Web Development Company in Salt Lake City

Ranges tied to scope. A well-built marketing site of roughly ten to twenty-five pages on a headless CMS, with a real content model, responsive design, WCAG 2.2 AA conformance, structured data, and a performance budget enforced in CI, typically runs USD 25,000 to 70,000 over eight to fourteen weeks. A larger content platform with hundreds of pages, multiple content types, localization, editorial workflow, and search typically runs USD 70,000 to 200,000. Ecommerce depends heavily on catalog complexity: a Shopify build with a custom Hydrogen storefront and standard checkout runs USD 45,000 to 130,000, while configurable products, B2B pricing tiers, or ERP integration push it to USD 150,000 and up. A customer or distributor portal with authentication, role-based permissions, and backend integration typically runs USD 90,000 to 300,000. Accessibility remediation on an existing site runs USD 15,000 to 80,000 depending on how the current components were built, and a component library built on unlabeled div elements costs more to fix than one built on semantic HTML. We quote fixed fee against a signed statement of work.

The Department of Justice published its ADA Title II web and mobile accessibility rule on April 24 2024, and it did something previous guidance never did: it named a specific technical standard, WCAG 2.1 Level AA, and set hard compliance dates. Those dates then moved. A Department of Justice interim final rule published April 20 2026 extended the deadline for public entities with a total population of 50,000 or more to April 26 2027, and extended the deadline for entities under 50,000 and for special district governments to April 26 2028. The extension buys schedule, not relief, and the standard itself did not change. That reaches Salt Lake City Corporation, Salt Lake County, Utah state agencies, the University of Utah, Salt Lake Community College, and the larger school districts, and it covers web content and mobile applications the entity provides or makes available, including content posted by third parties acting on the entity's behalf. Private businesses are governed separately under ADA Title III, where there is no published technical standard but courts have consistently treated WCAG AA as the practical benchmark in litigation and settlement. We build to WCAG 2.2 Level AA, which is a superset of 2.1 AA and covers the newer success criteria on focus appearance, dragging movements, and target size. Overlay widgets do not achieve conformance and have themselves become a litigation target, so we do not use them.

Three metrics, three different root causes, and generic advice wastes budget. Largest Contentful Paint is almost always an image or font problem: an unoptimized hero image, a missing preload on the resource that becomes the LCP element, render-blocking CSS, or a slow origin response. The fixes are serving AVIF and WebP at correctly sized breakpoints, preloading the LCP image, inlining critical CSS, and moving the origin closer, which for Utah traffic means an edge network plus an origin in the Salt Lake City Google Cloud region rather than a shared host in another state. Interaction to Next Paint replaced First Input Delay as a Core Web Vital in March 2024 and it is far harder to pass because it measures the full interaction including rendering. It is usually caused by long main thread tasks from third-party tags, oversized hydration bundles, and expensive re-renders, so the fixes are shipping less JavaScript, deferring or removing marketing scripts, code splitting, and breaking up long tasks. Cumulative Layout Shift is almost always missing width and height attributes on images and embeds, web fonts swapping without a size-adjust descriptor, or content injected above existing content. We instrument real user monitoring first, because lab scores and field data frequently disagree and only field data affects rankings.

No banner is required by Utah law, and no, Utah does not obligate you to honor Global Privacy Control. Utah requires clear notice of what you collect and why plus a working opt-out path for the sale of personal data and for targeted advertising. It does not require opt-in consent before analytics or advertising tags fire, so the consent-blocking wall teams copy from European sites is not a Utah requirement. That is the legal floor, and building only to it is usually the wrong call, because almost no Utah site serves only Utah residents. What we build instead is a location-keyed consent layer. Visitor region resolves at the edge before any tag loads, and the tag manager starts in a denied state so nothing fires ahead of the decision, which is where most retrofits leak. Colorado, Connecticut, and California visitors get universal opt-out signals honored automatically, European visitors get true prior consent, and Utah visitors get notice with a functioning opt-out. We honor Global Privacy Control for every visitor regardless of region, because the engineering cost is nil and the alternative is maintaining a map of which visitor deserves which courtesy. Consent state is stored server-side with a timestamp and the policy version in force, since the question an inquiry asks is not what your banner says today but what a specific visitor was shown on a specific date. Opt-outs propagate to your customer data platform and ad destinations rather than stopping at the browser.

This is a real Salt Lake City engineering problem rather than a theoretical one. A resort, rental, lodging, or gear site can see traffic multiply within hours of a storm forecast, and the same pattern will intensify through the runway to the 2034 Winter Games. The architecture that survives it separates cacheable content from dynamic state aggressively. Conditions reports, trail and lift status, pricing pages, and product pages get served from the edge with short time-to-live values and stale-while-revalidate so a spike hits the CDN rather than your origin. Booking availability and cart state are the only things that must reach an origin, and those paths get their own capacity plan, connection pooling that will not exhaust the database, and a queue with a visible waiting position rather than a timeout. Third-party scripts are the most common failure mode we find, because a slow marketing tag will take a page down under load even when the origin is healthy, so tags load asynchronously with timeouts and a kill switch. We load test to your worst historical hour with headroom rather than to your average, run the test against production configuration, and write a runbook that names who flips the degraded-mode flag and what it turns off.

It depends on what the widget does, and for most marketing sites the answer is narrower than people fear. Utah's current rules live in Utah Code Title 13, Chapter 75, effective May 7 2025. For an ordinary consumer transaction, the duty is reactive: if a visitor clearly and unambiguously asks whether they are talking to a human or to AI, the bot must say it is AI. A support bot that answers shipping questions does not need a standing banner. The duty becomes proactive in two situations that matter for site design. If your business operates in a state-regulated occupation and the interaction is high-risk, meaning it collects health, financial, or biometric data or gives financial, legal, medical, or mental health advice, the disclosure must be prominent and must appear before the interaction, in writing and verbally where the channel is verbal. And if the feature is a mental health chatbot, a separate statute applies with much stricter labeling, which we cover in our AI work. Practically, we implement three things: an always-available honest answer to the am-I-talking-to-a-robot question rather than a scripted deflection, a prominent pre-interaction label on any high-risk surface, and a server-side log that the label rendered for that session. The log matters because the deploying business, not the model vendor, answers for what the bot says under Utah consumer protection law, and proving a disclosure appeared is the part teams cannot reconstruct later.