Web Design Cincinnati, Ohio: Website Design for Visitors in Ohio, Kentucky and Indiana

Updated November 2026 · Written and maintained by the Progression Agency strategy team

Sort your site’s visitors by state and the Cincinnati picture changes: Covington and Florence are in Kentucky, Lawrenceburg is in Indiana, and a single contact form can collect data from all three states. The web design in Cincinnati, Ohio that businesses buy has to account for that. Here you get a side-by-side table of the Ohio, Kentucky and Indiana data laws with their dates and size thresholds, then price bands and pages that serve all three. Most small firms fall below two of those laws, and the page says so plainly. Progression is a New York City firm that works with Cincinnati clients remotely, with a free proposal and a written scope first.

Start web design in Cincinnati, Ohio with a visitor map

Before anyone picks a template, count who will use the site. Owners who search for website design in Cincinnati, Ohio often picture a customer from the next neighborhood over. The regional picture is wider. REDI Cincinnati, the area’s economic development organization, says on its About page that it is the first point of contact for companies considering southwest Ohio, northern Kentucky and southeast Indiana, and it describes a 15-county, 3-state region. Its county profiles list the places in the chart below.

The chart is a list of places, not a traffic report. Some owners will find that nearly all of their visitors come from one county, and others will find a steady share from across the river. Your analytics will say which.

Real places make the point. REDI’s Kenton County profile puts the county just a bridge south of downtown Cincinnati and says it is home to Covington, the largest Kentucky-based city in the region; the City of Covington gives its address as Covington, KY 41011. The profile for Boone County, Kentucky, says it is home to the Cincinnati/Northern Kentucky Airport. Florence, Kentucky, says on its own city site that it is an engine of growth in the Northern Kentucky/Greater Cincinnati metro area. On the Indiana side, Dearborn County says it is located in the southeastern-most corner of the state, bordering Ohio and Kentucky, and lists its administration offices in Lawrenceburg.

Website design in Cincinnati for customers in Covington or Lawrenceburg is the same job as for a customer in Hamilton County, with one extra question: which state’s residents are filling in the form? Ask it because the web design in Cincinnati that owners commission can sit under three sets of rules at once. The rest of this page lays them side by side.

How do you pull the state split from your analytics?

A few minutes in your analytics gives the designer something real to work from.

1. Open the report that breaks visitors down by location. Most analytics tools have one that shows state or region.
2. Set the date range to the last 12 months, so one slow season does not mislead you.
3. Note the share of visitors from Ohio, Kentucky and Indiana, and the share from everywhere else.
4. Do the same for form submissions and, for a shop, orders. People who buy may live in different places than people who browse.
5. Write the three shares on one line at the top of the brief you give a designer.

Treat the result as a design input. It tells you which service-area wording to write and which pages to test, and it is not the number any law counts.

Three states, one site: the comparison table

This compares the text of three laws as we read it in November 2026; it is not legal advice, so ask counsel. Ohio’s is a chapter of the Revised Code. Kentucky’s and Indiana’s are consumer data acts. Indiana’s Act is described the way the Indiana Attorney General’s guide describes it.

Two counting notes sit under the table. Kentucky’s number counts Kentucky residents and Indiana’s counts Indiana residents, in a calendar year, as each Act is written, so the two are not added together across the river. How an analytics cookie, a device identifier or an ad audience counts toward either number is a question for counsel, and this page does not answer it.

Dates on one line

The Ohio defense is more than seven years older than the other two laws. Kentucky’s definitions section also has a second version dated July 1, 2027, so check the current text with counsel before relying on any defined term.

Website design in Cincinnati: price bands for a three-state site

How much website design costs in Cincinnati depends on the pages, the features and what the site connects to. None of the three laws as read sets a price for a website or adds a fixed fee to one, so scope drives the number. The tables below give our own starting prices and the published US bands, with no Cincinnati-only figure, because none exists.

Our prices, the same in all three states

Our fixed-scope pricing on the website design and development page does not change with where your visitors live. These are the build types a three-state site usually starts from.

Privacy notice placement, a rights request form or a change to how tags are set up is quoted after a written scope, and we give no price for it here.

Published US bands for this kind of site

Each band below runs from the typical low to the published high in the sources named in the caption. None is a Progression quote.

A shop that ships to Kentucky and Indiana customers should read ecommerce website design for catalog and checkout work. For the accessibility row, see accessible website design.

Under the line: what a small Cincinnati firm can skip and what it cannot

Picture a roofer in Florence or a shop in Lawrenceburg whose site brings in a few thousand visitors a year. Both Acts start their size test at 100,000 consumers in a calendar year, or at 25,000 for a business that also earns over half of its gross revenue from selling personal data. A few thousand people is nowhere near either number, so the Kentucky and Indiana Acts as read will not apply to that business on size. Whether anything else applies is a question for counsel.

Ohio’s chapter is optional and scales down to the business that uses it. The affordable web design in Cincinnati that owners can plan around is mostly a matter of scope, and the table above is a reason to leave out work that no law in it asks of a business your size. Our page on web design for small business covers the build itself.

What still matters at any size?

Skipping the heavy work is not the same as skipping the basics. These cost little and protect visitors whatever the law says.

• A privacy notice that describes what the site actually collects and which tools receive it.
• A contact form that sends where it says it sends, tested again after every change.
• Fewer scripts and tags, since each one is another service that may receive visitor data.
• One named person who reads messages about personal data.
• Counsel for anything the table does not settle, including laws this page does not cover.

Ohio: a defense you earn, not a rulebook

Chapter 1354 of the Ohio Revised Code is titled Businesses Maintaining Recognized Cybersecurity Programs, and the chapter reads more like an offer than an order. As read, it gives consumers no rights, and nothing in it orders a business to adopt a program. A business that wants the defense it describes has to meet its terms.

What does the written program have to look like?

Section 1354.02 says a covered entity seeking the affirmative defense must create, maintain and comply with a written cybersecurity program. The program has to carry the following.

• Administrative, technical and physical safeguards for the protection of personal information, or of personal and restricted information.
• A design that protects the security and confidentiality of the information.
• A design that protects against anticipated threats or hazards to its security or integrity.
• A design that protects against unauthorized access and acquisition likely to cause a material risk of identity theft or other fraud.
• Reasonable conformance to an industry recognized cybersecurity framework named in section 1354.03.

The chapter ties the size of the effort to the business. A program’s scale and scope are appropriate if they are based on five factors.

Which frameworks does the chapter name?

Section 1354.03 lists several routes. A program can reasonably conform to the NIST framework for improving critical infrastructure cybersecurity, NIST special publication 800-171, NIST special publications 800-53 and 800-53a, the FedRAMP security assessment framework, the Center for Internet Security critical security controls or the ISO/IEC 27000 family. A business regulated under HIPAA’s security requirements, Title V of Gramm-Leach-Bliley, the Federal Information Security Modernization Act of 2014 or the HITECH Act can conform to that law’s requirements instead. Compliance with the PCI data security standard counts only together with another framework from the first list.

What does the defense cover?

Section 1354.02(D) makes the defense available against any cause of action sounding in tort that is brought under Ohio law or in Ohio courts and that alleges a failure to implement reasonable information security controls resulted in a data breach. Section 1354.04 adds that the chapter does not provide a private right of action, including a class action. Whether a particular program would qualify, and which claims the defense would reach, is a question for counsel.

Where does the website fit inside a program?

The chapter does not mention websites, but a site is one of the systems a program would have to cover. The places to look are the forms that collect names and messages, the admin logins and who holds them, and the plugin and software updates that keep the site patched. Our page on website maintenance for Ohio businesses covers the upkeep side. If your question is about being found across Ohio rather than about the build, see SEO company in Ohio.

Kentucky: when a Northern Kentucky site crosses the line

Kentucky’s Consumer Data Protection Act is codified at KRS 367.3611 to 367.3629, and the Attorney General’s page says it went into effect on January 1, 2026. KRS 367.3613 says who it reaches: persons that conduct business in the Commonwealth or produce products or services targeted to its residents and that, during a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data. KRS 367.3611 defines a consumer as a Kentucky resident acting only in an individual context, and says it does not include a person acting in a commercial or employment context.

The same section lists who the Act does not reach. They are a city, state agency or political subdivision; financial institutions, their affiliates and data subject to Title V of the federal Gramm-Leach-Bliley Act; covered entities and business associates governed by HIPAA’s rules; nonprofit organizations; institutions of higher education; certain organizations that handle data solely to help law enforcement with suspected insurance fraud or to help first responders in catastrophic events; and a small telephone utility, a Tier III CMRS provider or a municipally owned utility that does not sell or share personal data with a third party. Certain kinds of data, such as protected health information, are exempt as well.

The Attorney General’s page lists the rights the Act gives Kentucky residents.

• Confirm whether a business is processing their personal data.
• Access the personal data collected, without revealing trade secrets.
• Correct inaccuracies in it.
• Delete personal data provided by or obtained about them.
• Get a portable copy, to the extent feasible.
• Opt out of processing for targeted advertising, the sale of personal data or profiling in furtherance of decisions with legal or similarly significant effects.
• Have sensitive data protected from processing without consent.

Who should ask the size question? A consumer brand with a large Kentucky customer list, a ticketing or membership site, an account-based service and a data-heavy product are the places where the question is worth asking. That is a question to put to the numbers, not a statement about any firm. For the search side of a Northern Kentucky plan, see SEO company in Kentucky.

On enforcement, KRS 367.3627 gives the Attorney General exclusive authority. Before bringing an action the Attorney General must give 30 days’ written notice naming the provisions allegedly violated. If the business cures the noticed violation within the 30 days and gives the Attorney General an express written statement that the violations have been cured and that no further violations will occur, no action for damages starts. If violations continue after the cure period, the Attorney General may seek damages of up to $7,500 for each continued violation. The statute says nothing in it gives rise to a private right of action. The version of KRS 367.3613 read here is marked as amended by 2025 Ky. Acts ch. 13, so ask counsel to check the current text.

Website jobs if you are over the Kentucky line

These are duties the statute and the Attorney General’s page put on a business that meets the size test, as the statute reads until a second version takes effect on July 1, 2027. The website carries them. Whether you are such a business is for counsel.

• A reasonably accessible, clear and meaningful privacy notice that lists the categories of personal data processed, the purpose, how consumers exercise their rights including how to appeal, the categories shared with third parties and the categories of third parties.
• At least one secure and reliable way to submit a rights request, described in the notice. The statute says a business may not require a consumer to create a new account to exercise rights, though it may require use of an existing one.
• A clear and conspicuous disclosure, with the way to opt out, if the business sells personal data or processes it for targeted advertising.
• Consent before processing sensitive data: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for personal identification, precise geolocation data and data from a known child younger than 13.
• An appeal process that is conspicuously available and similar to the process for submitting requests.
• A person who answers. The Attorney General’s page says a business must respond without undue delay and no later than 45 days, and may extend by 45 more days when reasonably necessary if it tells the consumer why.

Indiana: same numbers, counted separately

Indiana’s Consumer Data Protection Act sits in Indiana Code 24-15. We read it through the Indiana Attorney General’s Consumer Bill of Rights guide, which says the General Assembly passed the Act in 2023 and that the office will enforce it starting January 1, 2026. The guide describes the Act as applying to people and companies that do business in Indiana or produce products or services targeted to Indiana residents and that, in the applicable calendar year, either control or process the personal data of 100,000 or more Indiana residents, or of at least 25,000 Indiana residents while deriving more than 50 percent of gross revenue from selling personal data.

The numbers match Kentucky’s, but the count is a different one. The guide defines a consumer as an Indiana resident acting in a personal, family or household context, and says a person acting as an employee or in a commercial context is not a consumer. A business with a large Kentucky customer list and few Indiana customers could therefore sit over the line in one state and under it in the other. Ask counsel how your own counts come out.

The guide says the Act does not apply to 501(c)(3), 501(c)(6) or 501(c)(12) nonprofit organizations, the state or state agencies, including bodies of any political subdivision. It adds that even a business over the numbers is generally outside the Act if it is a financial institution, a HIPAA covered entity, a nonprofit, a higher education institution or a public utility.

What does the Indiana guide say to expect from a business?

The guide’s questions and answers are the closest thing to a website checklist in the Indiana material we read.

• A business covered by the Act must have a privacy notice that is easy for people to locate and access. On many websites, the guide says, the link sits at the bottom of each web page.
• The notice has to carry instructions on how to appeal a denied request.
• A response to a rights request is due without undue delay and within 45 days, with one extension of 45 days if the consumer is told within the first 45.
• There is generally no fee to make a request, and a consumer can obtain a copy of data they previously provided once a year free of charge.
• A business may not process sensitive data without the consumer’s consent, and all data about a child is treated as sensitive.

On enforcement, the Attorney General’s letter says the Act directs the office to enforce it, and the guide tells residents that if a business still fails to respond after 45 days and a written notice, they can file a consumer complaint with the Attorney General. For the remedies the Act itself provides, ask counsel to read its enforcement provisions.

REDI’s Indiana list names three counties: Dearborn, which it puts about half an hour west of Cincinnati; Franklin, about 50 miles from both Indianapolis and Cincinnati; and Ohio County, about an hour west of Cincinnati. A Cincinnati firm with customers in those counties should run the Indiana count separately. For the search side of an Indiana plan, see SEO company in Indiana.

Pages that serve three states without three copies of a site

A three-state audience does not call for three sites. It calls for one site whose pages are honest about where you work and whose forms and tags are understood. Start with the places the site collects data, since those are the places a state’s rule would touch.

One service page, one service-area statement

Write each service once. Add a single statement of where you work that names only the places you really serve, for example Hamilton County in Ohio, Kenton and Boone counties in Kentucky or Dearborn County in Indiana, if those are true for you. One privacy notice page that every page links to can serve all three states; any wording specific to a state is a matter for counsel.

Where does a state detail belong?

Put a state detail only where it is true and useful. If you hold a license in more than one state, show each number beside the state it belongs to. A delivery area, a service area and a shipping option belong next to the service they describe. A near-identical page for each state adds upkeep and no new information. For a single-metro Ohio picture, see our page on web design in Columbus, Ohio.

What a three-state build adds in code

Once the site needs logic, you are shopping for web development in Cincinnati, not only design: a form that routes a privacy request to a named person, or a calculator that asks which state a customer is in. Our web development services page lists what we build.

Test web design companies in Cincinnati with one question

A portfolio shows what a firm has built. It does not show what the firm will do when a customer in Kentucky asks to see or delete their data. One question does, and it works the same on a web designer in Cincinnati found through a neighbor and on a firm found through search:

“Show me where you would put the state data and who answers a request from a Kentucky customer.”

A Cincinnati web design agency, a studio and a freelance designer can all pass it, because it measures thinking, not size. A quote for web design services that cannot answer it has left a gap in the scope. This page names no firm and ranks none.

If you are comparing quotes, lay them side by side on those four lines before you compare prices. The cheaper quote that leaves them blank is a smaller project with the same label.

What to bring to the first call about a three-state site

A designer can do more in one conversation when the facts are on the table. Bring these six things, even if some are rough.

1. The three visitor shares from your analytics: Ohio, Kentucky, Indiana and everywhere else.
2. A list of every form on the current site and the inbox each one sends to.
3. A list of the tags, plugins and outside services that receive visitor data.
4. A draft of your service-area statement, naming only places you really serve.
5. The name of the person who would read a message about personal data.
6. The contact details of your own counsel, for the questions this page leaves to them.

With those in hand, a quote can be written against a real list, and a written scope can show what is in the price and what is not.

More for a three-state site

Pages on the work a Tri-State site can lead to:

• Website design and development
• Web design for small business
• Web design in Columbus, Ohio
• Website maintenance for Ohio businesses
• Ecommerce website design
• Accessible website design

Three-state site questions