Turn compliance into a recurring line

Hans Skillrud lays out numbers that are not theoretical: fines for privacy violations begin at $2,500 per affected visitor, and lawsuits can start at $5,000 per visitor whose rights were infringed, so a single non-compliant site can represent serious exposure. Crucially, privacy laws protect people, not businesses, so a law protecting California residents can apply to any business collecting data from Californians regardless of where it is physically based.

The number of active privacy laws is growing constantly, with multiple new US state laws and international updates recently passed or about to take effect. This is the risk that makes the whole service sellable, and it is genuine, not scaremongering. Understanding the real numbers is what lets you have a calm, credible conversation rather than a panicked one.

Skillrud's point is that virtually any modern website needs a privacy policy, because almost all of them collect user data through a contact form, analytics, embedded maps, video embeds, marketing pixels, or booking tools. That means nearly every client in your book is exposed, whether they realise it or not, which is the addressable market for this service sitting right in front of you.

Being able to walk a client through the specific elements on their own site that create liability turns an abstract legal worry into a concrete, fixable list. The audit practically sells itself once the client sees their own contact form and analytics tag on the risk register. Start every compliance conversation with the client's actual site, not a generic warning.

Skillrud is precise on a point that protects you: it is the website owner's legal responsibility to comply, not the web agency's, but agencies should document that they have informed the client of the requirement. That documentation does two things, it shields you from liability and it creates the paper trail that opens the sales conversation, because now the risk is on the record.

Handled well, informing the client is not a disclaimer to bury, it is the natural lead-in to offering the service that resolves the risk you just flagged. Put the notice in writing, then offer the fix. Clarity about responsibility is what lets you sell compliance without taking on the client's legal exposure yourself.

Gen Herres makes accessibility affordable by scoping it tightly: a focused ten-test accessibility audit of a homepage takes about four hours, split into two two-hour blocks, which keeps it viable as a service for small clients. The 80/20 rule applies directly to WCAG, roughly 20% of the criteria account for 80% of the failures most sites exhibit, so you start there and deliver disproportionate value quickly.

She flags a specific modern failure mode worth checking for: AI-generated websites frequently omit skip links, because the training data for most models lacked them, a known and easy win. A quick, repeatable audit is the low-friction front door to the whole recurring relationship. Keep the first audit small and fast, because its job is to start the relationship, not to be exhaustive.

The legal case is not US-only, which widens the market considerably. Amber Hinds notes accessibility compliance is required across the US under the ADA and Section 508, in Canada under the AODA, and in Europe under the European Accessibility Act, with fines reaching into the millions of euros and, in Ireland and Cyprus, even potential jail time.

Gen Herres adds Australia's Disability Discrimination Act to the picture, and stresses these requirements are evolving, becoming a legal expectation rather than a best practice. Knowing which laws apply to a given client's markets lets you tailor the pitch precisely and credibly. For clients who sell internationally, the compounding obligations across jurisdictions make an ongoing retainer the only sane way to stay compliant.

Amber Hinds is clear that long-term retainer clients are best won on positive motivations, DEI values, SEO, and quality, rather than fear alone, because fear-driven clients only ever want a one-off emergency fix and then disappear. Accessibility work also improves SEO and AI comprehension, Herres notes that clear, descriptive link text and logical heading structure benefit users, search engines, and AI models alike, so you can sell it as an upgrade that widens reach, not just insurance.

Framed as ongoing quality and audience growth, it becomes something a client wants to maintain month after month; framed as fear, it becomes a grudge purchase they resent. The framing you choose determines whether you get a retainer or a single invoice. Lead with what the client gains, not only with what they risk.

Hinds structures remediation around billable time increments, 6, 12, 24, or 48 hours a month, with minimum commitments of three to six months, which creates predictable income for the agency and steady progress for the client. This is the mechanism that moved Equalize Digital's revenue mix from 86.

5% one-off project income to 73% recurring over roughly six years, a transformation of the business, not a side line. The tiered structure lets clients of different sizes buy in at a level that fits, while the minimum term protects your capacity planning and weeds out the emergency-only buyers.

The retainer, not the audit, is where the real business lives. Design the tiers first, then let the audit funnel clients into them.

Rather than a full audit before any fixing begins, Hinds recommends a mixed audit-and-remediation model, so clients see improvements immediately, which is a powerful selling point that keeps them engaged and paying. A long audit that produces only a report tests the client's patience; visible progress in the first weeks earns their trust.

Herres backs this with hard results: one of her clients saw a 48% year-over-year revenue increase and a 94% drop in customer service issues after accessibility work. Immediate, visible progress is what converts a sceptical client into a retained one. Showing value in the first month is worth more than a perfect report in the third.

Herres is adamant that accessibility is not a charity project or an enterprise luxury, it is a measurable business necessity that directly affects revenue, customer retention, and service load. Positioning it that way, with real before-and-after numbers, lets you charge for outcomes rather than obligation, and outcomes renew where obligations lapse.

The same work that keeps a client compliant also widens their audience and improves their discoverability in both search and AI, so the return is tangible and multi-sided. Clients renew services that visibly make them money, not services that merely reduce a risk they cannot see. Always attach a revenue or cost-saving story to the compliance work, because that is what survives a budget review.

Privacy and accessibility are separate disciplines but they share a shape: both are legally driven, both apply to nearly every site, both change over time, and both are unsold by most agencies. That makes them natural to bundle into a single compliance retainer that covers policy maintenance, cookie consent, and accessibility remediation together.

A combined offer is easier for the client to say yes to than two separate line items, and it deepens the moat, because now you own the client's entire compliance posture. Skillrud's privacy work and Hinds's accessibility retainers are two halves of the same recurring service. One compliance retainer is simpler to sell and much harder to cancel than two.

Skillrud stresses that a static, copied, or AI-generated privacy policy is not a compliant solution, because policies must be kept current as laws change, and that recurring maintenance is exactly what justifies a recurring fee. Cookie consent banners must offer a genuine, equal choice to accept or deny tracking, an accept-only banner or a hidden decline is non-compliant, and that too needs periodic review as rules tighten.

Hinds adds the closing argument that makes renewal effortless: documented, consistent compliance work has had real ADA lawsuits dismissed, one New York State case was thrown out because the owner could show years of ongoing remediation. Living paperwork is not overhead, it is the renewal case made for you, because the moment a client stops the retainer, their defensible history stops growing.