Website Compliance: Risk and Trust

Your website is where the fine starts.

A privacy policy that does not match what the site collects. A cookie banner that fires trackers before consent. Pages a screen reader cannot navigate. And now, for any business passing card cost to customers, the posted price and the checkout disclosure, which Visa has been enforcing with contracted shoppers and direct notices to merchants since 2024. Four categories of exposure, one surface, one platform watching it.

Get the free audit See the pricing compliance program

Four risksprivacy, accessibility, consent and price display

One platforminstead of a developer on retainer

Newdual pricing and surcharge compliance, with a financial backstop

Documentedthe record that answers an inquiry 18 months later

What the program covers

Four exposures on one surface.

Data privacy

Consent capture, a privacy policy that matches what the site collects, and the request handling that state privacy laws and GDPR expect. Most small business sites carry a policy copied from somewhere else and a tag manager nobody has audited.

Accessibility

Contrast, keyboard navigation, alt text, form labels and the structural issues that draw demand letters. These arrive in clusters by state and by industry, which means a neighbor getting one is a warning, not a coincidence.

Cookie consent

Scanning and categorizing what loads on the page, blocking non-essential trackers until consent, and keeping the consent record. The gap between the banner and the behavior behind it is where the exposure lives.

Price display and payment disclosure

New. If you pass any part of card cost to your customers, the posted price, the checkout disclosure and the receipt language are now a compliance surface with card network rules and state consumer protection law on top of it. Details below.

New value add

Dual pricing and surcharge compliance, with a financial backstop.

More than half of small and mid-sized businesses now pass some part of card cost to the customer. Most of them were set up once, by whoever sold them the terminal, and never checked again. Reporting indicates Visa has increased enforcement, and the networks identify violations through transaction data and mystery shopping rather than a site visit.

How they find you

Visa contracts shoppers. They pose as customers.

Trade reporting has documented the program since late 2024. People hired by the network transact like anyone else and note what they see: a surcharge above the 3% cap, a fee applied to a debit card, missing signage, a receipt that does not break the fee out. What they find goes back to Visa.

The bigger change is who gets the call. The network used to work top down, sponsor bank to processor to merchant. For merchants out of compliance, reporting describes Visa now going straight to the business. Your processor may find out after you do.

Detection is not only human, either. A compliant surcharge has to be transmitted as its own amount in the authorization message, which means a correctly configured terminal reports your surcharge to the network on every single transaction. The shoppers are for everything the data does not show.

The exposure

What a violation costs

The networks publish no fine schedule, so every figure in circulation is trade reported. What is consistent across sources is the shape rather than the number: a modest first assessment, then escalation on a 30-day clock that keeps running until the violation is fixed. Reported first assessments sit near $1,000. Reported outcomes for merchants who do not remediate reach six figures, and one processor notice in January 2024 warned its partners of a range up to $1 million.

The escalation is the real risk, not the first letter. Merchants do not get to six figures by being wrong once. They get there by receiving a notice they do not know how to answer and letting the clock run.

The part nobody expects

You have to prove you were compliant

The network does not hand you its evidence. The burden runs the other way. Answering a notice means producing your entry signage, your checkout disclosure, receipt samples, your terminal configuration, the 30-day notice confirmation and your cost of acceptance for the month in question.

Most owner-led businesses have none of that on file, which is why most merchants never challenge an assessment. Not because they were wrong. Because they cannot show they were right.

That is what the attestation and the quarterly re-audit are for. It is not paperwork. It is the only defense that exists.

The rules, in plain terms

What the card networks and the states require.

Debit is never surcharged

Not in any state, not even when a debit or prepaid card is run as credit. This is federal law under the Durbin Amendment and network rule at the same time. If your system cannot identify card product in real time, do not surcharge at all.

Caps, and the cap under the cap

Visa caps surcharges at 3%, Mastercard at 4%, which makes 3% the practical ceiling for a business accepting both. Colorado and Oklahoma cap lower. Underneath all of them sits the real limit: never more than your actual cost of acceptance.

Thirty days notice

Written notice to the card networks and to your acquirer before a surcharge program begins. Keep the confirmation. It is the first document requested when an inquiry opens.

Disclosure in three places

At the entrance, at the point of sale, and again before the transaction completes. Online, that means before checkout, not on the confirmation screen. The amount appears as a separate line item on every receipt.

Some states prohibit it outright

Connecticut and Massachusetts prohibit surcharging by statute, Puerto Rico prohibits it, and most sources report Maine does as well. Several other states restrict the amount or dictate how the price has to be displayed. California, Texas, Illinois and Oklahoma are contested enough that they are a question for your attorney rather than a line on a web page.

Follow the customer's state

For online and multi-state businesses, the rule that applies is the customer's, not yours. This is the most common failure in an e-commerce program and the control is state-aware behavior at checkout.

Dual pricing avoids most of this

Two posted prices, card and cash, with the card price as the advertised base. It is legal in all 50 states, it covers debit, it carries no network cap and it needs no notice. For most owner-led businesses it is the structure we recommend, and we will say so even when the surcharge math looks better on paper.

Rules current as of August 2026 and summarized in plain language. Card network rules and state law change often. This is not legal advice, and your program should be confirmed with your attorney and your acquiring bank before launch.

The most common finding

Half the merchants told they run dual pricing are running a surcharge.

Two things decide which program you are running, and neither one is what your program is called. Visa classifies a fee by what it does, not by the label on the receipt. A non-cash adjustment, a processing fee, a technology fee: if a credit customer pays more than the posted price, it is a surcharge and every surcharge obligation applies.

The second test catches more merchants than the first. Posting two prices does not make it dual pricing. What matters is whether anything is added at checkout.

One price posted, percentage added at checkout for credit

A surcharge. Notice, disclosure, cap, receipt line and the debit exclusion all apply.

Two prices posted, but the card price is reached by adding a fee at the end

Still a surcharge, whatever it was sold to you as. Debit has to be treated the same as cash.

One price posted, cash customers get a reduction

A cash discount. Legal in all 50 states, covers debit, no cap, no notice.

Two prices posted, customer pays exactly the posted price for the method used

Dual pricing. Legal in all 50 states, covers debit, no cap, no notice.

If your terminal adds a percentage at the end, you are running an unregistered surcharge program. That usually means no 30-day notice on file, disclosure that does not meet the requirement, and debit being surcharged without anyone realizing it. It is the finding we hit most often, and it takes about 10 minutes to confirm from one statement and one receipt.

What you get

Five parts, in the order they matter to you.

Attestation at go-live

A signed record of how your program is configured: signage, debit handling, the cap, the receipt language and the state settings. This is the document that answers an inquiry 18 months from now, when nobody remembers who set what.

Continuous site monitoring

Posted price, checkout disclosure, fee labeling and state-aware behavior, scanned on the same schedule as your privacy, consent and accessibility checks. One crawler, one report.

Quarterly re-audit

Signage photos, receipt samples, terminal settings and your current effective cost of acceptance against your posted rate. This is the check that catches drift, and drift is what gets merchants fined.

Response support

When an inquiry arrives, we map each allegation to the rule it cites, assemble the record and help you respond inside the deadline. Most merchants never challenge an assessment because they do not know they can. Documentation is the defense.

Financial backstop

Reimbursement toward assessments and response costs, subject to the terms of the program. Limits, triggers and exclusions are stated in the program document and we will walk you through them line by line before you enroll. We do not describe it as protection from being fined, because nothing is.

The honest no

If you are in a state where your program is not lawful, or your terminal cannot identify debit, we tell you to stop rather than sell you monitoring for something that should not be running.

Why it sits with payments

Nobody else is looking at both.

Your compliance vendor does not know your cost of acceptance. Your processor does not audit your website. The one rule that connects them, that a surcharge can never exceed your actual cost, sits in the gap between the two and gets checked by nobody.

We audit the statement and we watch the site. When we reprice you, the pricing program gets re-checked in the same motion. That is not a feature we added. It is the reason these two programs belong in one relationship.

Already running dual pricing or a surcharge?

Send one recent statement, one receipt and the address of your website. We will tell you four things at no cost: which of the four models you are running today, whether your posted rate sits above or below your cost of acceptance, whether your site discloses what the rules require, and whether your state permits the model you are on.

If everything checks out, we will say so, and you will have the documentation on file for the next time someone asks.

Start the audit

Next step

One statement, one web address, no cost.

Twenty minutes on the phone and a look at what you have. If the compliance program does not earn its place in your business, we will tell you that too.