2.2.6 Timeouts

What this rule means

WCAG 2.2.6 requires that users are informed about any inactivity timeout that could cause data loss. If the application will lose user data after a period of inactivity (session timeout, shopping cart expiration, form data loss), the user must be warned about the duration at the start of the process. The exception is when data is preserved for more than 20 hours of inactivity.

This is different from 2.2.1 (which requires adjustable timing) and 2.2.5 (which requires data preservation after re-authentication). This criterion is specifically about transparency: telling users upfront that a timeout exists and how long they have, so they can plan accordingly. Users should know before starting a task that they have a limited window to complete it.

Why it matters

Many users are unaware that sessions can expire or that inactivity can cause data loss. Users with disabilities who need extra time to complete tasks may step away from a computer to rest, may switch to a different assistive technology, or may simply work more slowly than the timeout anticipates. Without a clear warning about the timeout duration, these users may unknowingly lose their work.

Transparency about timeouts allows users to plan their approach. A user who knows they have 15 minutes to complete a form can decide whether to gather all information first. A user who knows a shopping cart expires after 30 minutes can prioritize completing their purchase. This information is especially critical for users who need to plan rest breaks or who work at a slower pace.

Related axe-core rules

There are no automated axe-core rules for this criterion. Timeout warnings are a design and content requirement that must be verified through manual review of the user interface and documentation.

How to test

Testing requires identifying all inactivity timeouts and verifying that users are warned about them.

1. Identify all places where user data can be lost due to inactivity: session timeouts, form data expiration, shopping cart timeouts.
2. Verify that users are warned about the timeout duration before they begin the affected activity.
3. Check that the warning is clear, prominent, and understandable (not buried in terms of service).
4. Verify the stated timeout duration is accurate.
5. If data is preserved for more than 20 hours, verify this claim is accurate through extended inactivity testing.

How to fix

Provide clear timeout warnings at the beginning of any process where inactivity could cause data loss.

Timeout warning on forms

<form id="application-form">
  <div role="alert" class="timeout-notice">
    <p>
      <strong>Important:</strong> This form will save your
      progress automatically. However, your session will
      expire after 30 minutes of inactivity. Please ensure
      you complete and submit the form within this time,
      or your unsaved changes may be lost.
    </p>
  </div>

  <!-- Form fields -->
  <label for="name">Full name</label>
  <input type="text" id="name" name="name">
  <!-- ... more fields ... -->
</form>

Shopping cart timeout notice

<div class="cart-header">
  <h1>Your Shopping Cart</h1>
  <p class="timeout-info" role="status">
    Items in your cart are reserved for
    <strong>60 minutes</strong>. After that, they may
    become unavailable if stock is limited.
  </p>
</div>

Login page timeout disclosure

<div class="session-info">
  <h2>Session Information</h2>
  <p>
    For security, your session will expire after
    <strong>15 minutes</strong> of inactivity.
    You will be prompted to extend your session
    before it expires.
  </p>
</div>

Common mistakes

• Session timeouts that are only documented in the terms of service or help pages, not at the point of interaction.
• Vague warnings like "Your session may expire" without specifying the duration.
• Timeout information that is visually present but not accessible to screen readers.
• Different timeout durations for different parts of the application without individual warnings.
• Shopping carts that silently expire without any upfront timeout disclosure.
• Not warning about inactivity-specific timeouts (as opposed to absolute session duration).