Who Must Comply?
Digital accessibility requirements apply across multiple legal frameworks in the United States and internationally. If you're building products that people depend on, understanding who must comply is the first critical step.
ADA Title III applies to private businesses that operate as public accommodations. This includes retailers, restaurants, hotels, educational institutions, and any business open to the public. Their websites and digital products must be accessible to people with disabilities.
Section 508 of the Rehabilitation Act applies to federal agencies and anyone selling technology products or services to the federal government. If your organization contracts with federal agencies, your digital products must comply. Additionally, if your organization receives federal funding or grants (universities, nonprofits, schools), accessibility requirements apply.
State and local government agencies fall under a subset of the ADA (Title II), and in 2024 the DOJ issued guidance requiring WCAG 2.1 Level AA compliance for state and local government websites and digital services.
The three main audiences for accessibility compliance: (1) federal agencies and their vendors, (2) private businesses serving the public, and (3) state and local government. But there are often nuances based on organizational size, type, and funding source. If you're unsure whether your organization is covered, it's worth consulting accessibility guidance specific to your sector.
Does the ADA Apply to Websites?
Yes — the ADA applies to websites. While the Americans with Disabilities Act was signed in 1990, before the modern web existed, courts and the Department of Justice have consistently interpreted ADA Title III to cover websites and digital products. Any private business open to the public is required to make its digital services accessible to people with disabilities.
While the ADA does not explicitly mention the Web, courts have consistently held that websites are covered. The landmark case National Federation of the Blind v. Target Corporation (2006) established that inaccessible websites violate ADA Title III. Target settled for $6 million in damages, a precedent that sent shockwaves through the business community.
The ADA does not specify a technical standard like WCAG. However, the Department of Justice has endorsed WCAG 2.1 Level AA as the accepted benchmark for ADA compliance. In 2024, the DOJ strengthened this guidance for state and local government, explicitly requiring WCAG 2.1 AA compliance.
Unlike Section 508, the ADA is enforced through private lawsuits and DOJ enforcement actions. This means organizations face legal exposure if they don't take accessibility seriously. Settlements and damages can be substantial, and there's reputational harm.
What Does Section 508 Require?
Section 508 is part of the Rehabilitation Act of 1973. It requires that federal agencies and federally funded organizations make their electronic and information technology (EIT) accessible to people with disabilities. In 2017, Section 508 was refreshed to incorporate WCAG 2.0 Level AA as its technical standard.
EIT (Electronic and Information Technology) includes websites, software applications, digital documents, and any technology system that stores or transmits information. It's a broad umbrella that covers nearly everything a modern organization uses internally and shares publicly.
One of the key mechanisms for Section 508 compliance is the VPAT (Voluntary Product Accessibility Template). A VPAT is a structured document that vendors complete to document how their product meets Section 508 standards. When a federal agency or contractor buys software, they typically ask for a VPAT. It's become the standard proof of accessibility compliance for government procurement.
The procuring process is straightforward but critical: a federal agency issues a Request for Proposal (RFP) for a software or service contract. Vendors are asked to provide a completed VPAT. The government evaluates not just the product's features and price, but also its accessibility conformance. If a product fails Level AA, it can be rejected or the vendor must commit to a remediation plan with specific timelines.
| Aspect | Section 508 | ADA |
|---|---|---|
| Applies to | Federal agencies, federal contractors, federally funded organizations | Private businesses and public accommodations open to the public |
| Technical standard | WCAG 2.0 Level AA (since 2017 refresh) | WCAG 2.1 Level AA (endorsed by DOJ; not explicitly required by law) |
| Enforcement | Compliance audits, VPAT documentation, procurement review | Private lawsuits, DOJ enforcement actions, settlements |
| Documentation | VPAT required for government sales; must be detailed and accurate | No specific template required; accessibility statements recommended |
Are There Exceptions to Accessibility Law?
Both Section 508 and the ADA have built-in exceptions, but they are narrow and do not work as blanket exemptions. Organizations sometimes claim they are unable to make a system fully accessible, citing "undue burden" or "fundamental alteration." These claims require careful scrutiny and usually do not hold up under legal review.
Undue Burden is a legitimate exception in some cases. If making a product accessible would require disproportionate cost or effort relative to the organization's budget and resources, the law recognizes this. However, "disproportionate" is interpreted narrowly. A major federal contractor claiming financial hardship to avoid accessibility compliance is unlikely to succeed. Undue burden has been used successfully in rare cases involving small nonprofits with extremely limited budgets, but it's not a common defense.
Fundamental Alteration is another narrow exception. If making a service accessible would fundamentally change the nature of the service, the organization is not required to do it. For example, a screen reader cannot reasonably be applied to a real-time video game without fundamentally changing the product. But this exception is applied very restrictively in practice.
Archived Content and Pre-Existing Third-Party Content have limited exemptions. Archived content that is no longer actively maintained is sometimes treated differently, though there's growing expectation that even older content should be made accessible if feasible. Third-party content that an organization embeds (e.g., a widget from another vendor) remains the responsibility of the primary organization, even if the vendor is not fully accessible.
Exceptions do not excuse accessibility entirely. Even if an organization claims undue burden, they must still take reasonable steps to provide alternative access. For example, if a complex financial system cannot be made fully keyboard-navigable, the organization might provide a phone line or alternative interface. Procuring agencies and litigants expect to see documented effort and good-faith remediation, not a simple claim of exemption.
What Changed in WCAG 2.2?
WCAG 2.2 was published in September 2023, building on WCAG 2.1. It adds 9 new success criteria aimed at improving accessibility for people with cognitive disabilities, low vision, and limited motor control. While Section 508 still formally references WCAG 2.0, and courts reference WCAG 2.1, organizations targeting federal contracts and private sector leadership are increasingly adopting WCAG 2.2.
| New Criterion | Level | What It Means |
|---|---|---|
| Focus Appearance (2.4.11) | AA | When a user tabs through a page with the keyboard, the focused element must be clearly visible. No hidden focus outlines. |
| Dragging Movements (2.5.7) | A | If drag-and-drop is required, an alternative keyboard method must exist. Not everyone can perform mouse drag operations. |
| Target Size (2.5.8) | AA | Interactive elements must be at least 24x24 CSS pixels. Helps people with motor control issues or using touch devices. |
| Redundant Entry (3.3.7) | A | Users should not have to enter the same info twice in one transaction (unless it's for security, like re-entering a password). |
| Accessible Authentication (3.3.8) | AA | Don't require users to solve cognitive puzzles (e.g., "enter the 3rd character of your password"). Offer simple alternatives. |
| Consistent Help (3.3.6) | A | Help mechanisms (contact forms, live chat) must appear consistently across pages so users can find them easily. |
These additions reflect real pain points that users with disabilities face. Focus visibility and target size directly address usability for people with low vision or motor disabilities. Authentication rules help people with cognitive disabilities. Organizations aiming for best-in-class accessibility are already implementing WCAG 2.2 criteria even if not legally required yet.
Who Owns Accessibility?
This is a critical question that organizations often get wrong: accessibility is not just a developer or QA problem. It is an organizational responsibility that spans design, product, development, QA, content, and legal teams.
Product and design teams must build accessibility into the product from the start. Accessible design is easier and cheaper than retrofitting accessibility later. Designers should test prototypes with assistive technologies and understand WCAG criteria during the design phase.
Developers are responsible for translating accessible design into accessible code. This means using semantic HTML, proper ARIA, keyboard navigation, and testing with screen readers. It's not an afterthought or a QA job; it's a development responsibility.
Content teams must write accessible content: proper heading structure, descriptive links, alt text for images, captions for videos. Many accessibility issues originate in content decisions, not code decisions.
QA and testing teams must include accessibility in their test plans. This means manual testing with keyboard-only navigation, screen readers, and assistive technologies. Not just automated tools.
Legal and compliance teams must understand the regulatory landscape and ensure the organization has documentation and a remediation plan in place. They also need to work with product leadership to allocate time and resources for accessibility work.
What Are the Legal Consequences of Inaccessibility?
The consequences of accessibility non-compliance are real and escalating. Organizations face legal action, reputational damage, loss of market share, and government procurement blocks.
The Department of Justice has issued hundreds of settlement agreements with organizations found to violate the ADA. In recent years (2022-2024), the pace of DOJ enforcement has accelerated. Common violations include websites lacking proper alt text, insufficient color contrast, broken keyboard navigation, and missing form labels. Settlement amounts typically require the organization to remediate the issues within 30-120 days and pay damages of $5,000 to $50,000+.
Private lawsuits have exploded in recent years. Class action lawsuits against retailers, airlines, financial institutions, and tech companies are increasingly common. Many organizations now budget for expected litigation costs as a line item. The cost of a settlement (often $50,000-$500,000 depending on organization size) is typically far higher than the cost of fixing accessibility in the first place.
Government procurement blocks are another serious consequence. If an organization submits an inaccurate VPAT or fails a Section 508 audit, federal contracts are revoked or not awarded. For large contractors, this can mean millions in lost revenue. Universities and nonprofits receiving federal funding face compliance requirements; failure to meet them can result in funding cuts.
Market impact should not be overlooked. Consumers are increasingly aware of and supportive of accessible products. An organization known for accessibility has a competitive advantage. Conversely, organizations that face legal action or get called out on social media for inaccessibility suffer reputational harm that affects recruitment, partnerships, and sales.
Building accessible products from the start is cheaper, faster, and lower-risk than retrofitting or fighting lawsuits. Organizations that prioritize accessibility also report better user satisfaction, easier internationalization, improved SEO, and stronger team morale because everyone knows they're building for everyone.
Frequently Asked Questions
Can I be sued for having an inaccessible website?
Yes. Thousands of web accessibility lawsuits are filed in the U.S. every year under the ADA. Any private business open to the public — including e-commerce sites, restaurants, healthcare providers, and financial services — can face legal action if their website is not accessible to people with disabilities.
Common targets include broken screen reader flows, missing alt text, inaccessible forms, and unresizable text. Proactively meeting WCAG 2.1 Level AA is the most effective way to reduce legal exposure.
Does the ADA apply to websites?
Yes. While the ADA was enacted in 1990 before the modern web existed, federal courts have consistently ruled that websites are covered under ADA Title III. The landmark case National Federation of the Blind v. Target Corporation (2006) established this precedent. The Department of Justice has also endorsed WCAG 2.1 Level AA as the accepted technical standard for ADA website compliance.
What is the Section 508 refresh?
The Section 508 Refresh refers to a major update to Section 508 standards that took effect in January 2018. The update aligned Section 508 requirements with WCAG 2.0 Level AA and expanded coverage to include all ICT (Information and Communication Technology) — not just federal websites, but also software, hardware, kiosks, and electronic documents used by federal agencies and their contractors.
What happens if I fail a Section 508 audit?
If a federal agency or federally funded organization fails a Section 508 audit, they may be required to remediate accessibility issues within a defined timeframe. Repeated non-compliance can result in loss of federal contracts, formal complaints to the agency's inspector general, or civil rights complaints filed with the Department of Justice.
For vendors selling to the federal government, Section 508 non-compliance can disqualify their product from procurement entirely — which is why VPATs exist as a pre-purchase documentation tool.
Do I need a VPAT for ADA compliance?
No. A VPAT is a procurement document used to demonstrate Section 508 compliance when selling to U.S. federal agencies. The ADA does not require a VPAT. However, maintaining a public accessibility statement — documenting your WCAG conformance level and your process for handling accessibility complaints — is strongly recommended as a good-faith demonstration of ADA compliance.
Can a company claim "undue burden" to avoid accessibility requirements?
Rarely, and only in narrow circumstances. "Undue burden" is a recognized exception under Section 508 and the ADA, but the bar is high. Courts and regulators interpret it narrowly — a large business or federal contractor claiming financial hardship is unlikely to succeed. The exception has been applied only in cases involving very small nonprofits or organizations with severely limited resources.
Even when undue burden is accepted, the organization must still take all reasonable steps toward accessibility — it does not excuse non-compliance entirely.
What changed in WCAG 2.2 compared to WCAG 2.1?
WCAG 2.2, published in October 2023, added nine new success criteria and removed one (4.1.1 Parsing, which was deprecated). Key additions include:
- 2.4.11–2.4.13 — Focus appearance requirements (minimum visible focus indicator size and contrast)
- 2.5.7 — Dragging Movements (alternatives to drag interactions)
- 2.5.8 — Target Size Minimum (at least 24×24 CSS pixels for interactive targets)
- 3.2.6 — Consistent Help (help mechanisms must appear in the same location across pages)
- 3.3.7–3.3.9 — Accessible Authentication (no cognitive puzzles required to log in)
WCAG 2.1 remains legally cited in most regulations, but WCAG 2.2 is the current recommended standard for new projects.