A provost’s office and a district curriculum lead have the same inventory problem at different scales. Behind a login sit years of syllabi, scanned readings, slide decks, lecture recordings and publisher files, and somebody has to decide how much of it is in scope before April 26, 2027 or April 26, 2028. A plan drafted from the 2023 proposed rule answers that one way: password-protected class and course content is excepted, on a notice-triggered clock. That plan rests on regulatory text that never took effect.
The Department of Justice proposed two course-content exceptions in the 2023 notice of proposed rulemaking, one for public postsecondary institutions and one for public elementary and secondary schools. It removed both from the 2024 final rule, under its own heading, at 89 FR 31371 (footnote markers are omitted from the block quotes throughout this article):
In the NPRM, the Department proposed exceptions to the requirements of Sec. 35.200 for certain password-protected class or course content of public elementary, secondary, and postsecondary institutions. For the reasons discussed in this section, the Department has decided not to include these exceptions in subpart H of this part.
The preamble repeats the point in one line at 89 FR 31360: “Notably, Sec. 35.201 does not include exceptions for password-protected course content in elementary, secondary, and postsecondary schools, which had been proposed in the NPRM.”
That is the holding. The rest of this article is what it costs to act on it: which files are in scope, the one exception that can still bite inside a course site, and what the rule declines to say about sequencing.
What the removal means, and the date correction it needs
DOJ wrote the consequence out at 89 FR 31371:
Accordingly, under subpart H, password-protected course content will be treated like any other content and public educational institutions will generally need to ensure that that content complies with WCAG 2.1 Level AA starting two or three years after the publication of the final rule …
The standard in that sentence is fixed at one edition. 28 CFR 35.104 defines WCAG 2.1 as the “W3C Recommendation 05 June 2018,” and 35.200(b)(3) incorporates that dated snapshot by reference rather than the 2023 revision (89 FR 31321 n.10).
The doubled word is in the original, and so is a stale interval. That sentence was written against the dates as first adopted. The April 2026 interim final rule amended 28 CFR 35.200(b) at 91 FR 20912, striking “April 24, 2026” for “April 26, 2027” in paragraph (b)(1) and “April 26, 2027” for “April 26, 2028” in paragraph (b)(2). Read “two or three years” as three or four years from April 24, 2024. The operative dates are April 26, 2027 and April 26, 2028, and the extension left the exceptions list alone. We covered that change in the 2026 deadline extension explainer.
The Department’s reason, at 89 FR 31374: it is “more efficient and effective” for institutions to use the compliance window “to prepare to make course content accessible proactively, instead of having to scramble to remediate content reactively.” On the docket, at 89 FR 31372: “The overwhelming majority of comments on this topic expressed opposition to the course content exceptions as proposed in the NPRM.” That is DOJ describing comments it received, not a measurement of what institutions or vendors do.
The learning platform was never inside the proposed exception
Even in the version DOJ proposed and then abandoned, the exception stopped at the content. At 89 FR 31372:
Although the proposed exception applied to password-protected course content, it did not apply to the Learning Management System platforms on which public educational institutions make content available.
The footnote points back to the NPRM at 88 FR 51970, where the Department said the same thing while proposing the exception: “while the LMS platform would need to be accessible, class or course content (such as syllabi and assigned readings) posted on the password-protected LMS platform would not need to be, except in specified circumstances.” That parenthetical is DOJ’s own list of what the dead exception would have covered. Syllabi and assigned readings moved from excepted-as-proposed to in-scope-as-adopted, and the platform never moved at all.
One citation trap follows from the renumbering. DOJ flagged it at 89 FR 31372 footnote 150: “Section 35.201(e) no longer refers to a course content exception, but now refers to a different exception for preexisting social media posts, as discussed in this section.” A policy memo citing 35.201(e) for course content is pointing at the social media exception. One citing 35.201(f) is pointing at nothing: the final section runs (a) through (e).
View the data as a table
| As proposed, 2023 NPRM | As adopted, 2024 final rule |
|---|---|
| Class or course content on a password-protected LMS, such as syllabi and assigned readings, would not need to be accessible | Syllabi and assigned readings moved to in scope, and the platform never moved at all |
| The LMS platform itself would still need to be accessible | 35.201(e) now refers to a different exception for preexisting social media posts |
| Paragraph 35.201(e) carried a course content exception | A memo citing 35.201(f) points at nothing: the final section runs (a) through (e) |
The surviving exception has three gates, not two
What remains is 28 CFR 35.201(d):
(d) Individualized, password-protected or otherwise secured conventional electronic documents. Conventional electronic documents that are: (1) About a specific individual, their property, or their account; and (2) Password-protected or otherwise secured.
Two numbered prongs, so it reads as a two-part test. In operation it is a three-part test, because the lead-in carries a gate of its own: the subject is a conventional electronic document, and that is a defined term at 28 CFR 35.104:
Conventional electronic documents means web content or content in mobile apps that is in the following electronic file formats: portable document formats (“PDF”), word processor file formats, presentation file formats, and spreadsheet file formats.
Four formats, and the list is closed. DOJ said so at 89 FR 31363: “This list of conventional electronic documents is an exhaustive list of file formats, rather than an open-ended list.” The Department worked the point through an example at 89 FR 31379: individualized medical records published “as HTML content (rather than a PDF)” fall outside the exception, while the same records as PDFs fall inside it. The same passage disposes of the platform a second time, since “the exception would not apply to the platform on which the public entity makes those documents available.”
Gate two is individualization, and DOJ’s examples are worth reading for what is missing from them. The four given at 89 FR 31379 are medical records or notes about a specific patient, a purchase receipt such as “a parent’s receipt for signing a child up for a recreational sports league,” a utility bill concerning a specific residence, and Department of Motor Vehicles records for a specific person or vehicle. The rule the Department draws from them, on the same page: “Content that is broadly applicable or otherwise for the general public (i.e., not individualized) is not subject to this exception.”
Gate three is the login. DOJ’s gloss at 89 FR 31379 is conditional: content “may be otherwise secured if it requires a member of the public to use some process of authentication or login to access the content.” DOJ’s fact sheet on the web rule states the same test as three points and supplies the combining rule: “The exception does not apply unless all three points are present.” The fact sheet is guidance, and DOJ’s own footer says guidance documents “have no legally binding effect, and have no force or effect of law.” The regulation and the preamble carry the weight; the fact sheet corroborates.
Does a syllabus qualify for the individualized-document exception?
Run it through the gates in order. A syllabus posted as a PDF clears gate one, because PDF is on the closed list. It fails gate two, because it is content for everyone enrolled rather than a document about a specific individual, their property or their account. Once gate two fails the login is irrelevant. The syllabus is in scope.
A scanned assigned reading fails at the same gate and picks up a second problem. A scan is still a PDF, but it is not about a specific person, and an image-only scan engages WCAG 2.1 Success Criterion 1.1.1 in the 5 June 2018 Recommendation, which requires that “All non-text content that is presented to the user has a text alternative that serves the equivalent purpose.” That is text recovery and structure, not a metadata fix.
A course page authored as HTML inside the LMS fails earlier still, at gate one, and no amount of individualization saves it. DOJ’s First Steps guidance reaches the same result in one sentence, in an example about a public school using a password-protected LMS: “There is no exception for educational course content.”
View the data as a table
| Syllabus posted as a PDF | Scanned assigned reading | Course page written in HTML | |
|---|---|---|---|
| Gate 1: a conventional electronic document | Clears it. PDF is on the closed list | Clears it. A scan is still a PDF | Fails here. The four listed formats are PDF, word processor, presentation and spreadsheet |
| Gate 2: about a specific individual | Fails. Content for everyone enrolled | Fails. Not about a specific person | Never reached, and no amount of individualization saves it |
| Gate 3: password-protected or secured | Not reached. The login is irrelevant once gate two fails | Not reached, for the same reason | Not reached |
| Result under subpart H | In scope | In scope, and an image-only scan also engages SC 1.1.1 | In scope |
The other exceptions do not rescue course content either
Three more exceptions sit in 35.201, and each has a limit that stops it short of assigned material.
Preexisting conventional electronic documents, 35.201(b), exempts documents available before the compliance date “unless such documents are currently used to apply for, gain access to, or participate in the public entity’s services, programs, or activities.” DOJ read that proviso forward at 89 FR 31365, to cover “documents that are used at any given point in the future,” and instructions supporting such a document travel with it (89 FR 31365). Editing forfeits the status: a document revised after the compliance date “would no longer be ‘preexisting’ for the purposes of the exception” (89 FR 31364). A 2019 PDF still assigned this term is currently used to participate in the entity’s program, and the First Steps guidance applies that reasoning to a teacher’s posted reading. The same test cuts the other way for material nobody assigns. A 2019 PDF left in a decommissioned course shell is preexisting and outside 35.200 until someone edits it or puts it back on a reading list, which is the one place in a course inventory where this exception does real work.
Archived web content, 35.201(a), turns on a four-part definition, one part of which is that the content is retained exclusively for reference, research or recordkeeping. DOJ’s worked example at 89 FR 31363 concerns library material pulled into a current online exhibition, which fails because the entity is “using the materials to create and provide a new educational program.” Renaming last term’s shell as an archive does not do the work while the material is still assigned.
Content posted by a third party, 35.201(c), has real play inside a course site, and DOJ marked its edges at 89 FR 31377: posts by third parties on course websites “may be covered,” but the exception “only applies where the third party is not posting due to contractual, licensing, or other arrangements with the public entity,” and if the third party acts on the entity’s behalf it does not apply. The Department called the inquiry fact-specific. It also confirmed at 89 FR 31367 that the exception “does not apply to the tools or platforms the public uses to post third-party content.”
View the data as a table
| Preexisting documents, 35.201(b) | Archived web content, 35.201(a) | Third-party content, 35.201(c) | |
|---|---|---|---|
| What it can cover | Documents available before the compliance date | Content retained exclusively for reference, research or recordkeeping | Posts by third parties on course websites, which may be covered |
| The limit that stops it short | Lost where documents are currently used to participate in the entity’s programs | Fails where the entity is using the materials to create a new educational program | Only where the third party is not posting under contractual or licensing arrangements |
| What that means for assigned material | A 2019 PDF still assigned this term must conform; one in a decommissioned shell need not | Renaming last term’s shell as an archive does not do the work | It does not reach the tools or platforms used to post the content |
Class video runs on the same clock as everything else
Commenters asked for a separate captioning timeline. DOJ declined at 89 FR 31360, saying subpart H “requires conformance to WCAG 2.1 Level AA as a whole on the same compliance time frame.”
For a media inventory that means three success criteria land on one date: captions for prerecorded audio at SC 1.2.2, captions for live audio at SC 1.2.4, and audio description for prerecorded video at SC 1.2.5. Lecture capture and live-streamed sessions are not on a later schedule than the syllabus PDF. If you are scoping that piece, our guide to audio transcripts is the starting point.
The vendor is not the regulated party
The scope clause is why a licensed platform and a publisher’s file land on the institution’s side of the ledger. 28 CFR 35.200(a) reaches web content and mobile apps a public entity “provides or makes available, directly or through contractual, licensing, or other arrangements.” DOJ applied that to education at 89 FR 31345: when institutions “arrange for third parties to post educational content on their behalf, public entities will still be responsible for the accessibility of that content under the ADA.”
Digital textbooks got no separate treatment. At 89 FR 31377 the Department chose “to treat digital textbooks, including EPUBs, the same as all other educational course materials.” And the duty does not transfer with the contract: at 89 FR 31376, subpart H “does not apply to private third parties, and the ultimate responsibility for complying with subpart H rests with public entities.” A supplier’s conformance report is evidence for procurement. It is not a defense.
One question the rule expressly declines to answer is what to do when a license forbids modifying a publisher file. At 89 FR 31377 DOJ wrote that subpart H “is not intended to interpret or clarify issues related to intellectual property law” and declined to opine. The only pointer it offers is 28 CFR 35.202, conforming alternate versions, available where direct accessibility is not possible due to technical or legal limitations. For EPUBs the Department named a second route on the same page, 28 CFR 35.203, equivalent facilitation: an entity “could still choose to apply additional standards specifically related to EPUBs to the extent that the additional standards provide substantially equivalent or greater accessibility and usability as compared to WCAG 2.1 Level AA.”
The dates, and the sequencing the rule declines to prescribe
Under Title II the dates turn on population, not on institution type. Under 35.200(b)(1) a public entity other than a special district government with a total population of 50,000 or more complies beginning April 26, 2027; under (b)(2) an entity below 50,000, and any special district government, complies beginning April 26, 2028. For a school district that is an instrumentality of a city or county, the figure is that jurisdiction’s decennial Census population; for an independent school district it is the Census Bureau’s Small Area Income and Poverty Estimates number (28 CFR 35.104, “total population,” with DOJ’s worked example at 89 FR 31352).
Title II is not the only clock over these files. An institution that also receives Federal financial assistance from the Department of Health and Human Services is a recipient under that Department’s Section 504 rule, and 45 CFR 84.84(b) opens “Beginning May 11, 2027, a recipient with fifteen or more employees” at (b)(1) and “Beginning May 10, 2028, a recipient with fewer than fifteen employees” at (b)(2). That is a different date sorted by a different test, and 45 CFR 84.85 carries the same five exceptions as 35.201 with no course-content exception either. If you are on both tracks, record both dates: all four are set out in the 2026 deadline extension explainer.
What neither rule contains is a schedule for getting there. DOJ set no phase-in, no prioritization order and no per-term percentage, and rejected a commenter’s proposal to require 20 percent of course materials per semester at 89 FR 31375. Its position at 89 FR 31375: subpart H “provides educational institutions with the flexibility to determine how best to bring their content into compliance.” Any term-by-term milestone plan is yours, chosen for operational reasons. No source cited here makes one a legal requirement.
View the data as a table
| Time | Milestone | Detail |
|---|---|---|
| April 26, 2027 | Title II, 50,000 or more | Not a special district government |
| May 11, 2027 | Section 504, 15 or more | HHS recipients, 45 CFR 84.84(b)(1) |
| April 26, 2028 | Title II, under 50,000 | Or any special district government |
| May 10, 2028 | Section 504, under 15 | HHS recipients, 45 CFR 84.84(b)(2) |
What is not settled
No decision has applied subpart H to course content. A CourtListener opinion search on August 21, 2026 returned one opinion in the whole database matching the phrase “WCAG 2.1,” from 2017, and nothing matching subpart H with 28 CFR 35.200 in the web-accessibility sense. That database is not a complete record of federal district court opinions, so the honest statement is narrower: no published decision applying subpart H to course content turned up by that method.
Graded work and transcripts are the live edge. One student’s graded paper returned as a PDF in the portal is the one place in a course where all three gates can plausibly close: a listed format, about a specific individual, behind a login. Every individualized-document example DOJ gave is non-educational. The closest the record comes is the Department’s own summary of the comments on this exception, which describes the documents at stake as containing “sensitive, private, and urgently needed information, such as medical test results, educational transcripts, or tax documents” (89 FR 31379), after which DOJ wrote that it “has decided to retain this exception in subpart H of this part.” That is a recital of comments followed by a decision to keep the exception. It is not a holding that a transcript sits inside it.
Closing the three gates also does not close the file. On the same page DOJ said that content which “notifies users about the existence of such documents must still conform to WCAG 2.1 Level AA,” and worked the point through Success Criterion 2.4.4 and a records portal listing individualized PDFs (89 FR 31379). The link text on a grade portal is regulated whether or not the document behind it is.
Where a student sits under the third-party exception is undecided. DOJ said such posts “may be covered” and that the inquiry is fact-specific. No example resolves a student’s post in a graded discussion board.
The extension is still an interim rule. It took effect on publication, April 20, 2026, with comments due June 22, 2026, and as of the eCFR issue date of August 20, 2026 section 35.200 shows no amendment after 91 FR 20912 and section 35.201 none at all. At 91 FR 20911 the Department “seeks feedback on whether the agency should publish additional rulemaking to consider additional regulatory alternatives that could make the 2024 final rule less costly for small governments.” Whether DOJ finalizes, modifies or extends again is open, and nothing in that sentence says the course-content exceptions are coming back.
Two provisions deserve naming so nobody mistakes them for an escape hatch. 28 CFR 35.204 requires an undue-burdens determination by the head of the entity or a designee, after considering all resources available and “accompanied by a written statement of the reasons for reaching that conclusion,” and still requires compliance to the maximum extent possible. 28 CFR 35.205 excuses only noncompliance with “such a minimal impact on access” that participation stays “substantially equivalent” in timeliness, privacy, independence and ease of use. DOJ said that provision “is intended to apply in rare circumstances” and that it “does not expect or intend that Sec. 35.205 will excuse most nonconformance to the technical standard” (89 FR 31387).
Where this stops
What a course must contain, and how an individual student’s accommodation is decided under an IEP, a Section 504 plan or a disability services process, belongs to the institution’s disability services office and its counsel. So does any decision to invoke 35.204. On this side of the line sit the inventory, the format triage, the contract clause and the test evidence.
What to do before the term ends
- Count the platform first. The LMS, the portal, the media server and the proctoring tool are in scope under 35.200(a) whether or not a single document is ever remediated. The LMS platform specifically was in scope even under the exception DOJ proposed (88 FR 51970, recapped at 89 FR 31372). Get those conformance reports now.
- Sort the document inventory by format, not by department. The four listed formats are the only ones 35.201(d) can ever reach, and they still fail on individualization for anything assigned to a class. HTML pages inside the LMS have no exception available at all. That is why a format-first remediation triage is built on the format split rather than on a course-by-course sweep.
- Give media no later date than anything else. Captions at SC 1.2.2, live captions at SC 1.2.4 and audio description at SC 1.2.5 fall due with every other success criterion (89 FR 31360). Sequence the backlog on that fact rather than on an assumption that video comes last.
- Fix the citations in your own policy documents. Anything pointing at 35.201(e) or 35.201(f) for course content is pointing at the wrong paragraph, and any large-entity deadline written as April 24, 2026 is superseded.
If you are scoping that inventory against the 2027 or 2028 date, our education accessibility work starts with the platform-and-format split above rather than a page count. For the wider Title II picture beyond course materials, see our guide to the Title II web rule; for the Section 508 view of the same LMS, a different rule on a different standard, see PDFs to LMS under Section 508.