WCAG (Level AAA) SC 2.2.6 Timeouts (w3.org)
Issue description
WCAG 2.2.6, “Timeouts” recognizes that requiring users to re-authenticate or losing their data due to inactivity can create significant barriers, especially for those with cognitive disabilities or who rely on assistive technologies. This Level AAA criterion aims to minimize these disruptions and provide users with greater control over their sessions.
Many websites implement session timeouts that automatically log users out after a period of inactivity. This can lead to:
- Frustration and data loss: Users might lose their work or progress if they are unexpectedly logged out.
- Cognitive overload: Remembering to re-authenticate frequently can be challenging for users with cognitive disabilities.
- Accessibility barriers: The re-authentication process itself might not be fully accessible to users of assistive technologies.
WCAG requirements
This guideline requires that, unless the data is preserved for more than 20 hours, users are warned of the duration of any inactivity that could cause data loss. This means:
- Clear warnings: Users should be informed about the session timeout duration when they log in or start a process.
- Notifications: Users should receive clear notifications before being logged out, with enough time to take action.
- Options to extend: Users should be able to easily extend their session to prevent data loss.
Benefits
- Reduced anxiety: Knowing about the timeout and having options to extend the session reduces anxiety and allows users to work at their own pace.
- Prevents data loss: Clear warnings and options to extend help prevent users from losing their work or progress.
- Improved accessibility: It removes a potential barrier for users with cognitive disabilities or those who rely on assistive technologies.
While this is a Level AAA criterion, meaning it represents a higher level of accessibility, it’s an important consideration for creating a more inclusive and user-friendly online experience.
Related requirements
The following WCAG source criteria are often related to this as well. They can provide additional insights into specific challenges you may be encountering.
- WCAG (Level A) SC 2.2.1 Timing Adjustable
- WCAG (Level AAA) SC 2.2.3 No Timing
- WCAG (Level AAA) SC 2.2.4 Interruptions
- WCAG (Level AAA) SC 2.2.5 Re-authenticating
Who this issue impacts
Follow the links for additional information on user impairments:
Suggestions for remediation
Remediating WCAG 2.2.6, “Timeouts” involves providing users with clear warnings and control over session timeouts to prevent data loss and minimize disruption, especially for users with cognitive disabilities. Here’s how:
Provide clear warnings
- Inform users about timeouts: When users log in or start a process that could result in data loss due to inactivity, inform them about the session timeout duration.
- Advance notifications: Provide clear notifications well in advance of the session expiring. The timing of the notification should be proportionate to the length of the timeout. For example, a warning 10 minutes before a 20-minute timeout would be appropriate.
- Multiple notifications: Consider providing multiple notifications at increasing frequency as the timeout approaches (e.g., 10 minutes, 5 minutes, 1 minute).
- Visual and auditory cues: Use both visual and auditory cues to alert users about the impending timeout.
Offer options to extend
- Extend session: Provide a simple and accessible way for users to extend their session, such as clicking a button or pressing a key.
- “Remember me” option: Offer a “Remember me” option that allows users to stay logged in for a longer period or until they explicitly log out.
Preserve data
- Automatic save: Implement automatic saving of user data at regular intervals to minimize data loss in case of a timeout.
- Save prompts: If automatic saving is not feasible, provide clear prompts for users to save their work before the session expires.
Consider user needs
- Customizable timeouts: Allow users to customize the session timeout duration in their user preferences.
- Assistive technology compatibility: Ensure that timeout warnings and extension options are accessible to users of assistive technologies, such as screen readers.
Testing
- Test with different scenarios: Test the timeout functionality with different scenarios, including with and without assistive technologies.
- User testing: Conduct user testing with people with cognitive disabilities to get feedback on the usability and effectiveness of the timeout warnings and extension options.
Example
If your website has a 20-minute session timeout, you can:
- Display a warning message: Show a modal dialog 10 minutes before the timeout, informing the user about the remaining time and providing a button to “Extend Session.”
- Provide a progress bar: Include a visual progress bar that shows the time elapsed and the remaining time before timeout.
- Offer a “Remember me” checkbox: On the login page, include a “Remember me” checkbox that allows users to stay logged in for a longer period.
By implementing these techniques, you can minimize the disruption and potential data loss caused by session timeouts, creating a more user-friendly and inclusive experience for all users, especially those with cognitive disabilities.
