Who Regulates Your Website? A 2026 Guide for Pennsylvania and New Jersey

Ask most people who regulates the internet and you'll hear "the FCC." For the website your business or borough actually runs, that answer is mostly wrong.

The short answer: no single agency regulates websites in the United States. In 2026, the rules come from several places at once:

• The Federal Trade Commission (FTC) polices what your site claims and how it handles data, reviews, email and children's information.
• The Justice Department and HHS enforce accessibility under the ADA and Section 504.
• The states write their own privacy laws. New Jersey has one in force. Pennsylvania's is still pending.
• The courts fill in the gaps, often through private lawsuits.
• The FCC regulates internet providers and text messaging, not the content of your website.

The internet is a social institution, and its rules are still being written

Sociologists use the term social institution for the durable systems a society builds to meet a basic need: the family, schools, the economy, government. Each comes with its own norms, roles and rules, and those rules tend to settle over generations.

The internet now works like an institution. It's how we shop, apply for jobs, pay the water bill and follow the borough council. But it's a young one, barely a few decades old as a public tool, and its rulebook is still being negotiated between federal agencies, courts, state legislatures and the companies that run the biggest platforms.

That's why website rules feel scattered. There isn't one internet law because the institution grew faster than the rules did, and different parts of government each claimed the pieces closest to their existing jobs.

First, a myth: the internet wasn't built as a weapon

A common story says the internet was a Cold War weapon, designed by the military to survive a nuclear attack. The people who built it say otherwise.

The internet's ancestor, ARPANET, was funded by the Defense Department's research agency. In a history written by ARPANET pioneers including Vint Cerf, Bob Kahn and Leonard Kleinrock, the authors call the nuclear-survival story a false rumor. They say it grew out of a separate RAND study on secure military voice communications.

ARPANET's main early purpose was resource sharing: letting researchers use expensive computers at other universities instead of every campus buying its own. The first message traveled from UCLA to the Stanford Research Institute in October 1969.

The network was born of government money in the Cold War, but as research infrastructure, not a weapon. That origin still shapes regulation today: the internet grew up largely outside the rules that govern telephones and broadcasting.

The FCC regulates your provider, not your website

The Federal Communications Commission regulates communications networks: phone carriers, broadcasters, cable, and to a limited degree internet service providers. It has never set rules for what a business puts on its website.

Even its authority over internet providers has shrunk. In January 2025, the U.S. Court of Appeals for the Sixth Circuit struck down the FCC's 2024 net neutrality order in Ohio Telecom Association v. FCC. The court held that broadband is an "information service," not a telecommunications service, so the FCC can't treat providers like traditional phone companies. Without new legislation from Congress, federal net neutrality rules are off the table.

The FCC does matter to your marketing in one place: text messages and automated calls, covered below.

The FTC is the main regulator of business websites

If one federal agency "regulates websites," it's the Federal Trade Commission. Its core power, Section 5 of the FTC Act, bans unfair or deceptive practices, and it applies online just as it does in a store. That covers:

• Claims on your site. Prices, results, "guaranteed" anything and comparisons must be true and backed up.
• Privacy promises. If your privacy policy says you don't sell data and you do, that's deception.
• Design tricks. Hidden fees, fake countdown timers and cancel buttons buried five pages deep draw FTC attention.

The FTC has also written specific rules that reach ordinary websites:

• Reviews and testimonials. Since October 21, 2024, the Consumer Reviews and Testimonials Rule bans fake reviews (including AI-written ones), buying reviews, undisclosed reviews from employees or relatives, and suppressing negative reviews. It also bans buying fake followers or views. Our guide to online reviews for local businesses covers what this means in practice.
• Children's data. The amended Children's Online Privacy Protection Rule took effect in June 2025, with a compliance date of April 22, 2026. Among other changes, sites aimed at children under 13 now need separate parental consent before sharing kids' data with third parties for targeted advertising, and can't keep children's data indefinitely.

The FTC applies these rules to marketing vendors too. In April 2025, it finalized a $1 million order against an accessibility-widget company over claims that its tool made any website compliant, a reminder that "guaranteed" compliance claims are themselves a compliance risk.

Email and texts follow different rules

To a customer, a marketing email and a marketing text feel about the same. Legally, they're handled by different agencies under different laws:

The Justice Department and HHS enforce accessibility

Accessibility is the area where websites have the clearest technical standard. The Justice Department enforces the Americans with Disabilities Act. Its 2024 rule requires state and local government websites and apps to meet WCAG 2.1 Level AA by April 26, 2027 (populations of 50,000 or more) or April 26, 2028 (smaller governments and special districts).

The Department of Health and Human Services applies the same standard to hospitals and health care providers that receive federal health funding, with deadlines in May 2027 and May 2028. Private businesses have no formal standard, but face thousands of ADA lawsuits each year.

We cover all of it in detail in Website Accessibility and the ADA in 2026.

The states write the privacy rules

Congress has never passed a general consumer privacy law, so states have filled the gap. That's why the rules for your website can depend on where your visitors live.

Small businesses: what this means in practice

Most local businesses won't reach New Jersey's 100,000-resident threshold. But two things make privacy worth handling now:

1. Your privacy policy is a promise the FTC can enforce, no matter your size. It should accurately describe the tracking, forms and third-party tools on your site.
2. The tools on your site may collect more than you think. Analytics, ad pixels, chat widgets and embedded maps all collect visitor data. Knowing what's running is the first step under any of these laws.

One more law that protects you: Section 230

Section 230 of the Communications Decency Act generally shields websites from liability for content other people post, such as reviews, comments and forum posts. It doesn't protect content you write yourself, and it doesn't override federal criminal law or intellectual property claims. Congress debates changing it almost every session, but as of October 2026 it remains in force.

A short compliance checklist for 2026

1. Read your own privacy policy. Make sure it matches the tools actually running on your site.
2. Inventory your tracking. List every analytics script, pixel, form and embedded tool, and what data each one collects.
3. Honor opt-out signals if you could be covered by New Jersey's law or plan to sell or share data for advertising.
4. Clean up reviews. No incentives tied to positive reviews, no employee reviews without disclosure, no hiding the bad ones.
5. Check your email and text sign-ups. Unsubscribe links must work, and text opt-ins need clear written consent.
6. Fix accessibility. It's the area with the clearest standard and the most lawsuits.
7. Revisit twice a year. Pennsylvania's bill, New Jersey's regulations and federal accessibility rules could all change in the next twelve months.

We handle much of this as part of our website development and hosting care plans, and build compliance-first sites for boroughs, townships and authorities through our government and municipal services.

Sources

• Internet Society, A Brief History of the Internet (Leiner, Cerf, Clark, Kahn, Kleinrock and others)
• U.S. Court of Appeals for the Sixth Circuit, Ohio Telecom Association v. FCC, No. 24-3449 (January 2, 2025)
• Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business
• Federal Trade Commission, FTC Finalizes Changes to Children's Privacy Rule (January 2025)
• Federal Register, Children's Online Privacy Protection Rule (April 22, 2025)
• Federal Trade Commission, FTC Approves Final Order Requiring accessiBe to Pay $1 Million (April 2025)
• Crowell & Moring, FTC Targets Fake Reviews in First Consumer Review Rule
• U.S. Department of Justice, Fact Sheet: Title II rule on web content and mobile apps
• Baker Donelson, Consumer Data Privacy Law Guide: New Jersey
• Troutman Pepper Locke, New Jersey's Proposed Data Privacy Regulations Have Expired (June 2026)
• FastDemocracy, Pennsylvania HB 78 bill history
• Altoona Mirror, Pa. Senate committee unanimously passes HB 78 (June 2026)

This article began as a college sociology paper by Nathaniel Kober in 2022 and was expanded and updated in October 2026. It is general information, not legal advice. For questions about your specific obligations, consult an attorney.