ADA website compliance · Title II · Section 508 · Section 504 · WCAG
ADA website compliance and US accessibility law – who must do what, by when, and what is still open.
What does ADA website compliance actually require? The honest answer starts with how US law is built. Private businesses fall under ADA Title III, which has no technical standard for websites. State and local governments have a WCAG 2.1 AA rule with deadlines in 2027 and 2028, federal agencies and their vendors work under Section 508, and recipients of HHS funding under Section 504. On this page I explain who must do what, by when, and what really helps.
Trusted by leading companies across the DACH region
Featured as an expert on ZDF WISO
Four laws, no single standard: how US accessibility law is built
The Americans with Disabilities Act of 1990 is older than the modern web. It prohibits discrimination against people with disabilities, but it does not mention websites or apps. That gap has been filled in different ways: by a detailed rule for government websites, by procurement rules for federal agencies and, for private businesses, by DOJ guidance and court decisions.
The result is a patchwork with one common thread. Wherever a federal rule names a technical standard, it is WCAG: version 2.0 for Section 508, version 2.1 for Title II and the HHS Section 504 rule. For private websites, WCAG is still what the DOJ calls helpful guidance, even though in 2026 it declined to endorse it as the required standard.
Legal status as of November 10, 2026. US accessibility rules are moving quickly: deadlines have been pushed back, a lawsuit against that delay is pending, and the Department of Justice (DOJ) has changed its tone on technical standards. This page explains the law in general terms and is not legal advice; for your situation, please talk to a US attorney.
Which law applies to whom: Title III, Title II, Section 508, Section 504
There is no single US “web accessibility law”. Four federal rules matter, and which one applies depends on who you are.
| Law | Who it covers | Technical standard |
|---|---|---|
| ADA Title III | Private businesses that are “public accommodations”, such as stores, restaurants, hotels and service businesses | None set by regulation for websites |
| ADA Title II | State and local governments, including special district governments, and services they provide through contractors | WCAG 2.1 Level AA (DOJ rule of April 2024) |
| Section 504 (HHS rule) | Organizations that receive funding from the US Department of Health and Human Services (HHS) | WCAG 2.1 Level AA (HHS rule of May 2024) |
| Section 508 | Federal agencies, and their vendors through procurement | WCAG 2.0 Level A and AA, also for non-web documents and software |
For private businesses, the relevant rule is Title III. Its text lists twelve categories of “public accommodations” but does not mention websites or apps; the DOJ says the ADA applies to them anyway, and courts have applied it, with differences explained below. Under Title II, a public entity must also make sure its contractors meet the rule, so it reaches vendors who sell software or digital services to cities, counties, public schools or transit agencies (details on our page on ADA Title II). Section 508 covers the technology that federal agencies develop, procure, maintain or use; vendors are affected through procurement (see our Section 508 page). For Section 504, this page covers the HHS rule for the websites, apps and kiosks of HHS funding recipients, for example in health care and social services.
Why there is no technical standard for private websites
For Title III there is no regulation that sets a technical standard for private websites. The DOJ withdrew its earlier rulemaking on the websites of public accommodations in December 2017, and we have found no new draft since.
The DOJ guidance of March 2022
In its Guidance on Web Accessibility and the ADA of March 18, 2022, the DOJ says it has “consistently taken the position” that the ADA applies to the web, but that it “does not have a regulation setting out detailed standards”. WCAG and the Section 508 Standards provide “helpful guidance”, and businesses “can currently choose how they will ensure” accessibility. The guidance is not binding; it was still published on ada.gov on November 10, 2026.
The DOJ position of February 2026
On February 2, 2026 the DOJ opposed a proposed class action settlement over a retailer’s website (Alcazar v. Fashion Nova, N.D. Cal.): little value for consumers with vision disabilities, no mechanism to confirm or enforce the promised fixes, and generous compensation for the attorneys. A footnote reads: “The United States does not endorse WCAG as the appropriate or necessary standard for the provision of auxiliary aids and services under Title III of the ADA.” As of November 10, 2026 we have found no decision on the settlement.
I read this as a warning against fixes that exist only on paper, not as permission to do less. In practice WCAG remains the reference point: the settlement in that case named WCAG 2.1, and the DOJ measured the settlement’s own claims website against it. We test against WCAG 2.2 Level AA, which includes the success criteria of 2.0 and 2.1 except the removed 4.1.1 Parsing.
Online-only businesses: courts disagree
Whether an online-only business is a “public accommodation” is not settled; the US Supreme Court has not decided the question. The Ninth Circuit, which covers California and other western states, requires a connection, a “nexus”, to a physical place; in Robles v. Domino’s (2019) a pizza chain’s website and app were covered because they connect customers to its restaurants. According to legal commentary, other circuits read the law more broadly. In 2022 a California appellate court (Martinez v. Cot’n Wash) held that a website without a physical location is not a place of public accommodation under the ADA. Which view applies depends on where you could be sued.
How it is enforced: lawsuits, demand letters and state laws
Lawsuits under federal law
Under federal Title III, private plaintiffs can obtain an order to remove the barriers and, if they win, their attorney’s fees, but no money damages. If the Attorney General sues, the court can also award damages to the people affected and civil penalties, currently up to USD 118,225 for a first violation. According to the annual count by the law firm Seyfarth Shaw, 8,667 Title III lawsuits were filed in federal courts in 2025, 3,117 of them about websites, 27% more than in 2024; New York (1,021) and Florida (961) led. Cases in state courts, which matter especially in California and New York, are not included, and we know of no neutral count for them.
Demand letters
Some disputes start with a letter from a law firm that lists barriers and proposes a settlement. We have found no reliable figures on how many such letters are sent. My advice: do not ignore a letter, do not pay in a panic, involve a US attorney early, and keep a record of what you have tested and fixed.
State laws: California, New York, Colorado, Missouri and Utah
- California: Under the Unruh Civil Rights Act, every ADA violation is also a violation of state law, with damages of “in no case less than four thousand dollars ($4,000)” per violation, plus attorney’s fees. For online-only businesses, the Martinez decision sets limits: a separate Unruh claim there requires intentional discrimination.
- New York: We found no state law with a WCAG requirement for private websites; according to legal commentary, lawsuits often add claims under the state and city human rights laws. State entities must meet the most current WCAG version at Level AA “to the extent practicable” (State Technology Law § 103-d).
- Colorado: State agencies and other public entities must meet the accessibility standards of the state Office of Information Technology, and people can sue over violations (HB21-1110). Since August 2025, contractors must meet the same standards and indemnify the agency or school (HB25-1152).
- Missouri and Utah: Both passed laws in 2026 against abusive website accessibility lawsuits. In Missouri (SB 907, in force since August 28, 2026), a business that fixes the barriers in good faith within 90 days of written notice benefits from a rebuttable presumption against abuse. In Utah (SB 68), defendants can sue back if a website access lawsuit is abusive. Neither law changes the federal ADA.
Deadlines that matter in 2027 and 2028
Title III has no separate web deadline: the obligation applies now. The Revised 508 Standards have applied since January 18, 2018. The dates below concern public entities, funding recipients and, through their contracts, their vendors.
| Date | Rule | Who |
|---|---|---|
| January 1, 2027 | New York State Technology Law § 103-d | New York state entities: websites meet the current WCAG Level AA, or a public progress report is due |
| April 26, 2027 | ADA Title II, WCAG 2.1 AA | State and local governments with a population of 50,000 or more |
| May 11, 2027 | Section 504 (HHS), WCAG 2.1 AA | HHS funding recipients with 15 or more employees |
| April 26, 2028 | ADA Title II, WCAG 2.1 AA | Governments with a population under 50,000, and special district governments |
| May 10, 2028 | Section 504 (HHS), WCAG 2.1 AA | HHS funding recipients with fewer than 15 employees |
The Title II dates come from an interim final rule of April 20, 2026, which moved the original deadlines (April 24, 2026 and April 26, 2027) back by about a year; HHS moved its Section 504 dates in May 2026. According to the DOJ, the substantive requirements are unchanged. On May 21, 2026 the National Federation of the Blind sued the DOJ and HHS in federal court in Maryland over the delays. We know of no decision yet, and a ruling could change the dates again. My advice: plan for the current dates and do not count on another delay.
Documents and PDFs: the most common gap
Every federal rule that names a technical standard includes documents. Section 508 applies WCAG 2.0 Level A and AA to non-web documents such as PDFs, Word files and presentations, with four navigation-related success criteria excluded. Title II covers documents on websites and in apps, with an exception for conventional electronic documents posted before the compliance date, unless they are currently used to apply for, access or take part in a service; the HHS Section 504 rule has similar exceptions. When HHS extended its deadlines, it cited reports of “time-consuming and costly remediation of PDF documents”.
In our audit work, documents are rarely the first thing teams think of and often where the largest backlog sits. Two points matter. An “ADA-compliant PDF” is not an official category: there is no ADA certificate for documents, and the yardstick is WCAG. And PDF/UA (ISO 14289-1) is the technical standard for well-structured PDFs, but Section 508 measures documents against WCAG 2.0, not against PDF/UA, so a good remediation checks both. More on what the rules require for ADA and Section 508 PDFs and in our guide to PDF/UA.
What really helps: audit, ACR and monitoring
Since no law tells private businesses exactly what to do, the most reliable path is one you can explain: test against WCAG, fix, document, and keep it from breaking again.
- Automated scans such as axe or WAVE find many technical errors quickly. But 60–70% of WCAG criteria cannot be tested automatically, for example whether an alternative text is meaningful or whether a screen reader user can complete a checkout. A scan is a starting point, never evidence that a website conforms.
- Audits add manual testing with screen readers such as JAWS, NVDA and VoiceOver, keyboard-only navigation and zoom, on representative pages and key journeys such as sign-up, search and checkout.
- The ACR (Accessibility Conformance Report) is the usual proof in public procurement; the General Services Administration calls it “a good way” to address a solicitation’s accessibility requirements. It is normally based on the voluntary VPAT template of the Information Technology Industry Council (ITI), currently version 2.5 in the editions 508, EU, WCAG and INT. An ACR documents results per criterion. It is not a certificate, does not prove legal compliance, and is only as good as the testing behind it.
- Monitoring after each deployment catches machine-detectable regressions from new plugins, forms or CMS updates early. It complements periodic manual testing but does not replace it.
What does not help
Promises that a script or widget can make any website conform. In April 2025 the Federal Trade Commission (FTC) finalized an order under which an overlay vendor agreed to pay USD 1 million. According to the FTC, the vendor had claimed that its AI tool could make any website conform to WCAG, claims the FTC called false, misleading or unsubstantiated. I take this case seriously for our own wording too: no tool and no service, ours included, can rule out a lawsuit.
Selling to the EU too? The European Accessibility Act
Since June 28, 2025 the European Accessibility Act (EAA) has set accessibility requirements for many products and services, including e-commerce. It applies to companies outside the EU that offer covered products or services to EU consumers; microenterprises that provide services are exempt. The technical reference is EN 301 549, which builds on WCAG, and enforcement lies with the member states. A test against WCAG 2.2 Level AA serves both markets; what differs is the report, for example the 508 or WCAG edition of an ACR for US buyers and the EU edition for European tenders. More on our page about the European Accessibility Act for companies outside the EU.
How ifdb supports US organizations
IFDB GmbH is based in Munich, Germany, and has an office in San Francisco. Our offer follows the steps above: Access Score® and Access Read give you a free first picture of your website and your PDFs, Access Doc remediates documents to PDF/UA with human review, Access Ready audits with assistive-technology users and, on request, documents the results as an ACR, and Access Guard monitors after every deployment. We do not promise a legal outcome. We give you an honest picture, help you fix what matters most first, and document what was tested, for you, your attorney and your buyers. Talk to us if you are unsure where to start.
Three federal rules, one yardstick.
How to prepare without testing twice.
Because the federal rules that name a standard all point to WCAG, you do not need a separate WCAG test for each law. A thorough test against WCAG 2.2 Level AA includes the success criteria of 2.1 and, except for one removed criterion, of 2.0; Section 508 adds a few requirements beyond WCAG, for example for software and support documentation. What differs is how you report the results and which deadlines apply to you.
FAQ
Frequently asked questions about ADA website compliance
First the facts, then the plan.
Start with a free Access Score® and an honest look at your documents. Then let’s talk about which US rules apply to your organization and what to fix first.
ADA website compliance in practice: understand the rules, test honestly, document the result
ADA website compliance is less a seal than a process: knowing which rule applies to you, testing against WCAG, fixing barriers in a sensible order and documenting what was done. The primary sources are public. The DOJ explains its view in the Guidance on Web Accessibility and the ADA and in its fact sheet on the Title II rule, and the General Services Administration describes the ACR on Section508.gov. With ifdb, you can move from the legal framework to practice: the free Access Score® scan gives you a first picture of your website, our page on ADA Title II explains the 2027 and 2028 deadlines for public entities, and Access Ready combines manual testing with assistive-technology users and, on request, an ACR based on the VPAT template. This is how US accessibility law becomes a plan you can explain to your users, your buyers and your attorney.