School and college website accessibility: which rule applies

Three campuses, one platform, three answers

A public state university, a private liberal arts college and the K-12 district across town can license the same learning management system, run the same course pages on it, and still get three different answers to the question general counsel asks: what standard are we held to, and by when.

The public university has a regulation that names a standard and prints a date. The district has the same regulation and possibly a different date. The private college’s governing regulation names no standard and prints no date, and that is not an oversight anyone is about to correct. Its rule traces to 1977, and the agency that owns it has no rulemaking on the books.

The gap is a missing yardstick sitting on top of a duty that has not gone anywhere. What follows maps a campus by the money it takes rather than by its org chart, then answers the part that stalls the compliance memo: if no regulation names a standard, what do you adopt, and what makes that choice defensible afterwards.

One boundary first. Which tier your institution falls into, whether a given grant counts as federal financial assistance, and any decision to claim undue burden are counsel calls. The conformance target, the test evidence, the vendor flow-down clause and the written record are ours.

The public institution: WCAG 2.1 Level AA, on one of two dates

A public university and a public school district are public entities under Title II of the ADA, and Title II now carries a technical standard in the regulation itself. 28 CFR 35.200(b)(1) provides that “Beginning April 26, 2027, a public entity, other than a special district government, with a total population of 50,000 or more shall ensure that the web content and mobile apps that the public entity provides or makes available, directly or through contractual, licensing, or other arrangements, comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1.” Paragraph (b)(2) gives entities under 50,000, and every special district government, until April 26, 2028. Level A and Level AA is 50 success criteria in the WCAG 2.1 Recommendation, 30 at Level A and 20 at Level AA, not the 20 Level AA criteria on their own, and the version and level questions have their own answers by rule.

The date turns on a population number that has nothing to do with enrollment. “Total population” at 28 CFR 35.104 sends a public entity that has no decennial Census estimate of its own, and that is neither a special district government nor an independent school district, to the combined Census population of the state or local governments it is an instrumentality of. An independent school district goes instead to the Census Bureau’s Small Area Income and Poverty Estimates, and a special district government is on the 2028 date whatever its size. DOJ worked it through in its own guidance appendix: “a public State university located in a town of 20,000 within a State with a population of 5 million would be considered a large public entity for the purposes of this part because it is an instrumentality of the State. However, a county community college in the same State where the county has a population of 35,000 would be considered a small public entity for the purposes of this part, because the community college is an instrumentality of the county.” The sentence immediately after that example states the principle: “population size for educational entities is determined not by the size of those entities’ student bodies, but rather by reference to the Census-calculated total population of the jurisdiction of which the educational entity is an instrumentality.”

So the university in the small town is on the 2027 clock, the community college in the small county is on the 2028 clock, and the campus with more students can be the one with less time. Which side a particular community college lands on turns on state law and on Census classification. DOJ gives one example each way and stops. The K-12 district runs on the same pair of dates, with its number coming from SAIPE rather than from the decennial count.

View the data as a table

	Public State university	County community college	Independent school district
Whose population counts	The State’s, because the university is an instrumentality of the State.	The county’s, because the community college is an instrumentality of the county.	The Census Bureau’s Small Area Income and Poverty Estimates.
DOJ’s worked example	A town of 20,000 inside a State of 5 million: a large public entity.	A county of 35,000: a small public entity.	None. DOJ gives one example each way and stops.
Compliance date	April 26, 2027	April 26, 2028	The same pair of dates, with the number coming from SAIPE.
Standard owed on that date	Level A and Level AA in WCAG 2.1, 50 success criteria.	Level A and Level AA in WCAG 2.1, 50 success criteria.	Level A and Level AA in WCAG 2.1, 50 success criteria.

The private college: its own regulation does not contain the word “web”

The Section 504 rule for a private college that takes federal money from the Department of Education is 34 CFR part 104. Section 104.2 sets the reach: “This part applies to each recipient of Federal financial assistance from the Department of Education and to the program or activity that receives such assistance.” The joint Department of Education and Department of Justice Dear Colleague Letter of May 19, 2023 puts the institutions on the recipient side of that line: “Most public and private colleges, universities, and other postsecondary institutions are recipients of financial assistance from the Department of Education, and all of their operations, including all their online programs and activities, are covered by Section 504,” footnoted to 29 U.S.C. § 794(b) and 34 C.F.R. § 104.3(k). A college that takes no assistance from the Department sits outside part 104 by the terms of § 104.2. Under § 104.3(k)(2)(i), “program or activity” for a college, university or other postsecondary institution means all of the operations of the institution, not the aid-funded corner of it.

The coverage is total. The standard is absent. Pull the whole of part 104 from the eCFR versioner API at title 34’s current issue date of July 24, 2026, strip the markup and count: the 170,841-byte retrieval contains zero occurrences of “web,” zero of “WCAG,” zero of “kiosk,” zero of “electronic” and zero of “information technology.” Five terms, five zeros, appendix included.

The vocabulary the rule does use tells you when it was written. The auxiliary aids provision at 34 CFR 104.44(d)(2) still reads: “Auxiliary aids may include taped texts, interpreters or other effective methods of making orally delivered materials available to students with hearing impairments, readers in libraries for students with visual impairments, classroom equipment adapted for use by students with manual impairments, and other similar services and actions.” Taped texts and readers in libraries is still the illustration ED’s rule offers a course platform in 2026.

What part 104 carries instead of a yardstick is a duty. Under § 104.4(b)(1) a recipient may not, directly or through contractual, licensing or other arrangements, “Afford a qualified handicapped person an opportunity to participate in or benefit from the aid, benefit, or service that is not equal to that afforded others,” or “Provide a qualified handicapped person with an aid, benefit, or service that is not as effective as that provided to others.” An inaccessible registration form with no equally available alternative is what § 104.4(b)(1) is aimed at, whether or not WCAG appears anywhere in the CFR.

One correction before it reaches someone’s memo: the effective communication duty at a college does not come from part 104, where the phrase appears only in the provision about hospitals and emergency treatment. In the same joint letter, the sentence requiring institutions “to ensure that communications with individuals with disabilities are as effective as communications with others” is footnoted to 42 U.S.C. § 12132, 28 C.F.R. § 35.160, 42 U.S.C. § 12182(b)(2)(A)(iii) and 28 C.F.R. § 36.303. It runs through the ADA regulations, not through ED’s Section 504 rule.

Nothing published since rescinds that letter, and nothing reaffirms it. It remains posted and linked from ED’s current technology accessibility guidance page, which names no technical standard and contains no occurrence of “WCAG.”

Title III does not fill the gap either

A private college is also a place of public accommodation. 28 CFR 36.104 lists “A nursery, elementary, secondary, undergraduate, or postgraduate private school, or other place of education.” Title III applies, and its general nondiscrimination and effective communication duties apply with it.

Title III has no web standard. In the regulatory text of the whole of 28 CFR part 36 the word “web” appears once, in the movie theater notice provision at § 36.303(g)(8). “WCAG” appears nowhere in the regulatory text. Its single appearance anywhere in the part sits in the 2010 guidance appendix, which says the Department “is unable to issue specific regulatory language on Web site accessibility at this time” but “expects to engage in rulemaking relating to Web site accessibility under the ADA in the near future.”

DOJ withdrew that rulemaking. On December 26, 2017 it published a notice withdrawing four announced rulemakings “for further review,” the first being web accessibility for public accommodations, and recorded that “The Department has not published any rulemaking document regarding title III Web accessibility since the 2010 ANPRM.” The same notice added that the Department “is evaluating whether promulgating regulations about the accessibility of Web information and services is necessary and appropriate.” Eight years on, no title III web rulemaking document has been published.

What DOJ says instead is that the choice is yours. Its 2022 web accessibility guidance states that the Department “does not have a regulation setting out detailed standards, but the Department’s longstanding interpretation of the general nondiscrimination and effective communication provisions applies to web accessibility,” and then that covered entities “can currently choose how they will ensure that the programs, services, and goods they provide online are accessible to people with disabilities.” A banner now says the page does not reflect the requirements published for state and local governments in April 2024, which leaves it speaking, on its face, to businesses.

The route that does give a private college a standard: HHS money

This is the reason to map a campus by funding stream rather than by org chart.

45 CFR 84.84(b)(1) provides that “Beginning May 11, 2027, a recipient with fifteen or more employees shall ensure that the web content and mobile apps that the recipient provides or makes available, directly or through contractual, licensing, or other arrangements, comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1.” Recipients with fewer than fifteen employees have until May 10, 2028. Nothing in part 84 says whether the employee count runs per recipient, per campus or per program, so a multi-campus system has a question the text does not answer.

Who counts as a recipient is where this reaches past the teaching hospital. 45 CFR 84.10 defines “program or activity” as all of the operations of, among others, “A college, university, or other postsecondary institution, a public system of higher education,” and defines “Federal financial assistance” to include “any grant, cooperative agreement, loan, contract (other than a direct Federal procurement contract or a contract of insurance or guaranty), subgrant, contract under a grant or any other arrangement.”

On §§ 84.10 and 84.84 read together, a private college holding one NIH or HRSA grant is an HHS recipient, and part 84 reaches all of its operations rather than the grant-funded part. Read that way, the private college with no standard under ED’s rule acquires WCAG 2.1 Level AA through a research award, on a date set by an agency nobody in the marketing office has thought about. The limit on that reading should be stated plainly. HHS has published no guidance applying subpart I to a college whose only HHS money is a research award, and no decision has construed § 84.84, so this is a reading of the regulatory text rather than a settled application of it.

HHS confirms that the two Section 504 rules carry the same postsecondary text. In the preamble to its 2024 final rule the Department wrote that its postsecondary subpart “is identical to the postsecondary education provisions in the existing section 504 regulations and in the ED regulations at 34 CFR 104.41 through 104.47.” The auxiliary aids sentence at 45 CFR 84.44(d)(2) is word for word ED’s, taped texts and all. One department bolted a web standard on top of that shared text. The other did not.

View the data as a table

	Public university or K-12 district	Private college, ED money only	Private college, public accommodation	Any college holding HHS money
Governing regulation	28 CFR 35.200 (Title II)	34 CFR part 104 (ED)	28 CFR part 36 (Title III)	45 CFR 84.84 (HHS)
Technical standard stated	WCAG 2.1, Level A and AA	None stated in the rule	None stated in the rule	WCAG 2.1, Level A and AA
Date printed in the rule	April 26, 2027, or 2028 under 50,000	None	None	May 11, 2027, or May 10, 2028 under 15 staff
What brings the campus in	Being a public entity under Title II.	Any federal aid from ED.	Being a private school or place of study.	One NIH or HRSA grant.
Duty when no standard is named	None: the rule names a standard.	A service as effective as others get.	General ADA duties, no web standard.	None: the rule names a standard.

Two consequences are easy to miss. A public university holding NIH money is covered by both 28 CFR 35.200 and 45 CFR 84.84, which is two regulators and two dates, April 26, 2027 and May 11, 2027, aimed at one WCAG 2.1 Level AA target. And ADA complaints about one campus split by subject matter: under 28 CFR 35.190(b) the Department of Education takes institutions of higher education “other than schools of medicine, dentistry, nursing, and other health-related schools,” and HHS takes those.

What both web rules leave out

Neither rule reaches everything on a campus server. 28 CFR 35.201 and 45 CFR 84.85 carry the same five exceptions in the same order: archived web content, preexisting conventional electronic documents, content posted by a third party, individualized password-protected or otherwise secured conventional electronic documents, and preexisting social media posts.

Two clauses inside that list decide the campus cases. The preexisting-document exception switches off for documents “currently used to apply for, gain access to, or participate in” the entity’s programs or activities, which is the application packet, the aid form and the syllabus a student needs this term. And third-party content is excepted “unless the third party is posting due to contractual, licensing, or other arrangements” with the entity, so the licensed learning platform, the hosted video player and the payment page sit outside the exception rather than inside it.

The password-protected exception is also narrower than an LMS login makes it look. It reaches only a “conventional electronic document,” defined at 28 CFR 35.104 as web content “in the following electronic file formats: portable document formats […], word processor file formats, presentation file formats, and spreadsheet file formats,” and only where that document is “About a specific individual, their property, or their account.” A course page behind a login is neither. Course content was considered for an exception and did not get one. HHS wrote in its 2026 interim final rule that its 2023 proposal “included proposed exceptions for certain course content used by postsecondary institutions and elementary and secondary schools; however, the Department reconsidered those exceptions in light of significant negative public comments responding to the NPRM and did not include them in the 2024 final rule.”

View the data as a list

Five exceptions, both web rules: Same five, same order, in 35.201 and 84.85.

• Archived content
• Preexisting docs: Off if used to apply or take part.
• Third-party posts: Not if posted under contract.
• Secured documents: Only about one individual.
• Old social posts

What the Department of Education has done since, which is nothing

ED did plan a Section 504 rewrite. RIN 1870-AA18 sat at the proposed rule stage against 34 CFR part 104 with a notice of proposed rulemaking slated for December 2024, the statement of need observing that “The current regulations have been largely unchanged since they were first published in 1977.” No proposal was published, and the entry is absent from the Spring 2025 edition of the Unified Agenda and from the current one.

Two details sharpen the absence. The abstract and statement of need for that rulemaking contain no occurrence of “web” and none of “WCAG,” so even the rewrite ED planned and dropped was not going to add a web standard. And ED’s current agenda lists 19 active rulemakings and 5 completed actions, none of the 24 concerning disability, Section 504 or accessibility. Nothing in the record explains the withdrawal, and this article will not guess at one.

Both federal dates are provisional, and so is the requirement behind them

If your calendar still says April 2026 or May 2026 it predates two rules. DOJ moved the Title II dates by an interim final rule published April 20, 2026, and HHS moved the Section 504 dates by an interim final rule published May 11, 2026. The word doing the work is interim. DOJ’s comment period closed June 22, 2026 and HHS’s closed July 6, 2026, and as of research for this article on August 21, 2026 neither department had published a final rule confirming the extension. Both interim rules are in effect in the meantime, DOJ’s since April 20, 2026 and HHS’s since May 7, 2026, so the extended dates are the operative ones unless a later rule moves them again.

View the data as a table

Time	Milestone	Detail
April 20, 2026	DOJ interim final rule	Title II dates moved; in effect.
May 11, 2026	HHS interim final rule	504 dates moved; in effect May 7.
June 22, 2026	DOJ comment period closed	Title II comments are in.
July 6, 2026	HHS comment period closed	Section 504 comments are in.
August 21, 2026	Still no final rule	Both interim rules remain in effect.

Both say more is coming. DOJ’s Unified Agenda entry says the Department is weighing a later proposal “to reconsider whether some of the regulatory provisions imposed by the April 24, 2024 rule could be made less burdensome,” with that proposal’s timetable listed as to be determined, and HHS says the same of its 2024 rule. Both entries are marked deregulatory. Neither entry names WCAG 2.1, neither names Level AA, and neither says which provisions it has in mind. What the record carries is an undated possibility of a future proposal, not a change to the standard.

What a moved date does not move is the size of the job. DOJ’s regulatory analysis for the 2024 Title II rule put the ten-year present value cost of compliance for one small community college at $4,721,508 at a 3 percent discount rate, and the largest line in that total is not software: $3,617,001 is postsecondary course remediation, against $1,020,862 for website testing and remediation. That is staff time measured against a course catalog, and it does not shrink because a date moved. Small independent community colleges were the only small entity type in DOJ’s analysis whose costs exceeded 1 percent of revenue, at 1.05 percent. The deadline extensions are a scheduling fact, not a reprieve.

No court has construed either web rule

A search of the CourtListener opinion corpus on August 21, 2026 returned zero opinions citing 28 C.F.R. § 35.200 and zero citing 45 C.F.R. § 84.84. The same zero came back for the alternate citation formats “28 CFR 35.200” and “28 C.F.R. 35.200,” and a control query for “WCAG” in that corpus returned 18 results, so the corpus is populated and the query reaches it.

State that carefully. CourtListener’s free corpus is not a record of unpublished district court orders, and consent decrees are not opinions. The honest sentence is that no published decision applying either section turned up in the research for this article, and every reported web accessibility decision that did turn up predates these rules and rests on the general ADA provisions.

If no rule names a standard, what does a college adopt

This is where the private college is stuck, and there is a defensible answer with agency evidence behind it.

DOJ has said the choice belongs to the covered entity. Institutions under scrutiny have made that choice on the record. The 2017 resolution agreement between the Office for Civil Rights and Santa Clara University, signed after an investigation into an allegation that the university’s website contained barriers to access, sets its own yardstick under a heading reading Benchmarks for Measuring Accessibility: “the accessibility of online content and functionality will be measured according to the World Wide Web Consortium’s (W3C’s) Web Content Accessibility Guidelines (WCAG) 2.0 Level AA and the Web Accessibility Initiative Accessible Rich Internet Applications Suite (WAI-ARIA) 1.0 techniques for web content, which are incorporated by reference.”

The next sentence says how far that gets you. Adherence to those standards “is one way to ensure compliance with the Recipient’s underlying legal obligations to ensure people with disabilities are able to acquire the same information, engage in the same interactions, and enjoy the same benefits and services within the same timeframe as their nondisabled peers.” One way. Not a safe harbor, not a certification, and not a defense standing alone.

Three commitments in the same agreement are worth copying whatever standard you pick, because they turn a target into a record. The undue burden assertion may be made only by the University President or a designee with budgetary authority, in a written and certified statement. Annual training runs to content developers, webmasters and procurement officials by name. And the plan for new content expressly covers material “developed by, maintained by, or offered through a third-party vendor or through the use of open sources,” which is where the learning platform, the payment page and the video host live.

Two further sources shape the choice. On version, both rules that name one point at WCAG 2.1 and specifically at the W3C Recommendation of 05 June 2018, incorporated by reference with a perma.cc mirror in each. Adopting that dated edition voluntarily puts a private college on the target the two rules that name one actually cite, and on the target it inherits the day it accepts HHS money. It is not the newest edition. WCAG 2.2 has been a W3C Recommendation since 12 December 2024, and no US regulation incorporates it. It is additive: the 2.2 document states that “sites which conform to WCAG 2.2 also conform to WCAG 2.1,” and that the working group “recommends that sites adopt WCAG 2.2 as their new conformance target, even if formal obligations mention previous versions.” So 2.2 clears the regulatory target and adds to it: six more success criteria at Level A and AA, and 2.1’s 4.1.1 Parsing marked obsolete and removed.

View the data as a table

	WCAG 2.1, 05 June 2018	WCAG 2.2, 12 December 2024
Named by a US regulation	Yes. Both rules that name a version cite this dated edition.	No. No US regulation incorporates it.
What the W3C says to do	Nothing further; it is the earlier edition.	The working group recommends adopting it as the new conformance target.
Success criteria at A and AA	Still carries 4.1.1 Parsing.	Six more criteria, and 4.1.1 Parsing marked obsolete and removed.
Effect on the regulatory target	It is the target inherited the day the college accepts HHS money.	Sites conforming to 2.2 also conform to 2.1, so the target is cleared.

On workarounds, DOJ’s 2010 guidance allows an accessible alternative such as a staffed telephone line and then bounds it: “such an alternative must provide an equal degree of access in terms of hours of operation and range of options and programs available.” Hours and range, measured against the website.

Institutions already inside one of the two web rules have relief doors that a voluntary policy does not hand you. Section 84.87 preserves equivalent facilitation for alternatives that “result in substantially equivalent or greater accessibility and usability of the web content or mobile app.” Section 84.89 deems compliance where noncompliance “has such a minimal impact on access that it would not affect the ability of individuals with disabilities” to use the content. And § 84.88 puts the undue burden call in one place: it “must be made by the head of a recipient or their designee,” in writing, “after considering all resources available for use in the funding and operation of the program or activity.” The Title II rule carries the same three: equivalent facilitation at § 35.203, the fundamental alteration and undue burden finding at § 35.204, and minimal impact on access at § 35.205. A public university has both sets. What no set of relief provisions does is attach to a purely voluntary policy.

Where this stops

Which tier your community college falls into, whether a specific award is HHS federal financial assistance, whether one such award carries part 84 across an entire institution’s web presence, how the fifteen-employee line applies to a multi-campus system, and any decision to assert undue burden are questions for counsel.

The narrower half is ours: naming the conformance target and its dated edition, testing against it, writing it into the vendor contract so the platform you license carries it too, and keeping evidence somebody can read two years from now. That is what our education sector accessibility work and the underlying ADA website compliance service are built around.

Next step

Take one page, the online application, and answer three questions about it in writing. Which entity operates it. Which federal money that entity takes. Which of the four regulations above therefore reaches it. If the answer is 28 CFR 35.200 or 45 CFR 84.84, you have a standard, a level and a date, and the work is scoping. If the answer is 34 CFR part 104 or 28 CFR part 36, you have a duty with no yardstick, and the next decision is which standard you adopt, who signs it and what the contract says.

Send us that page, the entity that operates it and the funding streams that touch it, and the first thing back is that map with the empty cells marked.