2.2.6 Timeouts (AAA)

Success Criterion 2.2.6 Timeouts (Level AAA):

Users are warned of the duration of any user inactivity that could cause data loss, unless the data is preserved for more than 20 hours when the user does not take any actions.

Privacy regulations may require explicit user consent before user identification has been authenticated and before user data is preserved. In cases where the user is a minor, explicit consent may not be solicited in most jurisdictions, countries or regions. Consultation with privacy professionals and legal counsel is advised when considering data preservation as an approach to satisfy this success criterion.

Intent:

This success criterion is intended to prevent users from having to start tasks over again if they unintentionally take too long to complete a task or leave the page inactive for a period of time.

The two solutions offered are to:

  1. Just give the user at least 20 hours, regardless of inactivity, to complete the task or form.
  2. Inform the user of the inactivity time constraint at the beginning of the task so that they can choose to prepare their information ahead of time (so they don’t need to run and find more documents to complete their taxes, risking an inactivity timeout), and make sure any breaks they take or pauses they use to check their work are not too long.

A third solution would be to save user information, but various privacy policies and laws affect this solution, so the W3C recommends consulting experts on privacy and legal counsel before using that solution.

Note that this success criterion does not apply to content that is timed regardless of inactivity. Timed content is covered by SC 2.2.1 “Timing Adjustable.”

Exceptions:

This success criterion does not apply to loss of information outside of the content provider’s control, such as when the user closes the browser window.

Who it helps:

  • Users with cognitive disabilities.
  • Users who like to make snacks in the middle of long forms.

Example: Provide a timeout warning

A modal dialog saying, 'To protect your data, user sessions expire after 15 minutes of inactivity. You may lose progress on this form if you pause word longer than this period.'

For security reasons, many banking websites timeout after short periods of inactivity. In order to prevent users being losing data while filling out a form, banks can provide a warning at the beginning of the form that tells the user what the inactivity timeout period is.