A demand letter arrives citing the Americans with Disabilities Act and the company website. A customer’s vendor form asks whether the site is an ADA compliant website. A county IT manager hears that the deadline moved to 2027. Each of them is asking two questions about ADA compliance for websites: do websites have to be ADA compliant, and if so, to what standard? For businesses open to the public and for state and local governments, the Justice Department’s answer to the first question is yes. The second depends on who runs the site.
State and local governments now have a regulation that names a standard and a date. Businesses have the statute, Justice Department guidance, settlement agreements and court decisions, but no ADA website regulation; a business that receives HHS financial assistance has one under Section 504. This guide sets out what the ADA requires of a website in each case, who it covers and who it does not, who enforces it, and what an organization can show when someone asks.
The ADA reaches a website through what the organization offers on it
The ADA was signed in 1990 and does not mention websites. Title III, which covers private businesses open to the public, states its rule in terms of what a business offers:
“No individual shall be discriminated against on the basis of disability in the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation by any person who owns, leases (or leases to), or operates a place of public accommodation.” (42 U.S.C. 12182(a))
A second duty carries the rule onto the screen. The statute treats a failure to provide “auxiliary aids and services” as discrimination unless they would fundamentally alter the offering or impose an undue burden (12182(b)(2)(A)(iii)), and the regulation requires a public accommodation to “furnish appropriate auxiliary aids and services where necessary to ensure effective communication with individuals with disabilities” (28 CFR 36.303(c)(1)). A website that sells, books, informs or takes applications is one of the ways an organization delivers its services and communicates.
The Justice Department has read the law that way for decades. Its 2022 guidance on web accessibility says that “the Department has consistently taken the position that the ADA’s requirements apply to all the goods, services, privileges, or activities offered by public accommodations, including those offered on the web,” and dates that position to 1996. The same guidance applies it to state and local governments under Title II.
What the Department never produced for businesses is a website rule. It opened rulemaking in 2010 and then, in December 2017, withdrew it, noting that it “has not published any rulemaking document regarding title III Web accessibility since the 2010 ANPRM” (82 FR 60932). The Title III regulation in 28 CFR part 36 sets no web standard. Its 2010 appendix only restates the position: “the Department has taken the position that title III covers access to Web sites of public accommodations” (28 CFR part 36, Appendix A). The guidance itself carries a caution that matters in a dispute: such documents “have no legally binding effect, and have no force or effect of law.”
For a board paper or a customer questionnaire, the answers to “what is ADA compliance for websites” and “is ADA compliance mandatory for websites” fit in one paragraph. For a business open to the public or a state or local government, the Justice Department holds that the ADA applies to what the organization offers online. The open questions are which technical standard applies and, for a business that exists only online, which court hears the case.
Which part of the ADA applies depends on who runs the website
The ADA is divided into titles by who is regulated, and the website follows the organization behind it. The table sorts the common cases, with the standard each one carries as of November 2026.
| Who runs the site | Law | What the site must meet | Source |
|---|---|---|---|
| Business open to the public: lodging, restaurants, stores, banks, law and medical offices, private schools, gyms and the other categories | ADA Title III | No regulation and no named standard; the Title II rule and the 2021 Rite Aid agreement use WCAG 2.1 Level A and AA | 42 U.S.C. 12181(7), 12182 |
| State or local government, including public colleges, school districts and special districts | ADA Title II | WCAG 2.1 Level A and AA from April 26, 2027 or April 26, 2028 | 28 CFR 35.200 |
| Employer, for staff tools and job applications | ADA Title I, employers with 15 or more employees | Reasonable accommodation for an employee or applicant | 42 U.S.C. 12111 |
| Recipient of HHS financial assistance, such as a hospital or clinic that receives it | Section 504 of the Rehabilitation Act, 45 CFR part 84 | WCAG 2.1 Level A and AA from May 11, 2027 (15 or more employees) or May 10, 2028 | 45 CFR 84.84 |
| Federal agency | Section 508 of the Rehabilitation Act, not the ADA | Revised 508 Standards | 29 U.S.C. 794d |
| Private club or religious organization | Exempt from Title III | Title III does not apply, except to the extent a club’s facilities are made available to customers or patrons of a place of public accommodation (28 CFR 36.102(e)) | 42 U.S.C. 12187 |
View the data as a list
- Business open to the public: ADA Title III; no rule, WCAG 2.1 AA is the working benchmark.
- State or local government: ADA Title II; rule requires WCAG 2.1 AA from April 2027 or April 2028.
- Employer, staff tools and job applications (15 or more employees): ADA Title I; reasonable accommodation.
- Recipient of HHS funds: Section 504; rule requires WCAG 2.1 AA from May 2027 or May 2028.
- Federal agency: Section 508; Revised 508 Standards.
- Private club or religious group: exempt; no Title III duty.
Title III coverage does not depend on size; size and resources count in the undue-burden defense (28 CFR 36.104), so the ADA requirements for businesses reach the small ones too. Title III lists twelve categories of public accommodation, from “a restaurant, bar, or other establishment serving food or drink” to “a gymnasium, health spa, bowling alley, golf course, or other place of exercise or recreation” (42 U.S.C. 12181(7)). Its carve-outs are narrow: an owner-occupied lodging with “not more than five rooms for rent or hire,” and private clubs and religious organizations. The 15-employee threshold belongs to Title I, which covers employment, so a three-person dental office is still a public accommodation under Title III.
Federal agencies answer to Section 508 instead, set out in the guide to the Section 508 standards for websites. A hospital or clinic that receives HHS financial assistance carries a second, dated rule: the HHS Section 504 regulation requires WCAG 2.1 Level A and AA from May 11, 2027 for recipients with fifteen or more employees and May 10, 2028 for the rest (45 CFR 84.84), dates set by an interim final rule of May 11, 2026.
The Title II rule binds the government, and its vendors take on the duty through their contracts. It reaches web content and apps a government provides “directly or through contractual, licensing, or other arrangements” (28 CFR 35.200(a)), which is why Title II obligations flow down to software vendors. Embedded tools follow the same logic; the guide to third-party content and conformance claims covers what a vendor’s widget does to a site’s claim.
A US business that also sells to consumers in the European Union has a separate law to meet, compared in the EAA, the ADA and WCAG side by side and set out step by step in EAA compliance.
The decision rule is short. Find the row for the organization that offers the service on the site, not the company that built it. Where a site sits in two rows, as a public university’s online store run by a contractor does, build to WCAG 2.1 Level AA, the standard the Title II rule names and the one the Justice Department wrote into its 2021 Rite Aid agreement.
The Ninth Circuit covers a website through its link to a physical place
Title III’s twelve categories describe physical establishments, and the regulation defines a place of public accommodation as “a facility operated by a private entity,” where a facility means “buildings, structures, sites, complexes, equipment” and other real or personal property (28 CFR 36.104). The definition does not mention websites, so courts have had to decide whether a site needs a link to a physical place.
The Ninth Circuit’s decision ties the site to a building. In Robles v. Domino’s Pizza, a blind customer who uses screen-reading software tried on at least two occasions to order a customized pizza through the chain’s website and app and could not. In January 2019 the court held “that the ADA applies to Domino’s website and app, which connect customers to the goods and services of Domino’s physical restaurants,” and explained: “This nexus between Domino’s website and app and physical restaurants … is critical to our analysis.” The Supreme Court declined to hear the appeal on October 7, 2019.
The opinion also restates the circuit’s earlier rule: because the ADA “only covers ‘actual, physical places where goods or services are open to the public, and places where the public gets those goods or services,’” there “had to be ‘some connection between the good or service complained of and an actual physical place.’” A software company, a streaming service or an online-only retailer has no such place.
A footnote leaves a different question open, for businesses that do have a location: “We need not decide whether the ADA covers the websites or apps of a physical place of public accommodation where their inaccessibility does not impede access to the goods and services of a physical location.”
The Justice Department’s guidance does not take up the question, but one of the Title III sample cases it lists does: its agreement with Peapod, an online grocery delivery service, describes www.peapod.com as “a sales and service establishment whose operations affect commerce” and states that “Peapod is a public accommodation subject to Title III of the ADA” (Peapod agreement). An agreement binds only its parties, and courts outside the Ninth Circuit are not bound by the Ninth Circuit’s rule.
For a business with stores, offices or restaurants, the working assumption follows Robles: the website that sells, books or locates is covered. For an online-only business the answer depends on the court where a claim is filed, and a business that sells nationally does not choose that court. The remedy in a private federal case is a fix to the site plus the plaintiff’s attorney’s fees, and the fix is the same work an audit would schedule anyway. Take one question to counsel: what the federal circuits and the states where the business sells have held about websites with no physical location.
State and local governments now have a dated standard, WCAG 2.1 AA
Title II covers “any State or local government” and “any department, agency, special purpose district, or other instrumentality” of one (42 U.S.C. 12131(1)). For these entities the Justice Department published a web and mobile app rule in April 2024, now subpart H of 28 CFR part 35. It names the standard and the dates:
“(1) Beginning April 26, 2027, a public entity, other than a special district government, with a total population of 50,000 or more shall ensure that the web content and mobile apps that the public entity provides or makes available, directly or through contractual, licensing, or other arrangements, comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1, unless the public entity can demonstrate that compliance with this section would result in a fundamental alteration in the nature of a service, program, or activity or in undue financial and administrative burdens.” (28 CFR 35.200(b)(1))
Smaller entities and every special district government follow on April 26, 2028. Both dates come from an interim final rule of April 20, 2026, which states that the compliance date for the larger group “is extended from April 24, 2026, to April 26, 2027.” The background and the open challenge are in the post on the 2026 Title II deadline extension.
View the data as a table
| Public entity | 2024 rule | Current date |
|---|---|---|
| Population of 50,000 or more | April 24, 2026 | April 26, 2027 |
| Population under 50,000, and special district governments | April 26, 2027 | April 26, 2028 |
The rule excludes five kinds of content, and each exclusion has a condition that brings content back in (28 CFR 35.201).
| Exception | Still covered when |
|---|---|
| Archived web content | it does not meet every part of the archive definition in 35.104 |
| PDFs, word processor, presentation and spreadsheet files available before the compliance date | they are “currently used to apply for, gain access to, or participate in” a service |
| Content posted by a third party | the third party posts “due to contractual, licensing, or other arrangements” with the entity |
| Files in those formats, of any date, about a specific person, their property or account, that are password-protected or otherwise secured | they are not about a specific person, or not secured, or not in one of those formats |
| Social media posts made before the compliance date | they are posted on or after the compliance date |
Four provisions qualify the standard without replacing it: the fundamental-alteration and undue-burden defense, which the entity must prove and which still requires compliance “to the extent that it does not result in a fundamental alteration or undue financial and administrative burdens” (28 CFR 35.204); conforming alternate versions, allowed “only where it is not possible to make web content directly accessible due to technical or legal limitations” (35.202); equivalent facilitation (35.203); and a minimal-impact rule.
Under the minimal-impact rule, an entity not in full compliance “will be deemed to have met the requirements of § 35.200 in the limited circumstance in which the public entity can demonstrate that the noncompliance has such a minimal impact on access” that people with disabilities can still get the same information, interactions and transactions and otherwise participate “in a manner that provides substantially equivalent timeliness, privacy, independence, and ease of use” (28 CFR 35.205). The entity carries the proof, and a payment form a screen reader cannot complete fails the transactions test.
The Title II web rule guide covers the definitions in depth, and the guide to which rule a college website must meet applies them to campuses. For the project plan, write down two dates: the entity’s compliance date from its total population, and an earlier delivery date in every contract that supplies web content or an app.
For businesses, WCAG 2.1 AA is the working benchmark even without an ADA rule
For private businesses, the ADA compliance requirements for websites come from the statute and the effective-communication rule in 28 CFR 36.303. No ADA regulation names a technical standard for them, so the yardstick comes from guidance, agreements and court decisions. The Justice Department’s guidance gives businesses room to choose: they “can currently choose how they will ensure that the programs, services, and goods they provide online are accessible.” It then points to the yardsticks: “Existing technical standards provide helpful guidance concerning how to ensure accessibility of website features. These include the Web Content Accessibility Guidelines (WCAG) and the Section 508 Standards” (DOJ web guidance).
The Department’s Title III agreements have named a WCAG version. Its 2021 agreement with Rite Aid, listed in the guidance as a sample case, required the company’s vaccine registration portal “to conform, at a minimum, to the Web Content Accessibility Guidelines 2.1, at Levels A and AA” (Rite Aid agreement, paragraph 13.a). Two of the three other Title III sample cases in the guidance, Peapod and H&R Block, required WCAG 2.0 AA; the third, Teachers Test Prep, used WCAG 2.0 AA to define the captions it required. In February 2026 the Department added a caution in a federal case: “The United States does not endorse WCAG as the appropriate or necessary standard for the provision of auxiliary aids and services under Title III of the ADA” (Statement of Interest, Alcazar v. Fashion Nova, footnote 4).
WCAG 2.1 AA stays the working benchmark for businesses because the Title II rule names it and the Rite Aid agreement used it. No ADA rule requires it of a business; the HHS Section 504 rule requires it of providers that receive HHS financial assistance, from May 2027. WCAG 2.2 is the newer W3C Recommendation, last updated December 12, 2024, and a team starting fresh can test to it, as the guide to WCAG 2.2 Level AA explains. The version each US rule names is set out in which WCAG version is required.
How WCAG is built, with its principles, levels and versions, is set out in the beginner’s guide to WCAG. The guidance also lists the features a business should check. Each maps to a success criterion in WCAG 2.1, which turns the list into a test plan.
| Feature the DOJ guidance names | WCAG 2.1 success criterion | Level |
|---|---|---|
| Color contrast in text | 1.4.3 Contrast (Minimum), 4.5:1 for normal text | AA |
| Text cues when color carries meaning | 1.4.1 Use of Color | A |
| Text alternatives for images | 1.1.1 Non-text Content | A |
| Captions on video | 1.2.2 Captions (Prerecorded) | A |
| Labels and instructions on forms | 3.3.2 Labels or Instructions | A |
| Errors identified, explained and announced | 3.3.1 Error Identification (A), 3.3.3 Error Suggestion (AA), 4.1.3 Status Messages (AA) | A and AA |
| Text size and zoom | 1.4.4 Resize text | AA |
| Headings built into the page | 1.3.1 Info and Relationships | A |
| Keyboard access | 2.1.1 Keyboard | A |
The example shows why the table matters more than a widget. On a law office’s site, captured for this guide, the current menu item is red #c03d2b on a dark gray bar #333333, which measures 2.37:1 against the 4.5:1 minimum in 1.4.3. The page also carries a toolbar with contrast and text-size buttons. Whatever the toolbar offers, the page as it loads measures 2.37:1. That is a WCAG measurement, not a statement about the office’s legal position.
For a contract or a statement of work, a sentence like this sets the bar: “The website and mobile app will conform to WCAG 2.1 Level A and Level AA, tested on the pages and user journeys listed in the scope, with results reported per success criterion.”
Who enforces ADA compliance, and what each enforcer can win
For a business under Title III, who enforces ADA compliance depends on who brings the case. There are three routes to court, and they end in different remedies.
The Justice Department may sue when it has reasonable cause to believe there is “a pattern or practice of discrimination” or a case that “raises an issue of general public importance.” The court may grant equitable relief, including an auxiliary aid or a change of practice; may award “monetary damages to persons aggrieved when requested by the Attorney General”; and may assess a civil penalty (42 U.S.C. 12188(b)). The statute caps the penalty at $50,000 for a first violation and $100,000 for a subsequent one; for violations after November 2, 2015, penalties assessed after July 3, 2025 can reach $118,225 and $236,451 (28 CFR 85.5). The court “shall give consideration to any good faith effort or attempt to comply.”
Short of court, the Attorney General “shall investigate alleged violations of this subchapter, and shall undertake periodic reviews of compliance” (12188(b)(1)(A)(i)); the Rite Aid agreement came out of such a compliance review.
A private person suing under Title III gets the remedies of the Civil Rights Act’s public accommodation title (12188(a)(1)), which means “a civil action for preventive relief, including an application for a permanent or temporary injunction” (42 U.S.C. 2000a-3(a)). Title III itself gives a private plaintiff no damages. The court may award the prevailing party, other than the United States, “a reasonable attorney’s fee, including litigation expenses, and costs” (42 U.S.C. 12205).
State law can add money. California’s Unruh Civil Rights Act provides that a violation of the ADA “shall also constitute a violation of this section” (Civil Code 51(f)), and makes the defendant liable for actual damages “but in no case less than four thousand dollars ($4,000)” for each offense, plus attorney’s fees (Civil Code 52(a)). Other states have moved the other way: the guide to ADA demand letters and four state statutes shows what Kansas, Utah, Missouri and Georgia changed, and what none of them pauses.
View the data as a table
| Outcome | DOJ lawsuit | Private ADA suit | California Unruh claim |
|---|---|---|---|
| Court order to fix | Yes | Yes | Not in section 52(a) |
| Money for the person | Yes, when the Attorney General asks | No | Yes, at least $4,000 per offense |
| Civil penalty | Yes, up to $118,225, then $236,451 | No | Not in section 52(a) |
| Attorney’s fees | No | Yes | Yes |
A state or local government faces a different set of routes. A person may file an administrative complaint “not later than 180 days from the date of the alleged discrimination” (28 CFR 35.170), the designated agency “shall investigate complaints” and, where it finds a violation, issues a letter of findings with “a remedy for each violation found (including compensatory damages where appropriate)” (35.172). The person may also sue “whether or not the designated agency finds a violation,” and that suit carries “the remedies, procedures, and rights set forth in section 794a of title 29” (42 U.S.C. 12133).
The numbers on filings come from private trackers that count differently; the reconciliation is in who gets sued over web accessibility, and the consequences are walked through in what happens if a business ignores WCAG. In the first week after a letter, three steps hold up under any of these routes: send it to counsel, save a dated copy of the pages it names, and scope a WCAG 2.1 AA test of the journeys the letter describes.
An ADA compliant website is a record you can show, not a badge
No regulation defines an “ADA compliant website,” and no government body issues a certificate for one, as the guide to what accessibility certifications exist explains. What an organization can show is evidence that the site meets a named standard on a named scope, and a process that keeps it there.
Automated tools are part of that evidence, not the whole of it. The Justice Department’s guidance says of “automated accessibility checkers and overlays” that “A ‘clean’ report does not necessarily mean everything is accessible,” and pairs them with a manual check. The Federal Trade Commission’s complaint against accessiBe alleged that “in a number of instances accessWidget fails or has failed to make basic and essential website components like menus, headings, tables, images, recordings, and more, compliant with WCAG”; the case ended in a consent order in April 2025, in which the company neither admitted nor denied the allegations. How overlays affect a conformance claim is covered in overlays and ACR claims.
| Part of the record | What it shows | Where to start |
|---|---|---|
| Scope | which pages, user journeys and standard were tested | the digital accessibility audit guide |
| Audit report | each failure, its location and its WCAG criterion, with evidence | accessibility testing tools and their limits |
| Remediation plan | what gets fixed first, by whom and by when | the accessibility remediation plan |
| Retest results | which fixes held | the same scope, tested again |
| Accessibility statement | the standard, known gaps and a way to report problems | the accessibility statement template |
The guidance gives the statement’s contact line a purpose: “Websites that provide a way for the public to report accessibility problems allow website owners to fix accessibility issues.” The record also feeds the good-faith consideration the statute gives a court weighing a civil penalty. How large organizations publish such a record is shown in the examples of ADA compliant websites.
Small businesses can offset part of the cost. The federal disabled access credit equals “50 percent of so much of the eligible access expenditures for the taxable year as exceed $250 but do not exceed $10,250” (26 U.S.C. 44). It is open to a business that had gross receipts of $1,000,000 or less, or 30 or fewer full-time employees, in the preceding year and elects the credit. Whether website work counts as an eligible access expenditure is the question to put to a tax adviser, with the post on the website accessibility tax credit as the starting brief.
Your next step
- Find your row. Name the organization that offers the service on the site and the law that covers it, using the table above.
- Set the standard and the date. A state or local government takes its compliance date from its total population and writes WCAG 2.1 Level AA into every web and app contract. A business scopes a WCAG 2.1 AA test of the journeys that sell, book, inform or take applications.
- Publish the record. Keep the scope, findings, fixes and retest results together, and publish an accessibility statement with a contact that a person answers.
Two questions belong to counsel: whether a business with no physical location is covered where it sells, and what state law, such as California’s Unruh Act, adds to the federal claim. ADA Compliance Pros scopes the pages and flows a claim is most likely to touch, tests them manually with keyboards, screen readers and magnification, maps every finding to a WCAG success criterion with evidence, ranks fixes by user impact and legal exposure, retests your developers’ changes, and documents the result in a record that supports an accessibility statement. To see where your site stands, start with an ADA website compliance review.