2.2.6 Timeouts

Who it helps

People with cognitive, memory or attention disabilities may need breaks or extra time to gather documents. Knowing the timeout up front lets them plan, prepare in advance or save their work before stepping away.

How to meet it

• The best fix is to keep users' entered data for more than 20 hours of inactivity, so nothing is lost when they come back.
• If you cannot, state the inactivity limit at the start of the task, for example "This form times out after 30 minutes of inactivity."
• Say what will be lost, and show the notice once at the start, not on every step.
• Check privacy rules such as HIPAA or PCI DSS before storing data, since some require consent first.
• Level AAA is not required by most laws or policies, which point to AA. It is still worth meeting where you can.

Examples

<h1>Apply for a parking permit</h1>
<form action="/apply" method="post">
  <!-- fields -->
</form>

<h1>Apply for a parking permit</h1>
<p id="timeout-note">
  For your security, this form times out after 15 minutes of inactivity.
  Answers you have not submitted will be lost.
</p>
<form action="/apply" method="post" aria-describedby="timeout-note">
  <!-- fields -->
</form>

Common mistakes

• Warning users only seconds before a timeout, instead of telling them the limit at the start.
• Stating the timeout in a help page or terms document that users do not see during the task.
• Keeping data for a few hours and assuming that is enough without a warning; the threshold is 20 hours.
• Warning about a timeout on every step of a long process, which adds noise.

Related criteria

• 2.2.1 Timing Adjustable
• 2.2.5 Re-authenticating
• 2.2.3 No Timing

Official W3C explanation of 2.2.6