Timeouts
Warn people up front how long they can sit inactive before their data is lost. The one way out is keeping that data for more than 20 hours of inactivity, in which case no warning is needed at all. The clock runs only while the user takes no actions, and the rule only covers timeouts you know about and control. Somebody closing their browser and losing an unsubmitted page is not your failure.
Why it matters
The warning has to arrive before the work starts, not partway through it. Somebody who knows a form drops after 15 minutes can plan around it, take the break they need, and come back. Somebody who finds out when the data vanishes cannot. Twenty hours is not an arbitrary figure either. It is set to cover a full day of interruption, so a reader can start a task, live the rest of their day, and finish it.
Who this rule protects
People with cognitive disabilities who need to plan a task and take breaks, and older readers, are the two groups W3C describes.
How to check it yourself
- Look for a stated timeout duration before a long form begins, at the start of the process rather than at each step.
- Check whether the data survives more than 20 hours of inactivity, which removes the need for a warning entirely.
- Check that the warning is not a modal appearing 14 minutes in, which is too late to plan around.
- Leave out anything you neither know about nor control, because the criterion does not reach it.
Failures we see most often
- No mention of the timeout appears anywhere until it fires.
- The duration sits in a help article nobody reads before starting the form.
- A warning arrives only once the timer is nearly up.
Who this one is for
Read from this rule's own note above, so the grouping and the note cannot disagree.
- Cognitive and learningpeople for whom the difficulty is understanding, remembering, or staying with it
How to fix it
- State the limit at the start of any long process, in a sentence.
- Or preserve the data for more than 20 hours and drop the warning. Take privacy advice before you build that, because W3C says to, and the consent question is genuinely hard where your users might be under 18.
- Tell people how their progress is being saved, and when.
Passes vs. fails
Passes
A line at the top of the form says the session ends after an hour of inactivity, so the reader can plan the sitting.
Fails
A tax form logs you out after 20 minutes, with no mention of the limit anywhere.
In audits and lawsuits
This is Level AAA and the cheapest of the timing criteria to satisfy, because the warning route is a sentence at the top of the form. The preservation route is not cheap, and W3C attaches a caution to it that we pass on in full. Privacy law may require explicit consent before user data is kept, and where the user is a minor that consent may not be available at all in most jurisdictions. W3C advises taking privacy and legal advice before choosing data preservation, and names PCI DSS and HIPAA as the regimes in question. One more thing worth knowing. W3C's own explanatory document says at least 20 hours while the criterion itself says more than 20 hours. The criterion governs.