2.2.6 Timeouts

1. What is the goal of this criterion?

You probably know this: you’re filling out a complicated form, the phone rings, and when you come back everything is gone. Session expired, all data lost. For some people this isn’t just annoying – it’s an insurmountable barrier.

People with cognitive disabilities, attention disorders or motor impairments often need more time to complete complex tasks. They may need to take breaks, look up information or simply collect themselves.

The goal of Success Criterion 2.2.6 is therefore clear: users should know how long they can be inactive before their data is lost – or, even better, the data is kept for more than 20 hours.

2. What exactly does it require?

It’s about timeouts caused by inactivity that can lead to data loss. The criterion allows two solutions:

Option 1: State the duration. Users are told how much inactivity can cause their data to be lost. The most useful place for this is at the start of a process – before anyone has invested time.

Option 2: Keep the data (recommended). Input is preserved for more than 20 hours, even if nobody does anything. Then no warning is needed, and people can take breaks and continue later.

Good to know:

• The criterion doesn’t prohibit timeouts. It only requires transparency or sufficiently long data retention.
• If data is stored before someone has signed in, privacy law may require explicit consent.
• For minors, such consent may not be solicited in most jurisdictions. The W3C recommends consulting privacy and legal experts here.

3. Why does it matter for accessibility?

Imagine you have to file your tax return online, but your concentration fades after 30 minutes. Or you have a motor impairment and need an hour for a form that others complete in 10 minutes.

Timeout information and long data retention improve accessibility because they:

• allow people with cognitive disabilities to work at their own pace,
• help people with attention disorders collect themselves and take breaks,
• give people with memory impairments time to look up information,
• give people with motor impairments enough time for input,
• help older people, who often need more time for digital tasks.

And not least: they spare everyone who has ever lost important data to an unexpected timeout a lot of frustration.

4. How to meet the criterion

It’s usually technically feasible – and often a win for overall usability. Here are some proven tips:

Ideal: keep data for more than 20 hours

• Save form data automatically, even when someone leaves the page.
• Use a server-side database or localStorage in the browser. sessionStorage isn’t suitable because it’s cleared when the tab is closed.
• Offer a “Save draft” function for longer processes.
• Protect stored data appropriately, for example with encryption, and don’t keep sensitive data unprotected in the browser.

Alternative: be clear about the timeout

• State the maximum period of inactivity at the start of a process.
• Use plain language: “This session expires after 30 minutes of inactivity. Unsaved input will be lost.”
• Place the notice where it’s easy to see, but not intrusive.

Technical implementation:

• Build auto-save into important forms.
• Extend the session on the server while someone is active.
• Offer an “Extend session” dialog before it expires – Timing Adjustable already requires this.
• Restore the user’s progress after they sign in again (see Re-authenticating).

What to avoid:

• Silent timeouts without any notice
• Unnecessarily short periods without a security reason
• Data loss after even brief interruptions
• Unclear or hidden timeout information

5. Why this criterion matters for businesses

Success Criterion 2.2.6 shows once again that accessibility isn’t an end in itself – it brings tangible benefits.

1. More completed processes

Every lost form is a potentially lost customer. People who have to re-enter everything often give up. With reliable data retention, more people reach their goal.

2. Less pressure on customer service

Fewer frustrated calls along the lines of “My data suddenly disappeared!” mean less support effort. Happy customers contact support less often – and recommend you to others.

3. A wider audience

You make your services accessible to people with cognitive disabilities, older people and anyone who completes complex tasks in several sittings. According to the WHO, around 1.3 billion people worldwide live with a significant disability.

And finally: AAA criteria like 2.2.6 are not mandatory under the European Accessibility Act (EAA) or its German implementation, the Barrierefreiheitsstärkungsgesetz (BFSG), since the harmonised standard EN 301 549 references WCAG 2.1 Level AA. Implementing them is a deliberate step beyond the minimum. This is general information, not legal advice.

6. The success criterion in the W3C’s words

Success Criterion 2.2.6 Timeouts (Level AAA)

Users are warned of the duration of any user inactivity that could cause data loss, unless the data is preserved for more than 20 hours when the user does not take any actions.

Note: Privacy regulations may require explicit user consent before user identification has been authenticated and before user data is preserved. In cases where the user is a minor, explicit consent may not be solicited in most jurisdictions, countries or regions. Consultation with privacy professionals and legal counsel is advised when considering data preservation as an approach to satisfy this success criterion.

In short: users must be told how much inactivity can cause data loss – unless the data is kept for more than 20 hours.