mobile app | CNIL |
| NL | Dec 2024 | Autoriteit Persoonsgegevens | Coolblue | €40,000 | Tracking cookies without valid consent | Privacy-web |
| NL | Jul 2024 | Autoriteit Persoonsgegevens | Kruidvat | €600,000 (as reported) | Tracking cookies without consent | Dutch IT Channel |
| NL | May 2024, reduced May 2025 | Autoriteit Persoonsgegevens | AS Watson | Undisclosed amount above €50,000, reduced to €50,000 after objection | Cookie violations | PPC Land |
| NL | Mar 2026 | ACM | About 100 of the largest webshops | 61% found not accessible | Accessibility check (European Accessibility Act) with users with disabilities | ACM |
| EU | Jul 2019 | Court of Justice of the EU (C-40/17) | Fashion ID, an online clothing retailer | Ruled jointly responsible for the data (joint controller) | Adding a social media plugin, an add-on from a social network, to a shop page made the shop jointly responsible for collecting and passing on visitors' data | Court of Justice of the EU |
| UK | Nov 2020 | ICO | Ticketmaster UK | £1,250,000 | A chat window from another company, on the payment page, was hacked and used to take card data in 2018 | Hunton Andrews Kurth |
Questions worth asking
Your answers stay on this page. Each one shows why it matters.
Who keeps your shop software and plugins up to date?
How many outside services (chat, statistics, advertising) load on your checkout page?
Where do customers type their card number?
Do you have 10 or more staff, or more than €2 million in turnover?
answers point to something worth fixing.
The full assessment scores all four exposures and builds your list for the next 30 days.
Not legal advice. Whether the European Accessibility Act applies to a given shop depends on its size and on how it sells; where it is close, a lawyer should confirm.