Timeline
Web Development Industry Timeline
What's changing in web development.
Regulations, standards, and platform changes that affect your website. What already happened, what's coming next, and what it means for your business.
Every entry links its primary source. Last reviewed .
Coming Up
-
January 2027
Privacy Automate MonitorCalifornia rules on automated decisions take effect
California's updated CCPA regulations require businesses that use automated decision-making technology, meaning technology that replaces or substantially replaces human decision-making, for significant decisions about Californians to comply by January 1, 2027. Significant decisions cover financial and lending services, housing, education, employment, and healthcare services. A business must give notice before use that explains how the system works, and offer either an opt-out or an appeal to a human reviewer with the authority to overturn the decision. Risk assessments for processing that began before 2026 are due by December 31, 2027, with attestations and summaries to the California Privacy Protection Agency by April 1, 2028.
Sources: cppa.ca.gov, cppa.ca.gov
-
January 2027
AI Automate MonitorColorado AI Act takes effect (rewritten and delayed)
Colorado rewrote its AI law before it took effect: Senate Bill 26-189, signed May 14, 2026, replaced the original law, which had been due to start June 30, 2026, with a narrower one that starts January 1, 2027 and drops the duty of care around algorithmic discrimination, deployer risk management programs, impact assessments, and reporting to the attorney general. Businesses that use AI for decisions about Colorado residents in hiring, lending, insurance, housing, education, or health care will need to give notice at the point of interaction, send a disclosure within 30 days of an adverse decision, and offer a route to correction and human review. The attorney general filed draft rules on August 11, 2026, with comments open until October 26, but a federal court order in xAI's challenge to the law, which the United States joined, bars enforcement for violations up to 14 days after the court rules on a preliminary injunction that xAI must seek within 28 days of the final rules. Plan the notices now, and expect enforcement to begin only after that ruling.
-
January 2027
AI Build AutomateChatbot safety laws take effect in Colorado and Washington
Chatbot safety laws in Colorado and Washington apply from January 1, 2027. Colorado's covers any business offering a public conversational AI service, which must tell users it is AI at the start of each day's first conversation and at least every three hours, or with a persistent notice, and must refer anyone who raises suicide or self-harm to a crisis service; Washington's covers companion chatbots and requires a not-human notice at the start and every three hours. Both exempt bots built for customer support, Washington's only if the bot does not sustain a relationship across conversations and draw out emotional responses, so a support or ordering assistant that stays on task is outside them. A site chatbot that holds open-ended conversations should add the disclosure and a crisis protocol before January, and Colorado's attorney general is taking comments on draft rules until October 26.
-
January 2027
Privacy MonitorOklahoma and Louisiana privacy laws take effect
Consumer privacy laws in Oklahoma and Louisiana take effect on January 1, 2027, and Alabama's follows on May 1, 2027. Oklahoma's applies to businesses handling the data of 100,000 residents, Louisiana's to those with more than $25 million in revenue or the data of 75,000 consumers, and Alabama's to those handling the data of more than 25,000, a low enough bar to catch a small business with a large online audience there. On the same January date, a California law requires every browser to offer a setting that sends an opt-out preference signal, such as Global Privacy Control, to the businesses a person interacts with. Check each threshold against your visitor numbers, add the new states to your privacy notice, and confirm your site treats that signal as an opt-out of the sale and sharing of personal data.
-
March 2027
Security Build AutomateSSL certificate lifetimes drop to 100 days
From March 15, 2027, publicly trusted SSL/TLS certificates can be valid for no more than 100 days, down from 200, and domain validation can be reused for only 100 days before a fresh check. Let's Encrypt moves sooner: from February 10, 2027 its default profile issues 64-day certificates, and 45-day certificates follow on February 16, 2028. At these lifetimes renewal has to be automatic, and Let's Encrypt recommends a client that supports ACME Renewal Information or renews about two-thirds of the way through a certificate's life. Add monitoring that alerts before a certificate expires, because a missed renewal takes a site offline behind a browser warning.
Sources: github.com, letsencrypt.org
-
April 2027
Accessibility MonitorADA Title II web accessibility deadline (delayed to 2027)
State and local governments serving 50,000 or more people must meet WCAG 2.1 AA by April 26, 2027, and smaller public entities and special districts by April 26, 2028. The DOJ moved both dates back a year in an Interim Final Rule published April 20, 2026, four days before the original April 24, 2026 deadline, saying it had overestimated covered entities' staffing and technology capacity. The dates could still move either way: the National Federation of the Blind has sued to have the extension set aside, and the DOJ's August 2026 regulatory agenda says it may propose making some of the 2024 rule's requirements less burdensome. Title II never covered private businesses, whose exposure comes from ADA Title III website lawsuits, which rose 27% in federal court in 2025, and from the European Accessibility Act if they sell to EU consumers.
-
May 2027
Accessibility Build MonitorHealthcare accessibility deadline under Section 504 (delayed to 2027)
Recipients of HHS federal financial assistance with 15 or more employees, such as hospitals, community health centers, and primary care centers, must make the web content and mobile apps they provide meet WCAG 2.1 Level AA by May 11, 2027, and recipients with fewer than 15 employees by May 10, 2028. HHS moved both dates back a year in an Interim Final Rule published May 11, 2026, from May 11, 2026 and May 10, 2027, to line them up with the Justice Department's ADA Title II extension. The dates could still move either way: the National Federation of the Blind has sued to have the extension set aside, and HHS's August 2026 regulatory agenda says it may later propose making some of the 2024 rule's requirements less burdensome. Size changes only the date, so any practice, clinic, or health system receiving HHS funding is in scope.
-
December 2027
AI Automate MonitorEU AI Act high-risk requirements (delayed to 2027)
The AI Omnibus, in force since July 27, 2026, moved the high-risk obligations for standalone systems from August 2, 2026 to December 2, 2027, and for AI built into products already covered by EU product-safety law from August 2, 2027 to August 2, 2028. The EU cited harmonized standards and national oversight authorities that were not ready in time. When the date arrives, AI used for hiring, creditworthiness, life and health insurance pricing, education, and access to essential services will need a conformity assessment, technical documentation, and registration in the EU database. The bans on prohibited practices and the transparency rules already apply, so the delay buys documentation time and exempts nothing.
Recent Changes
-
September 2026
Security Build MonitorChrome asks before loading HTTP sites by default
Chrome 154, released September 22, 2026 and rolling out gradually, turned on "Always use secure connections" by default for every user. Chrome now tries HTTPS first, and when a public site offers only plain HTTP it asks the visitor's permission before loading it, while private network addresses are left alone. Google had already switched it on for desktop users of Enhanced Safe Browsing in Chrome 150 in June. A site still serving plain HTTP should move to HTTPS with a free certificate and send every HTTP URL to its HTTPS version with a 301 redirect.
Sources: developer.chrome.com, blog.google, support.google.com
-
September 2026
Security MonitorWordPress 7.1.2 fixes a critical core vulnerability
WordPress released 7.1.2 on September 22, 2026 to fix a critical vulnerability in core: under certain conditions an unauthenticated attacker can make page template resolution load a readable PHP file from outside the active theme's folders, which can lead to remote code execution when the server and theme meet its preconditions. The fix was backported to every branch still eligible for security fixes, back to 4.7, and sites with automatic background updates start the update on their own. Confirm that every WordPress site you run reports a patched version, because a site with background updates switched off stays exposed until someone updates it by hand.
-
September 2026
AI MonitorCloudflare separates AI training blocks from search access
On September 15, 2026, Cloudflare added a Disallow AI Training setting that publishes a no-training preference in robots.txt and blocks training crawlers that ignore it, while crawlers it rates as accountable, including Googlebot and Applebot, stay allowed for search. Zones that had set Training to Block before then moved to the new setting automatically, and the stricter Block option still shuts those crawlers out of search as well. New domains that show ads now default to disallowing training and to blocking AI agents on pages with ads. If your site runs on Cloudflare, check each zone's AI crawler settings and keep Block off anything you want found in search.
-
September 2026
Standards MonitorEU accessibility standard EN 301 549 adopts WCAG 2.2
ETSI, CEN, and CENELEC published EN 301 549 V4.1.1 in September 2026, and the European accessibility standard for ICT now points websites, software, and documents to WCAG 2.2 instead of WCAG 2.1. It is the first version written with the European Accessibility Act in mind, and once the European Commission cites it in the Official Journal, meeting it will give a presumption of conformity with both the EAA and the Web Accessibility Directive. Until that citation the reference remains V3.2.1 from 2021, which is built on WCAG 2.1 Level AA. Anyone selling to EU consumers or supplying EU public bodies should start testing against WCAG 2.2 AA now rather than wait for the Commission.
-
August 2026
SEO MonitorSearch Console adds AI search reports and an opt-out
On August 31, 2026, Google opened two Search Console features to every site after offering them to a subset of sites since June 3. A new setting removes a site from AI Overviews, AI Mode, and generative AI features in Discover, so it gets no traffic or impressions from them, and Google says the setting is not a ranking signal elsewhere in Search and does not cover model training, which Google-Extended controls. New generative AI performance reports show how often a site's pages appear in those features, by page, country, device, and date, though not how often they are clicked. Read the report before touching the setting, because opting out gives up every impression those features currently send.
-
August 2026
AI Build AutomateEU AI Act transparency rules take effect
Article 50 of the EU AI Act applied from August 2, 2026, including to businesses outside the EU whose AI output is used there. The provider of an AI system has to make its chatbot tell people they are talking to a machine and mark generated audio, images, video, and text in a machine-readable format, so a site that built its own assistant carries those duties and a site using a vendor's tool relies on the vendor meeting them. Any site that publishes deepfakes has to label them, and AI-generated text on matters of public interest needs a disclosure unless a person reviewed it and someone holds editorial responsibility for it. Generative systems already on the market before August 2 have until December 2, 2026 to add the machine-readable marking.
-
May 2026
SEO MonitorGoogle May 2026 core update
Google's second Search core update of 2026 rolled out from May 21 to June 2, and spam updates followed from June 24 to June 26 and from August 18 to August 21. As with March, Google's announcements gave the rollout windows and no detail on what changed. If traffic moved during any of those windows, compare the affected pages with the results now ranking above them and look for what those pages offer that yours do not.
-
May 2026
SEO Build MonitorGoogle expands AI Mode at I/O 2026
At I/O on May 19, 2026, Google said AI Mode had passed one billion monthly users, made Gemini 3.5 Flash its default model, and began rolling out a new Search box in every country where AI Mode is available. Reports in July that AI Mode had become the default for every search were wrong: Google said searchers would keep getting the same range of results, and a spokesperson told Press Gazette that AI Mode is not the default experience. The pressure on clicks is real regardless, since SparkToro and Similarweb found 68% of US Google searches from January to April 2026 ended without a click. Write pages that answer the question plainly, and build traffic you own (email, direct, referral) alongside search.
-
March 2026
Accessibility MonitorHome pages failing WCAG rose for the first time in six years
WebAIM's annual scan of the top one million home pages found 95.9% with detectable WCAG failures, up from 94.8% in 2025 and reversing six consecutive years of gradual improvement. Detected errors rose 10.1% to an average of 56.1 per page, and low contrast text moved backwards rather than forwards, now affecting 83.9% of pages. Because the scan only catches failures a machine can detect, true WCAG 2 AA conformance is certainly lower than the 4.1% those numbers imply. If your site has not been tested in a couple of years, assume the baseline moved against you and start with contrast and form labels.
-
March 2026
SEO MonitorGoogle March 2026 core update
Google's first Search core update of 2026 rolled out from March 27 to April 8, and Google published nothing beyond the rollout window. Widely shared claims that it scored pages on "information gain" or cut AI content farms' traffic by 60 to 80% trace to agency blogs, and Google has said neither. Its standing advice for core updates is people-first content, and its self-assessment asks whether a page provides original information, reporting, research, or analysis. Pages that only restate what already ranks have the least to offer on that test.
-
March 2026
Security Build AutomateSSL certificate lifetimes drop to 200 days
Publicly trusted SSL/TLS certificates issued from this date can be valid for no more than 200 days, down from 398, under CA/Browser Forum rules that every major browser follows. Domain validation can also only be reused for 200 days before a fresh check is required. Two more cuts are scheduled: 100 days on March 15, 2027, and 47 days on March 15, 2029. Anyone still renewing certificates by hand once a year should move to automated issuance and renewal now, because an expired certificate takes a site offline behind a browser warning.
Sources: cabforum.org, github.com
-
January 2026
SEO Automate MonitorGoogle moves AI Overviews to Gemini 3
Google made Gemini 3 the default model for AI Overviews worldwide on January 27, 2026. BrightEdge found AI Overviews on 48% of the queries it tracks by February 2026, up from about 30% a year earlier, and Seer Interactive measured organic click-through on informational queries with an AI Overview falling 61% between mid-2024 and September 2025. Google's own guidance says no special markup is needed to appear in its AI answers, so the work is clear pages that answer the question directly, plus traffic that does not depend on Google: email, direct, and referral.
-
January 2026
Privacy MonitorUS state privacy laws expand to 19 states
Consumer privacy laws in Indiana, Kentucky, and Rhode Island took effect on January 1, 2026, bringing the number of states with a comprehensive privacy law on the books to 19, and four more states passed one by June 2026. Most apply only above a size threshold, such as handling the data of 100,000 residents in Indiana and Kentucky. They are opt-out laws: a covered business must let people opt out of targeted advertising, the sale of their data, and profiling, and a growing number of states require honoring universal opt-out signals such as Global Privacy Control. If your site runs advertising or analytics tags that share visitor data, check which thresholds you meet and whether your site responds to GPC.
Sources: in.gov, ag.ky.gov, webserver.rilegislature.gov, iapp.org, iapp.org
-
December 2025
SEO MonitorGoogle December 2025 core update
Google's third core update of 2025, after March and June, rolled out from December 11 to December 29. Google's announcement gave only the rollout window. The claims that circulated afterward, that it extended E-E-A-T to every niche and punished pages with slow load times, trace to agency blogs with no published method. If traffic moved in those weeks, compare the affected pages with the results now outranking them, and allow for the holiday season, which shifts search demand in the same window.
-
September 2025
Standards MonitorWCAG 2.2 becomes ISO standard
ISO and IEC published WCAG 2.2 as ISO/IEC 40500:2025 on September 24, 2025, replacing the 2012 edition, which was WCAG 2.0. The criteria it brings into the ISO standard include a 24 by 24 CSS pixel minimum for most touch targets and a rule against making people pass a memory or puzzle test to log in without an alternative. Organizations whose contracts or regulations cite ISO/IEC 40500 should test against WCAG 2.2 now. W3C expects the December 2024 revision of WCAG 2.2 to follow as ISO/IEC 40500:2026 by late 2026, and ISO's vote on that draft closed on July 11, 2026.
-
June 2025
Accessibility MonitorEuropean Accessibility Act starts to apply
From June 28, 2025, the EAA requires the consumer products and services it lists to be accessible when sold in the EU, wherever the seller is based, which puts US businesses selling to EU consumers in scope. For websites and apps the list covers e-commerce, consumer banking, e-books, electronic communications, and services giving access to audiovisual media, and service providers with fewer than 10 staff and no more than EUR 2 million in turnover are exempt. The Directive names no technical standard, and the reference standard in use is EN 301 549 V3.2.1, built on WCAG 2.1 Level AA, until the Commission cites the September 2026 version, which moves to WCAG 2.2. Each member state sets its own penalties, and a covered service also has to explain how it meets the requirements in its terms and conditions or an equivalent document.
-
March 2025
SEO MonitorGoogle March 2025 core update
Google released the March 2025 core update on March 13 and finished rolling it out on March 27. Its announcement gave the rollout window and named no specific signals or types of site. If traffic moved in those two weeks, compare the affected pages with the results now ranking above them and look for what those pages give a searcher that yours do not.
Source: status.search.google.com
-
January 2025
Accessibility MonitorFTC order requires accessiBe to pay $1M over deceptive claims
The FTC announced an order requiring accessiBe to pay $1 million to settle allegations that it misrepresented its AI overlay widget as able to make any website WCAG-compliant, and that it formatted paid reviews to look independent. The complaint alleged the widget failed to make basic components such as menus, headings, tables, and images compliant; accessiBe neither admitted nor denied the allegations, and the order became final in April 2025. Automated checking has a ceiling: in a UK government test, the best of 13 automated tools found 40% of 142 planted barriers and the worst found 13%. Treat any product that promises compliance from a line of script with suspicion, and budget for fixing the code and testing with real assistive technology.
-
August 2024
AI AutomateEU AI Act enters into force
The EU AI Act entered into force on August 1, 2024, after the European Parliament adopted it in March and the Council in May. It sorts AI by risk: a short list of practices is banned, high-risk uses such as hiring, credit scoring, and law enforcement carry documentation, human oversight, and conformity requirements, and chatbots have to tell people they are talking to a machine. Its obligations phase in, with the bans applying from February 2, 2025, the rules for general-purpose models from August 2, 2025, and the transparency rules from August 2, 2026. Businesses putting AI in front of EU customers should work out which tier each use falls into.
Sources: commission.europa.eu, eur-lex.europa.eu
-
March 2024
Performance MonitorGoogle Interaction to Next Paint (INP) replaces FID
INP replaced First Input Delay as a Core Web Vitals metric. FID only measured the first interaction. INP measures responsiveness across all interactions during a page visit. Sites that passed FID but have slow JavaScript event handlers or heavy re-renders may now fail INP.
-
October 2023
Standards MonitorWCAG 2.2 published as W3C recommendation
WCAG 2.2 became a W3C Recommendation on October 5, 2023, adding nine success criteria to WCAG 2.1, among them target size, dragging movements, focus appearance, and accessible authentication, and dropping the obsolete Parsing criterion. ADA Title II, Section 504, and the EAA's reference standard still point to WCAG 2.1 AA, but W3C recommends 2.2 as the conformance target even where the law names an earlier version. New projects should build to 2.2 AA, which is backward compatible with 2.1.
Need help preparing?
Whether it's a compliance deadline or a performance standard, we can help you get ahead of it. Tell us what you're working on.