Context

Effective 17 March 2025, the NZ Government Web Usability Standard 1.4 (the Standard) replaces the Web Usability Standard 1.3.

The Standard sets some minimum requirements to help people use a website and its content.

The major changes in version 1.4 of the Web Usability Standard are:

• new contact information requirements to support the public’s need for non-digital access channels
• new privacy statement requirements to better the meet the Privacy Act 2020.

For an account of all the substantive changes in the Web Usability Standard 1.4, see Web Standards effective from March 2025.

Mandated organisations

Based on a 2003 mandate established by Cabinet, all public service departments, the Defence Force, the Police and the Parliamentary Counsel Office are directed to implement the Standard.

Cabinet Minute (03)41/2b — New Zealand Government Web Guidelines: Mandatory Requirements

Public Service departments — Te Kawa Mataaho

Other public sector and local government organisations are not required to implement the Standard, but are encouraged to do so.

There’s a reasonable expectation that the websites of all public sector organisations will be accessible to the widest range of New Zealanders, including disabled people. This is due to:

• the Human Rights Act 1993
• the Bill of Rights Act 1990, and
• NZ’s ratification of the United Nations Convention on the Rights of Persons with Disabilities.

United Nations Convention on the rights of Persons with Disabilities

Terminology

The keywords ‘must’, ‘should’ and ‘should not’ used in the Standard signify different types of requirements as defined by RFC 2119:

• ‘must’ signifies that the defined course of action is absolutely required
• ‘should’ defines a recommended course of action that may be ignored as long as the full implications of doing so are clearly understood and the organisation is prepared to accept them
• ‘should not’ indicates a course of action that is not recommended but that may be reasonable to take as long as the full implications of doing so are clearly understood and the organisation is prepared to accept them.

RFC 2119

Other terms used in the Standard, for example web page, inactive web page (previously archived web page), website, main content, also have specific meanings, all of which are defined in the Web Usability Standard’s glossary.

What’s required

The Standard contains 6 requirements. The first 4 apply to publicly facing websites only, while the last 2 apply both to publicly facing websites and internally facing websites.

Requirements for publicly facing websites

1. Government identity

Each home page must include the name or logo of the mandated organisation for the website. This requirement helps users clearly identify who is accountable for the website.

If the website is a partnership between 2 or more organisations, government or non-government, it’s recommended that each NZ Government organisation contributing to the website makes its participation clear by including its name and/or logo on the website’s home page.

Each home page must also include a visible link to www.govt.nz. This link should use a suitable all-of-government logo and follow the recommended NZ government logo markup.

2. Contact information

To make it easy for visitors to contact the mandated organisation responsible for the website, the site must include or link to relevant contact information. The link must be visible on the website’s home page and clearly indicate that it will take the user to the contact information for the site.

The contact information must provide the following minimum information:

• an email address monitored daily during business hours where emails received are acknowledged within 3 business days with an indication of when a full response can be expected
• a postal address monitored daily during business hours
• a physical street address open to the public during business hours, if one exists
• the number of a telephone line available and monitored daily during business hours
• the telephone number for any call centre that supports a service provided by the website
• a link to the New Zealand Relay Service (NZ Relay) for people who are hard of hearing, deafblind, or who have a speech impairment.

3. Copyright

Government organisations are encouraged to make information available easily, widely and equitably to the people of NZ (except where reasons preclude such availability as specified in legislation). They’re equally encouraged to permit the use of material in which they own the copyright, subject to acknowledgement of source. Accordingly, each website must include or link to a general copyright statement.

The website’s general copyright statement must clearly indicate:

• what content on the website it applies to
• the content’s copyright status
• the licensing terms under which that content can be re-used by others.

The site’s home page must include a visible link to the copyright statement. The link’s text must be something like ‘Copyright’ or ‘Manatārua’ to clearly indicate that its target is the site’s copyright statement.

A website that contains third-party copyright material must clearly indicate either, within the general copyright statement or with each item of such material:

• the source and copyright status of such material in a way that avoids ambiguity as to which content items are subject to third-party copyright
• that the website’s terms of content re-use do not apply to such material
• that permission to re-use such material cannot be given by the mandated organisation responsible for the website.

The general copyright statement should also state that its general licensing terms do not apply to any material on the website that’s covered by the Flags, Emblems, and Names Protection Act 1981.

Agencies are encouraged to apply the New Zealand Government Open Access and Licensing framework (NZGOAL) when choosing the licensing terms for the copyright material on their websites.

For related guidance, see NZGOAL Guidance Note 1: Website copyright statements.

4. Privacy

Each website must provide access to 2 privacy statements, an Organisation Privacy Statement (OPS) and a Website Privacy Statement (WPS). The OPS describes, at a general level, all the ways the mandated organisation responsible for the website collects and uses personal information. The WPS describes how the particular website does that.

These requirements help agencies meet their obligations under the Privacy Act 2020.

That the information required in the OPS and the WPS can be provided by links to each other and other privacy statements gives agencies some flexibility in taking an approach that suits their situation and does not require more than what’s in the Privacy Act 2020.

Organisation Privacy Statement (OPS)

The organisation responsible for the website needs to provide only 1 OPS, and it can live on any of the organisation’s publicly facing websites. The OPS needs to describe at a general level:

• all the ways the organisation collects personal information, including through websites, other digital and non-digital channels — note that this also includes personal information collected indirectly, for example, from third parties
• why that personal information is being collected
• who will receive that personal information, for example, the organisation responsible for the website or third parties
• if collecting that personal information is voluntary or mandatory — either under a particular law or because it is not possible to provide services without it
• users’ rights to request access to or to correct personal information held by the organisation responsible for the website and contact details so people can make such requests.

The OPS can provide this information directly through links to the WPS or privacy statements on other websites.

Website Privacy Statement (WPS)

The site’s home page must include a visible link to the WPS. The link’s text must be something like ‘Privacy statement’ or ‘He tauākī matatapu’ to clearly indicate that its target is the site’s privacy statement.

The WPS must include a link to the OPS and describe at a general level:

• how personal information is collected through the website
• why that personal information is being collected
• who will receive that personal information
• whether the site uses cookies, including their type, purpose and how long they last
• any collection or use of information that could be used to identify individuals if connected to other information — this includes, but is not limited to:
  • IP address
  • operating system
  • device sensors — for example, GPS, camera, microphone
  • web browser

The WPS can provide this information directly or through links to the OPS or privacy statements on other websites.

Requirements for publicly and internally facing websites

Note that the following 2 requirements do not apply to inactive web pages.

Definition of inactive web pages

1. Links to non-HTML files

When a web page includes a link to a non-HTML file (for example, a video file), it helps users to know something about the file they’ll download if they click the link.

Links to non-HTML files must be accompanied by information indicating the file’s format (for example, mp4, PDF, MS Word) and size. The format and size should be included in the actual link text, for example, Getting a ship into a bottle (PDF 463KB).

2. Printable web pages

Some users will print out web pages for various reasons. In the majority of those, it’s the page’s main content that’s of interest, and not all of the surrounding menus and widgets. For this reason, it’s required that the main content of each web page, in the page’s current state, be printable on A4 paper. The content should print by default as black text on a white background, and should not include the following items:

• primary content navigation
• secondary content navigation
• persistent or site-wide search form
• decorative elements.

Scope

Of the 6 requirements in the Web Usability Standard, 4 apply to publicly facing websites that a mandated organisation is responsible for. The remaining 2 requirements apply both to publicly facing and internally facing websites.

Certain requirements of the Standard apply to a website as a whole, while other requirements apply to specific web pages that are part of that website.

Publicly facing

Publicly facing web pages can be accessed by members of the general public or people who are not employees, staff or authorised paid personnel of a NZ government public sector organisation. This includes web pages that require users to authenticate themselves through some kind of login, for example an extranet for liaising with service providers.

Internally facing

Internally facing web pages can be accessed only by people who are employees, staff or authorised paid personnel of a NZ government public sector organisation. This includes web pages that are part of a government organisation’s intranet or web-based document management system.

Internally facing web pages are subject to the Standard in order to help government organisations:

• employ and support disabled staff, and
• align with provisions generally accepted as necessary for the fair and proper treatment of employees, as identified in section 73(3) of the Public Service Act 2020.

Public Service Act 2020 — New Zealand Legislation

Web apps and office documents

Note that the definition of web page used in this Standard includes what are typically referred to as web applications, but also resources such as Microsoft Word and PDF documents.

Definition of web page

Pages that an organisation simply contributes to

The 2003 Cabinet Minute is the formal mechanism that established the Standards and their scope of application. That scope does not include any website that a mandated organisation contributes to in some way.

It’s recommended that mandated organisations take deliberate steps to ensure that websites to which they make substantive contributions are produced and/or maintained to meet the Standards.

Inactive web pages

Inactive web pages do not need to meet WCAG. An inactive web page (archived web page in the previous version of the Standard) is one that remains available on a website for reference purposes, but whose main content is no longer needed for active administration purposes and is no longer updated or modified.

An inactive web page’s main content must be clearly marked as inactive or archived and include accessible instructions on how a user can request an accessible version of its content.

Website owners are strongly encouraged to audit their site’s content to identify those web pages that contain redundant, out-of-date or trivial content. In most cases, such pages should be either updated or removed from the website. However, in some instances there may be value in retaining them on the website, but not in maintaining or updating them, in which case they must be marked as inactive web pages.

Exemptions

There’s no process by which a mandated organisation can secure an exemption from the requirement to meet the Standard. Instead, each organisation is responsible for meeting the Standard, and accordingly accepts any risks associated with not doing so.

Assessment and reporting

Mandated organisations must be prepared, when notified by the Government Chief Digital Officer (GCDO), to assess and report on how their web pages conform with the Standard. The assessment methodology and reporting mechanism will be communicated to organisations at the time of notification.

In the case that an organisation does not fully meet the Standard, it will be required to manage any risk associated with that lack of conformance by performing a risk assessment and submitting a plan to address, over time, those areas of non-conformance.