2.2.6 Timeouts (Level AAA): WCAG explained. Axevoo

In plain English

If your site quietly discards someone’s data after a period of inactivity, they can lose work without ever knowing a clock was running. This AAA rule says either keep the data for more than 20 hours so a timeout basically cannot bite, or warn people up front how long they can be idle before it is lost.

Who this is for

People who pause often or work slowly, including many with cognitive and motor differences, who are most exposed to silent timeouts.

How to check and fix it yourself

Check whether inactivity ever discards a cart, a form, or session data. If it does, either extend how long it is kept (past 20 hours) or show a clear warning about the limit before people start.

Cart kept for days.                                   ✓ meets the 20-hour allowance
Data dropped after 30 min, with an upfront warning.   ✓ meets via warning
Data dropped after 30 min, no warning.                ✗

Where we can help

We check whether any inactivity timeout can lose customer data and whether people are warned about it, then recommend the simpler of the two fixes for your setup. It sits with the other enough-time checks.

Frequently asked questions

What does timeouts require?+

Success Criterion 2.2.6 (Level AAA, added in WCAG 2.1) says users must be warned about the duration of any inactivity that could cause data loss, unless the data is preserved for more than 20 hours of inactivity.

How is it different from re-authenticating (2.2.5)?+

2.2.5 is about restoring data after you log back in. 2.2.6 is about warning you upfront that a timeout exists and could cost you data, so you aren't caught by surprise. One saves the data, the other tells you the risk.

What's the simplest way to comply?+

Either keep in-progress data for more than 20 hours (so a timeout can't realistically lose it), or clearly tell the user at the start how long they can be inactive before their data is discarded.