Documentation for your Website

What’s required and what’s nice to have

Does your footer include a graveyard of policy links that nobody has reviewed in years? It is easy to overlook the “standards” when building and maintaining a website. Which policy pages your website needs depends on who you are.

Municipalities have the firmest legal requirements, nonprofits have a few of their own, and small businesses have fewer than you might think. Accessibility and privacy, though, apply to almost everyone in practice.

Here is how we sort them for our municipal, small business and nonprofit clients.*

Right to Know: required for municipalities

If your municipality has a website, Pennsylvania law says your Right-to-Know information must be on it. Businesses and nonprofits can skip this section; the law covers government agencies.

Section 504(b) of the Right-to-Know Law requires four things, posted at the municipal office and online:

1. Contact information for your Agency Open Records Officer (AORO)
2. Contact information for the Office of Open Records (OOR), which hears appeals
3. A form residents can use to file a request (the OOR’s standard form works)
4. Your regulations, policies and procedures for handling requests, if you have adopted them

Many municipalities still miss this. When the OOR reviewed agency websites in 2023, only 73 percent posted all three basics: AORO contact, OOR contact and a request form. It also flagged outdated AORO contact information as a common problem.

It’s important to note that every state has a public records law, but most don’t call it “Right to Know.” In other states, it may go by:

• New York: Freedom of Information Law (FOIL)
• New Jersey: Open Public Records Act (OPRA)
• California: California Public Records Act
• Texas: Public Information Act
• Ohio: Public Records Act
• Florida: Public Records Law, often grouped with its Sunshine Law

The federal Freedom of Information Act (FOIA) is separate and covers only federal agencies, not municipalities.

Best practice: give Right to Know (or your state’s equivalent) its own page, link it from the main menu or footer, and make sure it shows up when someone searches your municipality’s name plus “Right to Know.” Update the AORO name every time staff changes.

A related requirement: under Act 65 of 2021, the Sunshine Act also requires meeting agendas to be posted on your website at least 24 hours before each public meeting.

Charitable solicitation disclosure: required for registered nonprofits

This is the nonprofit counterpart to Right to Know. Much like open records rules, charitable disclosure wording may differ from state to state. These states require wording, which usually shows up on donation pages. Each one points donors to a state agency where they can look up the charity’s filings:

• Florida: tells donors they can get the charity’s official registration and financial information from the Division of Consumer Services, by calling toll-free within the state (1-800-435-7352) or visiting their website. It also states that registration does not imply endorsement.
• Georgia: says a full and fair description of the programs and a financial statement summary are available on request.
• Maryland: says documents filed under the Maryland Solicitations Act are available from the Secretary of State for the cost of postage and copies.
• Michigan: requires only the charity’s registration number.
• Mississippi: directs donors to the Secretary of State’s office (888-236-6167) and says registration does not imply endorsement.
• New Jersey: tells donors that the Attorney General can provide the filed information, including the percentage of contributions that went to the charitable purpose in the last reporting period. It requires the most detailed wording of any state.
• New York: says the latest annual financial report is available from the charity or from the Attorney General’s office.
• North Carolina: points to the State Solicitation Licensing Branch for financial information and a copy of the license, and says the license is not an endorsement by the state.
• Virginia: says financial statements are available from the Department of Agriculture and Consumer Services.
• Washington: says the charity is registered with the state’s Charities Program and gives the phone number and website for more information.
• West Virginia and Wisconsin: both have their own wording. Other compliance lists also include Colorado and Kansas, each with registration-number style lines.

Pennsylvania’s Solicitation of Funds for Charitable Purposes Act requires registered charities to include a standard disclosure statement on written solicitations and donation receipts. Here is the wording:

The official registration and financial information of [Organization Name] may be obtained from the Pennsylvania Department of State by calling toll-free, within Pennsylvania, 1 (800) 732-0999.

Put it on your donate page and in online donation receipts, not just printed appeals. If you solicit donors in other states, many of them have their own required wording, and organizations commonly post a combined multi-state disclosure on the donation page.

If your nonprofit asks for donations from people outside Pennsylvania, other states may require their own registration and disclosure wording, so many organizations post a combined multi-state disclosure on their donation page; check with your attorney or a registration service to see which states apply to you.

Accessibility: expected of everyone, and the statement is strongly recommended

Every organization in this article is expected to have an accessible website. What differs is how the rule is enforced. In every case, the practical standard is WCAG 2.1 Level AA.

Municipalities (ADA Title II). In 2024 the Department of Justice finalized a Title II rule requiring state and local government websites and mobile apps to meet WCAG 2.1 AA. In April 2026, DOJ pushed the deadlines back one year:

Don’t read the extension as a pause. DOJ said plainly that the duty to make digital services accessible continues now.

Small businesses and nonprofits (ADA Title III). There is no federal web rule for private organizations, and DOJ has paused that rulemaking indefinitely. That doesn’t mean you’re exempt. DOJ’s position is that Title III covers websites of organizations open to the public, and courts measure sites against WCAG 2.1 AA. Plaintiffs filed 3,117 federal website accessibility lawsuits in 2025, up 27 percent from 2024, and small businesses are frequent targets. Nonprofits that receive federal funding also fall under Section 504 of the Rehabilitation Act.

For everyone, the rule covers more than web pages. PDFs, forms, menus and documents count too, and scanned documents are among the most common failures.

The statement. An accessibility statement isn’t required by name, but it tells visitors your standard and how to ask for help. A solid statement includes:

• The standard you are working toward (WCAG 2.1 AA)
• A contact for reporting barriers, with what to include: the page, the problem, and the format the person needs
• How to request a document in an alternate format
• Known limitations, such as older archived PDFs
• The date it was last reviewed

A few words of caution: an accessibility overlay or toolbar widget does not by itself make a site compliant, and some plaintiffs’ firms specifically target sites that rely on one. Describe the real work you have done, not the plug-in.

You’ll notice we don’t call websites “ADA compliant,” and unless you can prove compliance we’d encourage you not to either. Compliance is a strong word. It implies a finished state that no website really reaches. Content changes every time someone uploads a PDF, posts a photo or adds a new page. No scan, plug-in or one-time audit can promise that every page works for every visitor. Claiming full compliance can also backfire. It can invite complaints from visitors who hit a barrier, and in 2025 the FTC fined an accessibility overlay company $1 million for claiming its tool made sites compliant. Instead, say what’s true: your site is designed to meet WCAG 2.1 Level AA, you review it regularly, and you’ll fix any barrier someone reports. That language is honest, defensible, and closer to what the law actually expects, which is ongoing effort.

Privacy Policy: recommended for all, required in practice once you collect data

Pennsylvania has no comprehensive consumer privacy law yet (late 2026). A bill, HB 78, passed the House in 2025 and is still pending in the Senate; it would require covered businesses to post a privacy notice. Even without it, most websites end up needing a privacy policy:

• Tools you use require one. Google Analytics, advertising pixels and many payment and email platforms make a privacy policy a condition of their terms.
• Other states’ laws reach you. California’s online privacy law applies to commercial sites that collect personal information from California residents, wherever the business is located.
• Visitors expect it. A contact form, newsletter signup, online store or donation form all collect personal information.

Keep it short and honest. Cover:

• What you collect: form entries, email addresses, payment details, and automatic data like IP addresses and cookies
• Why you collect it and who sees it, including vendors such as payment processors or your web host
• Third-party tools (analytics, embedded maps, social media feeds) and links to their policies
• How long you keep it and how someone can ask you to delete it
• Who to contact with questions

For municipalities: add that anything submitted may be a public record under the Right-to-Know Law. A resident filing a complaint should know their submission could be released, with personal details redacted where the law allows.

For nonprofits: donors care most about one question: do you sell, rent or share donor information? Answer it directly. A clear “we never sell or trade donor information” builds trust on the donation page.

For everyone: collect only what the form needs, and never ask for Social Security numbers or similar identifiers on a web form.

Privacy law follows your visitors, not your address. You might have noticed the CA privacy law statement above. U.S. privacy laws generally protect people based on the state where they live, not the state where an organization is located. A Pennsylvania business, nonprofit or municipality with a website can be subject to the privacy laws of every state its visitors come from. As of 2026, about 20 states have comprehensive consumer privacy laws in effect, and more take effect in 2027. Pennsylvania’s own bill is still pending. Most of these laws apply only once an organization meets certain thresholds, often around 100,000 residents of that state, though some states set the bar lower. Most exempt nonprofits, but Colorado, Delaware, Maryland, Minnesota, New Jersey and Oregon largely do not. Government agencies are generally exempt from these consumer laws, but municipalities still answer to their own state’s public records and data breach laws. A good privacy policy explains what you collect and how visitors from any state can exercise the rights their state’s law gives them.

Legal Disclaimer: nice to have

A disclaimer isn’t required, but it is cheap insurance against claims that someone relied on outdated or incomplete information. Some examples of sections may include:

• General: the site is a public service for viewing information, and unauthorized changes are prohibited
• Liability: no warranty on the accuracy, completeness or usefulness of posted information
• Endorsement: naming a business or product is not an endorsement
• Email: no guaranteed response time to email
• External links: the organization doesn’t control or vouch for linked sites

Tailor it to what you publish:

• Municipalities: state that the official version of an ordinance, budget or minutes is the one on file at the municipal office. That protects you when a posted PDF lags behind an amendment.
• Small businesses: if you publish advice, such as financial, legal, health, fitness or home-improvement tips, say it is general information and not a substitute for professional advice. Note that prices and availability can change.
• Nonprofits: if you share resources or referrals for the people you serve, say you don’t control or guarantee outside services, and include an emergency contact line where it fits.

Terms and Conditions: recommended if you sell online, nice to have otherwise

Terms and Conditions set the rules for people who do something on your site beyond reading. If your site is informational, a good disclaimer covers most of the same ground.

• Small businesses: if you sell online, terms are close to essential. Cover payment, shipping, returns and refunds, warranties, and limits of liability. Link them at checkout, not just in the footer.
• Nonprofits: worth having for event tickets, class or program registrations, and membership sign-ups. Spell out cancellation and refund rules, and whether part of a ticket is tax-deductible.
• Municipalities: useful for online payments (utilities, permits, fees), resident portals, and pavilion or program registrations.

Write them in plain language and link them where the transaction happens. Payment and registration vendors often supply their own terms, so check what is already covered before writing new ones.

Internal Policies: recommended for all

Internal policies govern how your staff, volunteers and officials run your website and social media. They aren’t required, but they keep your accounts consistent, protect your reputation, and make sure access doesn’t walk out the door with one employee.

A good social media or website policy covers:

• Which accounts are official and who is authorized to post
• Who holds the passwords and admin access, and what happens when someone leaves
• Comment rules and when comments may be hidden or removed
• Who reviews website content and how often
• Guidance for staff and volunteers posting about the organization on personal accounts

Municipalities have higher stakes. In Lindke v. Freed (2024), the U.S. Supreme Court held that an official’s social media activity is government action when the official has actual authority to speak for the government and is using it. Blocking residents or deleting critical comments on an official page can then raise First Amendment claims. Municipal policies should apply comment rules the same way regardless of viewpoint, separate official accounts from officials’ personal pages, and address how posts are retained as public records.

Nonprofits should also address volunteers and board members speaking for the organization, and avoid political campaign activity on official accounts, which can put 501(c)(3) status at risk.

Your website policy checklist

Start with the required items for your type of organization, then work down the list.

PA Municipalities

• Right-to-Know page with AORO contact, OOR contact, request form and procedures
• Meeting agendas posted at least 24 hours before each meeting
• Accessibility review against WCAG 2.1 AA, including PDFs
• Accessibility statement
• Privacy policy, including the public-records note
• Legal disclaimer
• Adopted social media and website policy

Small businesses

• Accessibility review against WCAG 2.1 AA
• Accessibility statement
• Privacy policy, if you use analytics, forms, a newsletter or online sales
• Terms and conditions, if you sell online
• Disclaimer, if you publish advice
• Social media and website policy for staff

Nonprofits

• Pennsylvania charitable solicitation disclosure on the donate page and receipts
• Accessibility review against WCAG 2.1 AA
• Accessibility statement
• Privacy policy with a clear donor-information statement
• Terms for events and registrations
• Social media and website policy for staff, volunteers and board

CourseVector builds and maintains websites for municipalities, small businesses and nonprofits, including accessibility reviews, policy pages, and converting PDFs into accessible web pages. Contact us to review your site.

*Always check with your solicitor or legal team to make sure that you’re covering all of your legal requirements and your acceptable level of risk. We are not lawyers and this article is for educational purposes only. It is not legal advice.