Seven expensive website mistakes Denver businesses keep repeating
Colorado privacy enforcement, home rule sales tax, WCAG procurement rules and mountain bandwidth all punish the same lazy website build. Here is what to do instead.
We work with Front Range businesses from Dubai, so we usually meet a Denver website at the point where it has already gone wrong. The same few mistakes show up on dispensary sites in RiNo, roofing contractors in Arvada, aerospace suppliers near Jeffco Airport and clinics along Colfax. None are aesthetic. They produce a legal letter, a failed procurement bid, a tax notice, or an empty lead form.
1. Treating the Colorado Privacy Act as somebody else's problem
Colorado has its own privacy law, the Colorado Privacy Act, enforced by the Colorado Attorney General and district attorneys. Two dates matter. Since 1 July 2024, covered businesses must honour a universal opt out signal, and the recognised one is Global Privacy Control, which Firefox sends by default. Since 1 January 2025 the mandatory cure period is gone, so the first you hear of a problem can be the enforcement action. Penalties run up to twenty thousand dollars per violation.
The typical Denver marketing site fires Google Tag Manager, a Meta pixel and a session recorder on page load, shows a cookie banner that changes nothing, and never reads GPC. That is not a compliance programme. That is a banner.
What to do instead: gate your tag manager behind real consent state, read the Sec-GPC header server side and the navigator.globalPrivacyControl flag client side, and treat that as an opt out of targeted advertising without asking again. A day or two of engineering, and far cheaper than the alternative.
2. Building checkout as if Colorado had one sales tax
Colorado is the hardest sales tax state to build for, and Denver sits at the centre of it. Denver is a home rule city collecting its own sales tax under its own licence, separate from the state. Aurora, Lakewood, Colorado Springs and roughly seventy other jurisdictions do the same, each with its own registration, return and view of what is taxable. Two addresses a few blocks apart can fall in different jurisdictions.
Colorado also charges a Retail Delivery Fee on every order of taxable goods delivered by motor vehicle in the state. It rose to thirty one cents on 1 July 2026, is charged per delivery rather than per item, and must appear as its own invoice line.
What to do instead: never hardcode a rate. Use rooftop level address validation and a tax engine that knows Colorado home rule jurisdictions, and confirm it treats the delivery fee as a separate line rather than folding it into shipping.
3. Assuming accessibility is optional until a bid asks for it
Colorado was the first state to require its own state and local government entities to make digital content accessible, under HB21-1110, with WCAG 2.1 Level AA recognised as the standard by the Colorado Office of Information Technology. HB24-1454 added a grace mechanism with quarterly progress reporting, but the direction has not changed. Statutory damages of three thousand five hundred dollars per violation per person are available, alongside injunctive relief and legal fees.
The law binds public entities, not your restaurant. It reaches you the moment you sell to one. If your prospect list includes the City and County of Denver, Denver Public Schools, RTD or CDOT, procurement will ask for a conformance statement, and a site of unlabelled icon buttons and failing contrast cannot produce one honestly. Private businesses face ADA demand letters instead.
What to do instead: build to WCAG 2.1 AA from the first component. Keyboard operability, real focus states, labels tied to inputs, captions on video. Write the conformance report while the build is fresh.
4. Building for office wifi in LoDo, not LTE in a canyon
Colorado customers decide in places with bad signal. Someone books a rafting trip from a pullout on US 285. A homeowner in Evergreen looks for a mitigation contractor during a smoke advisory. A skier checks whether you rent touring gear while stopped at the I-70 tunnels. Mountain LTE crawls, and no phone rescues a page that loads a megabyte of JavaScript before rendering a phone number.
What to do instead: server render the content that matters, put the phone number and address in the HTML rather than behind a script, size images properly, and test on a throttled connection. Then read the Chrome UX Report data for your own domain, which reflects real Colorado visitors rather than your laptop.
5. Publishing Spanish that nobody read before it went live
Denver has a large Hispanic population concentrated in neighbourhoods including Westwood, Globeville and Elyria Swansea, and Aurora adds sizeable Amharic, Vietnamese and Somali speaking communities. For home services, healthcare and legal firms, Spanish is often the language of the household making the purchase.
The recurring mistake is a Google Translate widget bolted into the header, or machine translated pages with no hreflang and an English only contact form at the end. Visitors read two sentences, recognise machine Spanish, and leave. The pages rank for nothing because Google cannot tell which version serves whom.
What to do instead: translate with a human who speaks the Spanish actually spoken here, give each language its own indexable URL, set reciprocal hreflang with an x-default, translate the form and the confirmation email too, and make sure somebody can answer the phone in Spanish. Half a bilingual funnel is worse than none.
6. Baking Denver's clock and calendar into the HTML
Mountain Time is the easiest US zone for a developer to forget. Denver sits two hours behind New York and one behind Chicago, so a booking widget defaulting to Eastern will offer a customer a slot you are not open for, and a webinar time published without a zone is read as Eastern by half your audience.
The calendar version is hours and seasonal content hardcoded into a template. Colorado businesses change state constantly: ski season staffing, patio hours, closures after a spring blizzard, and the hail season that decides the year for every roofer in the metro. If changing a homepage banner after a storm needs a developer, it will not happen at nine on a Saturday night, which is when the searches arrive.
What to do instead: store times in UTC, render in America/Denver, and label every published time with its zone. Put hours, seasonal notices and emergency banners in the CMS where staff can change them in a minute, and keep them in sync with your Google Business Profile.
7. Learning your industry's rules after launch
Denver's economy concentrates in sectors that each carry their own constraints.
- Cannabis. The Marijuana Enforcement Division at the Colorado Department of Revenue restricts advertising that reaches under 21 audiences and requires age affirmation before content is shown. Card networks do not process dispensary sales, so an online menu is order ahead and pay in store. A standard e-commerce build is the wrong shape.
- Aerospace and defence suppliers. Metro Denver has one of the densest private aerospace workforces in the country. A public file drop of technical drawings sits inside export control expectations. It is a compliance incident, not a lead magnet.
- Brewing and distilling. Alcohol advertising and direct shipping rules sit with the Colorado Liquor Enforcement Division and vary by destination state, which means an age gate and a shipping ruleset, not a cart.
- Anything using AI on the site. Colorado's AI law has moved repeatedly: SB 24-205 was delayed to 30 June 2026, then enjoined, and SB 26-189 sets the framework from 1 January 2027. If your site screens applicants or makes lending or housing decisions, 2024 guidance no longer applies.
The short version
- 01Honour Global Privacy Control and gate tags on real consent.
- 02Treat Denver as its own tax jurisdiction, delivery fee on its own line.
- 03Build to WCAG 2.1 AA if any public sector client is on your list.
- 04Optimise for a weak mountain signal, not office fibre.
- 05Do Spanish properly, with hreflang and a bilingual reply, or not at all.
- 06Render in America/Denver and let staff edit hours without a deploy.
- 07Check your regulator before the build, not after the notice.
Every item here is cheaper to build in than to bolt on. Retrofitting consent, tax logic and accessibility into a finished site routinely costs more than the build did.
We are a Dubai team working with Colorado clients remotely, which means your morning arrives to finished work. If you want a straight opinion on which of these is costing you money, send us the details.
