There is a growing compliance burden for merchants. In 2016 digital commerce faced a number of compliance hurdles: ADA, PCI, COPPA, and SOX, to name a few. There are even more growing concerns with EU and Brexit on the horizon for a global economy. How will retailers in the digital age face these new challenges? This talk will look specifically at ADA compliance, global recognition and challenges of these regulations, and how these factors will impact digital commerce.

2. Managing the Growing Array
of Regulation for Online
Retail

3. Phillip Jackson
Ecommerce Evangelist - Something Digital

7. • Differences between compliance and regulation
• Types of regulations and compliance burdens faced by digital commerce
• How to plan and budget for growing burden
• Case studies
Overview

8. Is there a difference?
Regulation vs Compliance

9. • Compliance usually is dictated by
complying with a standard or non-legal
set of requirements
• Identified by a working group or
standards body
• Economic repercussions
• In flux, evolving
• Adapts to change, culture, technology
• Less expensive
“In general standards groups
seek to create guidelines that
outline best practice in order to
prevent regulation by a
governmental body.”
Compliance

10. • A set of laws which has an oversight
body, usually a governmental or NGO
body which oversees enforcement
• Legal repercussions
• Long periods of time between revisions
• Outmoded by technology, culture
• More expensive
Regulation

11. PCI Compliance

12. PCI Compliance
• PCI (Payment Card Industry)
• Standards body made up of worldwide banks and gateways
• Effort to circumvent regulation by region
• Requirement imposed at-will on premium, non-essential services
• Combination of self-assessment and 3rd party
• Risk mitigation

13. ADA Compliance

14. ADA Compliance
• American Disability Act (1990)
• Legislation overseen by DOJ, IRS
• Increasingly websites under scrutiny
• Large brands require higher levels of compliance

15. COPPA Compliance

16. COPPA
• Child Online Privacy and Protection Act (2013)
• Legislation overseen by FTC
• Simple rules to follow
• Don’t do business with children under 13
• Don’t collect data for children
• Don’t primarily (or secondarily) market to children

17. COPPA
• “Collect data”
• Full name
• Screen name or user name where it functions as online contact information
• A persistent identifier that can be used to recognize a user over time and across
different sites, including a cookie number, an IP address, a processor or device serial
number, or a unique device identifier

18. EU Privacy Directive
• Government regulation
• Privacy and control of Personally Identifiable Information as a human right*
• Requirement on all businesses for all people
* source: http://ec.europa.eu/justice/data-protection/

19. • Differences between compliance and regulation
• Types of regulations and compliance burdens faced by digital commerce
• How to plan and budget for growing burden
• Case studies
Overview

20. How to plan and budget for
growing burden

21. Start by saving
• Employ across disciplines
• Invest in training to save on hiring costs
• Invest in automation
• Limit unnecessary risk

22. Set expectations
• Anticipate large expenditures with increased demand and market segments. E.g.
investment in teen/tween goods or pushing above $6MM limit
• Invest in areas with largest impact

23. Set expectations
https://www.sans.org/reading-room/whitepapers/analyst/security-spending-trends-36697

24. Reasonable Expense
Training
9%
Audit
18%
Security
14%
Compliance
30%
Infrastructure
29%

25. Reasonable Expense
Infrastructure Compliance Security Audit Training
$14,500.00 $15,000.00 $7,000.00 $8,800.00 $4,500.00
29% 30% 14% 18% 9%

26. Reasonable Expenses
• Examples of spending:
• Infrastructure: servers/hardware, CCTV, biometrics, 2FA, security, HA/DR, building
access
• Compliance: legal, HR, seminars, productivity
• Audit: 3rd party services, scanners, hardware devices
• Security: physical and digital, seminars, SME’s
• Training: workforce education, hire for skill set

27. Costs: PCI Compliance

28. Costs: PCI Compliance
• Variables that affect PCI Costs:
• Business type
• Size of organization
• Level 1 (> $6MM in transactions -OR- > 1MM total transactions)
• Level 2 or 3 (at discretion of acquiring bank)

29. Costs: PCI Compliance
• Bottom line: costs scale significantly with your business:
• $300-10,000 for Levels 2-3 per annum
• $70,000 per audit for Level 1

30. Costs: PCI Levels 2 and 3
• Self-Assessment Questionnaire ~$50 - $200
• Vulnerability scanning ~ $100 - $150 per IP address
• Training and policy development ~ $70 per employee
• Remediation (software and hardware updates, etc.)
• Productivity Costs
http://blog.securitymetrics.com/2015/08/pci-compliance-cost.html

31. Costs: PCI Level 1
• Onsite audit ~ $40,000+
• Vulnerability scans ~ $800+
• Penetration testing ~ $5,000+
• Training and policy development ~ $5,000+
• Remediation (software and hardware updates, etc.) ~ Varies greatly based on where
entity is today in relation to compliance and security
http://blog.securitymetrics.com/2015/08/pci-compliance-cost.html

32. Costs: PCI Compliance
• Cost of a breech:
• Remediation: $25,000+
• Hosting Migration: $30-40,000
• Increase in rates from acquiring bank (or worse, blacklist)
http://blog.securitymetrics.com/2015/08/pci-compliance-cost.html

33. Costs cont.
IT Budget
Regulation
63%
IT Salary
Regulation
76%
https://www.sans.org/reading-room/whitepapers/analyst/security-spending-trends-36697

34. Costs: ADA Compliance

35. What is a Disability?
Definitions

36. ADA Compliance: Definitions
• No such thing as “ADA Compliance”
• WCAG (Web Content Accessibility Guidelines) 2.0
• Accessibility
• “Design with Equity”
• The Persona Spectrum

37. The Persona Spectrum
https://www.microsoft.com/en-us/design/inclusive

38. Resource

39. “In the context of health experience, a
disability is any restriction or lack of
ability (resulting from an impairment)
to perform an activity in the manner or
within the range considered normal for
a human being.”
–World Health Organization, 1980

40. “Disability is not just a health problem.
It is a complex phenomenon, reflecting
the interaction between features of a
person’s body and features of the
society in which he or she lives.”
–World Health Organization, 2017

41. Business Costs: ADA Compliance
• Variables that affect ADA Costs:
• ADA predates the WWW (by 1 year)
• New build vs retrofit
• Certification vs “light accessibility”
• Legal threats

42. User Costs: ADA Compliance
• Everyday users are affected
• Productivity increases
• Accessibility exercises increase mobile conversion rate

43. Costs: ADA Compliance
• Some incentives
• “Empathetic design” (design with equity) increases mobile conversion rate
• 8% of Americans suffer with color blindness
• Tax implications:
• Access Credit Expenditures must be for Compliance with the ADA
• General Business Credit Limit

44. Costs: ADA Tax Incentives
• General Business Credit Limit
• Work Opportunity Credit
• Access Credit CapEx
• Strong indication applies to websites (IANAL):
• DOJ broadened its interpretation of the ADA to websites stating “The Department
has consistently interpreted the ADA to cover Web sites that are operated by public
accommodations and stated that such sites must provide their services in an
accessible manner or provide an accessible alternative to the Web site that is
available 24 hours a day, seven days a week.”
http://www.southwestada.org/html/publications/general/taxbulletin.html

45. Costs: ADA Compliance
• Levels of Compliance:
• WCAG (Web Content Accessibility Guidelines) 2.0 Levels A & AA are somewhat
affordable
• Layered costs by percentage addition during design-time
• 6-16% increase in development and testing time
• External audits may be required/requested
• Retrofit can be very difficult
• AAA is prohibitive
http://www.accessiq.org/standardguideline/web-content-accessibility-guidelines-wcag

46. Costs: ADA Compliance
• Example build:
• 1400-hour Reference Site Build
• 7% of budget was Accessibility
• 32% of budget was PM / QA (compared at 30% nominal)
http://www.accessiq.org/standardguideline/web-content-accessibility-guidelines-wcag

47. Costs: COPPA Compliance

48. Costs: COPPA Compliance
• Build tools to cope with PII demands
• Analytics woes/issues with cookie data collection
• Purchasing challenges
• Age gating
• Sharing selections
http://www.accessiq.org/standardguideline/web-content-accessibility-guidelines-wcag

49. Where Magento 2 Can Help

50. Where Magento 2 can Help
• PCI compliance
• Out of box lowest-level PCI risk (directpost/iframe only payment methods)
• ADA Compliance
• M2 has ARIA features, skip to content links, tab navigation, great support for alt text, does many
things correctly out of the box
• Some reasonable tradeoffs, some features require compromise
• COPPA
• Wishlist
• Cookie policy

51. Where Magento 2 Needs Help
• ADA Compliance
• Return of focus
• Repetition of spoken text/terms
• COPPA
• Age gating
• Web chat, reviews, contact us

52. • Differences between compliance and regulation
• Types of regulations and compliance burdens faced by digital commerce
• How to plan and budget for growing burden
• Case studies
• Resources
Overview

53. Case Studies

55. Maddie Case Study: COPPA
• Age Gate
• Share to Buy
• Cookie / Data collection requirements
• Privacy Policy which complies with COPPA
• Marketing and photography consistent with demographic of target audience

57. Papyrus Case Study: ADA
• WCAG 2.0 AA
• Modals
• Keyboard Navigation
• Voice/Screen Reader

58. There Is Hope

59. Silver Linings
• Community
• Capabilities of Platform
• Openness of Platform
• Capabilities of Partners

60. • Differences between compliance and regulation
• Types of regulations and compliance burdens faced by digital commerce
• How to plan and budget for growing burden
• Case studies
• Resources
Overview

61. Resources

62. Resources: PCI
Secure Commerce
Magento Imagine 2016
Wow Such PCI Compliance
Meet Magento Spain 2015
https://www.youtube.com/watch?v=TkEGpQ0uz54 https://www.youtube.com/watch?v=RdBa3basd6o

63. Resources: Accessibility / ADA
• Something Digital Thought Leadership
Blog Series

64. Resources: Imagine
• Imagine 2017 Dev Exchange

65. Resources
• Salesforce UX Blog

66. Resources

67. Q&A

68. Thank You!