Web Development Company in Portland

Ranges tied to scope. A well-built marketing site with a real content model, custom design, a component library, accessibility testing and a performance budget typically runs USD 25,000 to 70,000. A headless commerce build on Shopify with Hydrogen or a custom Next.js storefront, including product data modeling, size and fit content, search, checkout customization and third-party integrations for reviews, loyalty and subscriptions, typically runs USD 70,000 to 220,000. A large institutional site or a customer portal, meaning authentication, entitlements, multilingual content, accessibility conformance and integration into a CRM, billing system or health system directory, runs USD 150,000 to 500,000 and up. Ongoing support and iteration is usually 15 to 25 percent of build cost annually. Rebuilds of existing sites often cost less than expected when the content model is sound and more than expected when it is not, which is why the assessment comes first. Design and front-end rates in this market run well under Bay Area equivalents. Oregon has no state sales tax, so an Oregon shopper pays none, but your checkout still needs correct tax calculation for the states where you have economic nexus.

Practically, four things. First, a privacy notice that actually describes the categories of personal data you collect, the purposes, the categories you sell or share, and how consumers exercise their rights, written to match what your tag manager is really doing. Second, working mechanisms for access, correction, deletion, portability and opt-out, plus Oregon's distinctive right for a consumer to obtain a list of the specific third parties, other than natural persons, that received personal data, where the controller elects whether to answer for that consumer's data or for its disclosures generally. No other state grants that right in this form, and either answer requires a current inventory of every script, pixel and vendor. Third, opt-in consent before processing Oregon's sensitive categories, which include health condition, genetic and biometric data, precise geolocation, national origin, immigration status and status as transgender or nonbinary. Fourth, recognition of universal opt-out mechanisms, mandatory since January 1 2026, meaning your site must read Global Privacy Control signals and act on them across the tag layer, not just in a cookie banner. There is no private right of action here; the Oregon Attorney General enforces alone, seeks civil penalties of up to 7,500 dollars per violation, and since January 1 2026 no longer has to give you 30 days to cure first.

Consent has to be a service, not a banner. We read the Global Privacy Control header and the corresponding navigator property on every request, resolve it against any explicit choice the visitor has already made, and write a single authoritative consent state that everything downstream reads. Google Tag Manager runs in consent mode with triggers bound to that state rather than to a cookie the banner set. Server-side tagging, where a client uses it, reads the same state so an opt-out cannot be routed around by moving collection to the server. Analytics, advertising pixels, session replay, heatmaps, chat widgets and A/B testing tools each get an explicit category, because session replay on a health system page or a checkout is a different risk than page-view analytics. Then we add a regression test: a Playwright run that loads key pages with the opt-out signal set and fails the build if any network request goes to a categorized vendor. That test is the difference between a compliance claim and a compliance fact, and it is what an Oregon Department of Justice inquiry would effectively be checking.

WCAG 2.1 Level AA is the working standard for private-sector sites in Oregon and the explicit standard the Department of Justice's ADA Title II rule sets for state and local government web content, which covers the City of Portland, Multnomah County, TriMet, Portland State University and their vendors. Automated tooling catches roughly a third of real issues, so we run axe-core in CI to stop regressions and then do the manual work that finds the rest: full keyboard traversal of every interactive flow including modals, carousels, filters and checkout; screen-reader passes with VoiceOver on Safari and NVDA on Windows Firefox; focus visibility and focus-order review; contrast checks against the actual brand palette rather than the design file; form error handling announced to assistive technology; reduced-motion behavior; and 200 percent zoom and 320 pixel reflow testing. Video content needs captions and, for public entities, audio description considerations. We deliver a conformance report with severity ratings, and we fix issues in components so a fix applies everywhere rather than page by page.

Footwear, apparel and outdoor brands live on large photography, so the work is making that photography cheap rather than making it small enough to look bad. LCP: identify the hero element honestly with field data, preload it, serve AVIF with WebP fallback at correctly sized breakpoints through an image CDN, set fetchpriority high, and never lazy-load the LCP image. INP is where most brand sites now fail, and the cause is almost always client JavaScript, so we move rendering to server components, cut third-party scripts or defer them behind interaction, break long tasks with scheduler yielding, and audit every analytics and personalization tag for main-thread cost. CLS: explicit dimensions on all media, reserved space for banners and consent UI, and font loading with size-adjust descriptors so the fallback and web font occupy the same space. Then we hold the line with a performance budget enforced in CI and real-user monitoring, because a site that passes at launch and fails three months later after marketing adds four tags has still failed.

Yes, and the failure mode is always the same: a redesign ships, URLs change, redirects are incomplete, and traffic drops for a quarter. We prevent it with a pre-launch crawl of the existing site capturing every indexed URL, its status code, its title and meta description, its canonical, its structured data and its inbound internal links, then a redirect map covering every URL that changes, tested as a suite rather than spot-checked. Structured data is ported and validated: Product, Offer and Review markup for commerce, Organization and LocalBusiness where relevant, Article for editorial, FAQPage where it is genuinely used, and MedicalOrganization or Physician markup for health systems. Titles, headings and content depth are preserved or improved rather than trimmed for visual tidiness. XML sitemaps are regenerated and submitted, robots directives are reviewed so a staging noindex does not ship to production, which is the single most common launch-day disaster, and internal linking is audited so authority still flows. We monitor Search Console daily for the first two weeks and hold a rollback path the whole time.