Next year's dates are already set: California's privacy law on January 1, Windows 7 on January 14, Chrome's cookie change in February, old encryption dropped early in the year, and Flash ending in December. Each needs a short check.

Next year's calendar is partly written

It is the last Monday of 2019, and several dates in 2020 are already fixed. Each was announced months ago, and each touches some small business websites.

None is dramatic for most sites. All of them are easier to deal with in January than in the week they arrive, when suppliers are busy with everybody else who waited.

Here they are in order, with a short check for each.

The dates

The third is the one most likely to break something a small business relies on, because it affects tools the site borrows from other companies: payment forms, booking calendars and chat windows.

January 1: California

California's Consumer Privacy Act covers businesses that collect personal information from people in California and pass any one of three tests.

The tests are annual revenue above 25 million US dollars, personal information on 50,000 or more consumers, households or devices each year, or half or more of revenue from selling personal information.

Most small Canadian businesses fall below all three. Check once, write down the answer, and move on.

A business that does meet one needs an updated privacy notice and a way to handle requests from Californians to see or delete their information. That is a job for a lawyer as well as the website.

January 14: Windows 7

After that date, Microsoft stops fixing security weaknesses in Windows 7. The computers keep working, which is why so many will stay in use.

Anything used for banking, email or website work should be on a supported system by then. Any machine that has to stay, usually because it drives a piece of equipment, should come off the internet.

Old drives should be wiped before the machines they came from are recycled.

February: cookies and SameSite

Chrome 80, due in February, will stop sending cookies that have no SameSite setting when their site is embedded inside another one. Cookies meant to work that way will need marking SameSite=None and Secure.

Most websites' own cookies are unaffected. The risk is in embedded tools: a payment form from a processor, a booking calendar, a chat window, a login from another service.

List every tool embedded in the site and ask each vendor, in writing, whether it is ready.

Chrome already has a test setting that switches the new behaviour on early, which whoever maintains the site can use now to try the checkout and the booking form.

Early in the year: old encryption

TLS is the encryption behind every https address. Versions 1.0 and 1.1 date from 1999 and 2006, and Apple, Google, Microsoft and Mozilla have said their browsers will drop them early in 2020.

Most current hosting already offers newer versions, so most sites will notice nothing. The exceptions are old servers, old control panels, and old payment or booking systems hosted elsewhere.

Ask your host which versions the server offers, or run its address through a free online test. If 1.2 or newer is on the list, browsers will keep connecting.

A worked example

A model and hobby shop with an online store went through the list this month, with whoever maintains its site on the phone.

California did not apply. The computer behind the counter, used for email, still ran Windows 7, and its replacement is booked for the first week of January.

The payment form, embedded from the processor, was confirmed ready for February in writing. The booking calendar for weekend painting workshops, from a small vendor, was not, and the vendor has promised an update in January.

The server already offered newer encryption. A tour of the shop's model railway, built in Flash years ago, came off the events page, and two workshop photographs still loading over http were corrected.

Through the spring: insecure content

This month Chrome started tightening how it treats images and scripts that load insecurely on secure pages. In the next releases it will try to load audio, video and then images over https, and block whatever fails.

Any image or script on a secure page that still loads from an http address needs its address updated. Search the site's pages and theme for http:// and fix what turns up.

December 31: Flash

Adobe will stop updating and distributing Flash when 2020 ends, and the major browsers are dropping it on the same timetable. Chrome has blocked it by default since July, and phones never ran it at all.

Anything still built in Flash, such as a gallery, a menu, a virtual tour or an old video player, is already invisible to most visitors.

Replace it early in the year, while it is a small job rather than one of many.

One calendar, with names

Dates announced months ahead are easy to forget, because nothing reminds anybody until the day itself.

Put each one in the business calendar now, with the name of whoever will check it and the supplier who will do the work. A date with nobody's name against it is a date that passes.

Ask suppliers for their answers in writing. An email saying a payment form is ready for February is worth more than a reassurance on the phone.

The counter-case

For many small business sites, this list takes less than an hour.

California's law will not apply, the host already offers current encryption, Flash went years ago, and a site with no embedded tools has nothing for the cookie change to break.

But the hour is worth spending in January, because the one item that does apply is far easier to fix before its date than after.

In the first week of January

  1. Check California's thresholds once.
  2. Replace or isolate Windows 7 machines.
  3. List every embedded tool on the site.
  4. Ask each vendor about SameSite in writing.
  5. Ask your host which TLS versions it offers.
  6. Search the site for Flash and http://.
  7. Put each date in the calendar with a name.

Step three is the one most businesses have never done. Nobody remembers every tool a site borrows from another company until one of them stops working on a February morning.

The Windows 7 deadline is covered in more detail in four weeks left on Windows 7.

Frequently asked questions

Which website deadlines are already set for 2020?

California's privacy law on January 1, the end of Windows 7 support on January 14, Chrome's cookie change in February, old TLS versions dropped early in the year, and Flash ending December 31.

Does California's privacy law apply to my business?

Probably not. It applies above 25 million US dollars in revenue, data on 50,000 or more consumers, households or devices, or half of revenue from selling personal information.

What will Chrome's cookie change break?

Mostly tools embedded from other companies, such as payment forms, booking calendars, chat windows and logins, if their cookies lack the new settings. Ask each vendor in writing.

How do I know if my server uses old TLS?

Ask your host which versions it offers, or run the address through a free online test. If TLS 1.2 or newer is available, browsers will keep connecting.

Is Flash worth keeping until December?

No. Chrome has blocked it by default since July, phones never ran it, and most visitors already see a blank space. Replace it early, while it is a small job.

How long does this check take?

For many small business sites, under an hour. The one item that does apply is far easier to fix before its date than after it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure which 2020 dates touch your site?

Tell us which tools your site embeds. We will check each of next year's dates against your site and list what needs doing.

Start a Conversation