2.2.6: Timeouts

What it means

Warn users about inactivity timeouts that will cause data loss, unless the data is kept for more than 20 hours. People should know their session will end before it happens.

This AAA criterion focuses on transparency before timeout.

How to fix it

• Display how long until timeout on authenticated pages when feasible.
• Send a visible warning at least two minutes before data may be lost.
• Explain what will happen (logout, lost cart, etc.) in plain language.
• Align timeout duration with privacy policy statements.

Quick examples

• Good: A banner states “Your session expires in 5 minutes — save now.”
• Bad: Users discover timeout only after being logged out without warning.
• Good: Help docs describe the 30-minute inactivity limit up front.
• Bad: Timeout happens silently during a phone call with no chance to extend.