Asso­ci­a­tion Websites⁠: Acces­si­bility⁠, Cookie Consent and GPC

An association website should be built and tested against WCAG 2.2 AA, should hold back analytics and third-party embeds (listing search, video, maps) until a visitor consents, and should honour the Global Privacy Control signal from a visitor's browser. The hard part isn't launch day. It's keeping all three true as staff add pages, PDFs and widgets for years afterwards, so the checks below cover both.

We build and run association sites on TaliCMS for Texas REALTORS®, Columbus REALTORS® and the Abilene Association of REALTORS®, and we build our own products and client platforms to the same standards. This post covers what we've learned and what we'd check on any association site, ours or anyone else's.

This isn't legal advice. Accessibility and privacy both have legal dimensions in the US, and your counsel is the right person for those. This is the practical side.

Part 1: Accessibility

What "against WCAG 2.2 AA" means in practice

WCAG 2.2 is the current version of the Web Content Accessibility Guidelines, and level AA is the level most organisations measure against. In plain terms, AA means:

• Text has enough contrast against its background to be read.
• Everything you can do with a mouse, you can do with a keyboard, and you can see where the keyboard focus is.
• Images have text alternatives, and decorative images are marked as decorative.
• Forms have labels, and errors say what went wrong and where.
• Pages have a sensible heading structure and landmarks, so screen reader users can jump around.
• Tap targets are big enough to hit on a phone.
• Status changes (a form sent, a filter applied) are announced to screen readers.

What we've seen: do it as a sweep, then lock it in

We've said "we'll make it accessible as we go" on plenty of projects. It never quite happens. Someone's in a rush, an icon button ships with no label, and months later there's a long tail of small problems.

So we now do accessibility as a sweep. In one week this year we ran a pass against WCAG 2.2 AA across our Handl app, its website and Real Estate Jobs Australia, a real estate recruitment platform we build. For Real Estate Jobs Australia that meant contrast, focus states, a skip-to-content link, labelled forms and screen reader announcements. Then we added automated checks so the work doesn't slip backwards the next time someone builds a screen in a hurry.

The lesson for associations: ask a vendor how accessibility is kept, not just how it's achieved. A one-off audit report ages quickly.

The association-specific risks

Association sites have three accessibility problems most sites don't.

1. PDFs. Associations publish a lot of them: bylaws, forms, market reports, strategic plans, flyers. PDFs are often the least accessible content on the site, and the hardest to read on a phone. At Abilene, the strategic plan, member benefits, board and staff, foundation and community outreach came across from the old site as real pages instead of downloads. On the Texas REALTORS® consumer site, guides and flyers for consumers were rebuilt as pages people can read on a phone and share. Not every PDF should become a page, but the ones people read regularly usually should.

2. Staff-published content. Accessibility is set by the developer, then maintained, or not, by whoever publishes. Ready-styled page blocks help, because staff can't pick a low-contrast colour or invent a heading style. But alt text, link wording and heading order are still in staff hands. A short checklist in the admin's help guides does more than a policy document nobody reads.

3. Third-party widgets. Listing search, event registration, video players and maps usually come from other vendors. Their accessibility is outside your site's control, so it's worth asking each provider directly.

Accessibility checks for your site

• Can you reach and use every menu, filter and form with only a keyboard?
• Can you see where the keyboard focus is at all times?
• Is there a "skip to content" link?
• Does the directory's search and filter work with a screen reader?
• Do images in news and events have meaningful alt text, written by whoever published them?
• Are your most-read PDFs available as pages?
• Does your vendor run automated accessibility checks on every change, not just once?

Part 2: Cookie consent and embeds

Why embeds are the part everyone misses

Most consent banners are set up for analytics: don't load tracking until the visitor says yes. That part is well understood.

Embeds are different. Association sites accumulate them: an IDX or listing search from another provider, a YouTube or Vimeo video, a map, a registration form. Many of them set their own cookies the moment they load. And they get added over time, often by staff pasting a snippet into a page, long after the consent banner was configured.

What we've seen: on both Texas REALTORS® sites and on the Abilene site, analytics and embedded content wait for cookie consent. That covers every third-party embed on those sites, and at Abilene it includes embeds staff place inside text blocks, not just the dedicated embed block. If a visitor withdraws consent later, analytics cookies are cleared, not just stopped.

The principle is that a widget a staff member adds next year should follow the same rules as everything built at launch, without anyone having to remember.

What a visitor should see before consenting

A blocked embed shouldn't leave a blank hole in the page. Visitors should see a placeholder that says what the content is and offers a way to allow it. Members trying to use a listing search on their phone don't want to hunt through cookie settings to find out why nothing is there.

Part 3: Global Privacy Control

Global Privacy Control (GPC) is a signal a visitor's browser can send to say "don't sell or share my data". Some browsers send it by default, and others offer it as a setting or extension. Several US state privacy laws, California's among them, treat it as a valid opt-out request.

For an association site, honouring GPC means treating that signal as the visitor's answer to the consent question, so tracking and optional embeds stay off without the visitor having to click anything.

What we've seen: both Texas REALTORS® sites and the Abilene site honour the Global Privacy Control signal. On our own Handl website we take the same line: analytics run under a consent setup where nothing tracks until a visitor says yes.

Consent and privacy checks for your site

• Open your site in a private window. Does anything track before you accept?
• Does every third-party embed (listing search, video, maps, forms) wait for consent?
• What about embeds staff have pasted into ordinary text, not just embed blocks?
• Is there a visible placeholder where a blocked embed would be?
• Can visitors change their mind later, and does that clear analytics cookies?
• Does the site honour Global Privacy Control?
• Is the cookie policy current, and does it list the embeds you actually use?

Questions to ask a vendor

If you're running a vendor selection now, these questions are also in our association website RFP checklist. For the staff side of keeping a site in good shape, see what association staff need from a CMS.

FAQ

What accessibility standard should an association website meet?

Build and test against WCAG 2.2 AA. It covers contrast, keyboard access, alt text, form labels, headings and screen reader announcements, and it's the level most organisations measure against.

Do embedded IDX or listing search widgets need cookie consent?

Many third-party widgets set cookies when they load, so they should wait for consent like analytics do. Check each embed in a private browser window before accepting cookies.

What is Global Privacy Control?

A signal a visitor's browser sends to say they don't want their data sold or shared. Several US state privacy laws treat it as a valid opt-out, and a well-built site treats it as the visitor's answer to the consent question.

Are PDFs a problem for accessibility?

Often, yes. They're harder to make accessible and hard to read on phones. The PDFs members read regularly are usually better as web pages.

How do we keep a site accessible after launch?

Automated checks on every code change, ready-styled content blocks for staff, and a short checklist covering alt text, link wording and heading order.

See how TaliCMS handles accessibility and consent on association sites, or talk to us about your own platform through consulting.