Who’s Liable When a Client’s Site Gets Sued?
Is Your Agency Covered if a Client Gets Sued Over Their Website?
I own a web agency in Jacksonville, FL. As a fellow web designer I have to tell you about a nightmare I just lived through. Grab a coffee ☕ Maybe something stronger.
Quick note: this is my experience and not legal advice.
I thought a tool would make my clients compliant. I chose one and it was running. Done. I was misinformed. Then a lawsuit hit one of them and I learned how costly the wrong systems can be 🤦♀️
It came out of nowhere 😳
This lawsuit was on no one’s radar. No warning. One day my client was running her business. The next day she was a defendant.
What the lawsuit looked like
Local news reports say the plaintiff has filed at least 150 similar lawsuits against Florida businesses. My client chose to settle. The amount would badly hurt most small businesses.
Then came the part that made me stare at my screen. My client was told the plaintiff would scan her site again after the settlement. If they found even one issue they could sue her again. The audacity! 😤
Read that twice. To me it felt like being put on a watch list.
A real example from Central Florida 📰
In August 2026 a Miami man sued a Central Florida dermatology practice in small claims court. He said its website used third-party tracking tools without first getting his consent. He asked for up to $8,000 plus attorney fees. The practice settled. The terms were not made public and the settlement is not a finding that it broke the law.
It was one of at least 150 similar suits filed against Florida businesses. One clinic that was sued has countersued and calls the suits a shakedown. A University of Florida privacy law professor said the claim turns a technical issue most of us take for granted into a threat for small businesses. The plaintiff’s attorneys say people have a right to expect businesses to protect their online privacy.
A separate WPBF investigation, as reported by Hoodline, found more than 160 lawsuits filed since July 2025 for one plaintiff over website chat pop-ups. Most wrapped up without going to trial. Cookies, pixels and chat tools are all on the menu.
Agree or disagree with the lawsuits. Your clients still have to deal with them.
This is not a Florida man thing 🌎
Before anyone says “well that is just Florida,” let me stop you.
California. A Sacramento Business Journal op-ed says more than 3,000 California businesses were sued over website tools in two years and tens of thousands more got demand letters.
Accessibility, nationwide. TV newsrooms in Jacksonville, Orlando and Pittsburgh each reported nearly 4,000 website accessibility cases filed in 2025. About 90% came from just 16 law firms. At least 35 Jacksonville businesses have been sued. A Colorado winery got hit too.
Lawsuit flavors of the day 🍦
Think of it as a menu nobody ordered from.
Cookie consent and tracking: plaintiffs say tools like analytics and pixels collect visitor data before anyone agrees to it.
Privacy policy: this one comes up a lot in what I have been reading. I treat it as one piece of the puzzle and not the whole thing.
Accessibility (ADA): people have sued over sites that are hard to use with screen readers and keyboards.
Questions I now ask on every site 🤔
Does the site have a privacy policy and cookie policy that name the tools it uses?
Does the cookie banner actually stop tracking until the visitor agrees?
Can visitors opt out?
Does the site have an accessibility statement?
Have I made a real effort for screen readers and keyboard users?
A word about widgets. I treat a widget as a helpful extra and not the whole fix. According to WPXI in Pittsburgh, one designer paid for help making her site compliant and still got sued three times. That is why I back mine up with real accessibility coding like alt text, keyboard navigation, labeled forms and color contrast. I also keep a record of what I fixed and when.
Here is what I do now. I show real effort, with an accessibility statement and actual fixes behind it. We now add 10 to 15 compliance tasks to every new site and our prices have not changed. That is the world we live in and sadly it is just the beginning.
Your contracts probably say nothing 🖊️
In my experience most website contracts have nothing in them about compliance. Mine did not either at first.
A few years ago Termageddon gave me contract language that let a client accept or decline compliance measures. Most accepted. A few declined.
My own contracts now include clear language that I will not build a site without compliance measures in place. Ask your attorney what that should look like for you.
Build it into your fee 💸
Here is my honest suggestion. Build compliance work into your fee. Yes it is more work. But what are we doing if we are not protecting our clients?
Ask yourself this. Would you like it if someone handed you a ticking lawsuit and you had no idea? For most of our clients the website is attached to their business. For most of them the business is their baby. Handing them a site with a legal time bomb inside is a reputation killer for you. If you do not change your workflow now it will catch up with you.
I get it. We do not want to be compliance experts too. We already wear so many hats and lawyer does not need to be one of them. There are companies out there that can take some of that mental load off. Do your homework before you pick one.
We still have to put the compliance work in place. That is where the extra charge comes from. You can send clients straight to the compliance company or add it as your own upcharge service. Either way you do not have to be a legal eagle to take care of the people who trust you with their business.
The rabbit hole 🐇
The lawsuit sent me deep into consent and compliance. I wanted to know what the law actually requires. So I ran scanner after scanner on my own site and then tried to work out how to fix the other sites I manage.
It was a nightmare. Every scanner gave different results. Some flagged things that were fine. Others missed real problems.
Then my phone rang. It was the founders of ConsentStack. I had used their tool so many times that they tracked me down and said “What do you need? We are here to help.”
What I did next
I went back through 10 years of past clients and offered to make them compliant for free. I also offered a big discount on ConsentStack, the company I now use.
The ConsentStack team jumped in with me. For two weeks we worked tirelessly and adjusted over 25 sites at no charge, with more in the works. They are even more passionate about this than I am. And I am on fire over here 🔥
Many clients said no. Some saw right away that I was doing them a huge favor. Others had moved on to different marketing agencies so I sent my warning to those agencies instead.
I just hope someone is looking out for them the way I would 💚
Full disclosure: I took advantage of every bit of help ConsentStack offered. That includes discounts for my clients and future clients and their affiliate offer, so I earn a small commission if you sign up through my link. I would be silly not to. But even if they had not offered any of it I would be sharing this anyway. I saw the integrity they showed me and my clients through the whole process, and I appreciate the transparent research and knowledge they shared.
What you can do this week ✅
Check your own site first. I fix my own site and then roll the same best practices out to every other site I manage.
List every client site you manage.
Find out which ones track visitors before consent.
Update your contract so compliance is clearly addressed and priced.
Talk to your clients before a plaintiff does.
If you manage client sites you are closer to this than you think.
This is my experience and not meant to be taken as legal advice.
