ADA Website Compliance in 2026: What Actually Protects You From a Lawsuit

Nobody certifies a website as ADA compliant. There is no federal registry, no inspection, no agency that issues a pass, and any badge sold to you as proof is a graphic file. What is real is a statute from 1990 that covers most businesses open to the public, several thousand federal lawsuits a year aimed at websites, and a set of technical criteria that almost every site on the internet currently fails.

The useful question is not whether you are compliant, because that word has no official meaning here. It is which specific things on your site a plaintiff can point at, and which of them are cheap to prevent. Nearly all of them are build decisions, made in the first week of a project, by people who are not lawyers.

The 30-second answer

If your business serves the public, the ADA almost certainly reaches what you offer online, and there is still no federal regulation telling private businesses which technical standard to hit. The Justice Department says you have flexibility in how you comply, but you must comply. In practice the benchmark is WCAG 2.1 Level AA, because that is the standard the government itself adopted when it wrote a binding web rule for state and local agencies. Automated accessibility widgets do not deliver that standard: the FTC required one overlay vendor to pay $1 million in 2025 over claims that its AI could. Federal web accessibility lawsuits reached 3,117 in 2025, up 27 percent in a year.

Is your business actually covered

If you appear anywhere in the statute's list of public accommodations, yes. That list, at 42 U.S.C. 12181(7), is unusually concrete for a federal law. It names "a restaurant, bar, or other establishment serving food or drink", "a bakery, grocery store, clothing store, hardware store, shopping center, or other sales or rental establishment", "the office of an accountant or lawyer", the "professional office of a health care provider, hospital", and "a gymnasium, health spa, bowling alley, golf course, or other place of exercise or recreation".

Read that list next to the industries we work in and the answer is not close. Law firms, medical and behavioral health practices, gyms, restaurants, retailers and most local service businesses are named in the text of the statute itself.

What the statute does not say is anything about websites, because it was written in 1990. The Department of Justice filled that gap with guidance rather than regulation. Its web accessibility guidance of March 18, 2022 states that "The ADA's requirements apply to all the goods, services, privileges, or activities offered by public accommodations, including those offered on the web." The same page says businesses "can currently choose how they will ensure that the programs, services, and goods they provide online are accessible", and then adds the part people skip: "But they must comply with the ADA's requirements."

That is the whole tension. An obligation exists, and the government has declined to tell private businesses exactly what satisfies it.

Why there is no rulebook, and what filled the gap

There is no technical standard for private business websites because the Justice Department dropped the rulemaking that would have created one. On December 26, 2017 it published a notice at 82 FR 60932 withdrawing four advance notices of proposed rulemaking under Titles II and III of the ADA "for further review". Nine years later, nothing has replaced them for Title III.

What filled the vacuum was litigation. When there is no regulation defining the finish line, the finish line gets argued case by case, and the reference both sides reach for is the Web Content Accessibility Guidelines published by the World Wide Web Consortium. Build to those and you are arguing about degree. Ignore them and you are arguing about whether you tried at all.

How many lawsuits are we actually talking about

Enough that this is a normal business risk rather than an exotic one. Level Access, in a litigation analysis published May 27, 2026, counts 3,117 federal web accessibility lawsuits filed in 2025, a 27 percent increase over the 2,452 filed in 2024. Adding state court filings takes the 2025 total past 5,000. New York, Florida and California still dominate the volume, with newer activity in Illinois, Missouri and Minnesota, where the analysis says more than 300 businesses were sued in 2025.

Two honest caveats before anyone panics. The company publishing that count sells accessibility software, which is a reason to read the framing carefully even when the underlying court filings are real. And a filing is not a judgment. A large share of these cases resolve quickly and quietly, which is precisely what makes them attractive to file in volume.

The practical read is not that you will be sued. It is that a demand letter is a cheap thing for someone to send, and the cost of receiving one is much higher than the cost of not being an obvious target.

So what do you actually build to

Build to WCAG 2.1 Level AA. Not because a statute names it for private business, but because the federal government picked exactly that standard the one time it did write a binding web rule, which makes it the least arguable benchmark available.

That rule covers state and local government, not you. It was published at 89 FR 31320 on April 24, 2024 and took effect that June. Its operative text now sits at 28 CFR 35.200, and it requires public entities to comply with "Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1".

WCAG 2.2 is the newer version, currently published by the W3C as a Recommendation dated 12 December 2024, and it adds success criteria on top of 2.1. If your team is building to 2.2, good. The version referenced in United States regulation today is 2.1, so 2.1 Level AA is the floor to specify in a contract and 2.2 is the direction to move.

The government deadline that quietly moved this April

It moved by a year, and it does not bind private businesses, but it is worth knowing about for two reasons. On April 20, 2026 the Justice Department published an interim final rule at 91 FR 20902 extending the Title II web compliance dates. Public entities with a population of 50,000 or more went from April 24, 2026 to April 26, 2027. Smaller entities and special district governments went from April 26, 2027 to April 26, 2028.

The first reason to care is commercial. If you sell to a city, a county, a school district or a public hospital system, or you build sites for anyone who does, that obligation lands in your scope of work and now lands a year later than the schedule most vendors were quoting.

The second is that a lot of published advice is now wrong. Guides written before this April still list April 24, 2026 as a live date. If you are reading anything on this topic that has not been updated since spring, check its dates against the rule itself.

Healthcare organizations have a separate obligation on a separate clock, under section 504 rather than the ADA, and those dates also moved in 2026. We covered that in our piece on what a HIPAA compliant website actually requires, and the two should not be confused with each other.

The overlay widget problem

An accessibility overlay will not make your website conform to WCAG, and the Federal Trade Commission has now put a price on saying otherwise. On January 3, 2025 the FTC announced that accessiBe would pay $1 million to settle allegations it misrepresented the ability of its AI-powered tool to make any website WCAG compliant. The complaint alleged the accessWidget plug-in "did not make all user websites WCAG-compliant" and that the claims were therefore false, misleading, or unsubstantiated.

Samuel Levine, then director of the FTC's Bureau of Consumer Protection, put the principle plainly: "Overstating a product's AI or other capabilities without adequate evidence is deceptive."

The complaint carried a second allegation that is arguably more useful to you as a buyer. The FTC said the company "deceptively formatted third-party articles and reviews to appear as if they were independent opinions by impartial authors" while failing to disclose its connections to those reviewers. If you researched overlays in the years before this, some of what you read was advertising. The Commission approved the final order on April 22, 2025 by a 3-0 vote, barring the company from claiming its automated products can make any website WCAG compliant, or keep it compliant over time, without evidence.

Be precise about what this does and does not mean. The FTC acted on advertising claims, not on whether overlays are lawful, and it is not illegal to run one. The point is narrower and more practical: a script that loads after your page cannot supply what your page never had. If a button contains an icon and no text, the widget is guessing what that button does. If your color palette fails contrast, the widget offers a visitor a menu to change it, which is a different thing from the page being readable when it loads.

What actually breaks, in order

Six failure types account for almost all of the detectable problems, and all six are decided during the build. WebAIM, a non-profit service center at Utah State University that has worked on accessibility since 1999, tests the top one million home pages every year. In its February 2026 analysis, "95.9% of home pages had detected WCAG 2 failures", up from 94.8% in 2025 and reversing six straight years of small improvements.

The scale is worth sitting with. WebAIM detected 56,114,377 distinct errors across the million pages, an average of 56.1 per page, 10.1 percent more than the 51 per page found in 2025. And because only automatically detectable failures were counted, the report notes that the real rate of full WCAG 2 A and AA conformance "was certainly lower than 4.1%".

Translated out of jargon, here is what those six things are. Low contrast text is a palette decision, usually grey type on white that looked elegant in a design file. Missing alternative text is an image with nothing describing it, so a screen reader announces a filename or nothing at all. Missing form input labels means a field whose label is only visual, so nobody using assistive technology knows what to type. Empty links and empty buttons are almost always icons without text, the search magnifier and the hamburger menu being the classic pair. Missing document language is one attribute on one line of HTML that tells software which language to pronounce.

None of that is expensive to get right the first time. The trend data makes the point better than we can: missing document language has fallen steadily from 33.1 percent of home pages in 2019 to 13.5 percent in 2026, because it became a default in build tooling. Low contrast text went the other way, improving to 79.1 percent in 2025 and then jumping back to 83.9 percent this year, because contrast is a taste decision that gets re-made by every new designer.

Your platform matters less than your builder

It matters, but not in the way vendors imply, and the same WebAIM data lets us check rather than guess. Detected errors per home page, broken out by content management system, ranged from 29.9 on Adobe Experience Manager to 52.8 on WordPress across 252,302 WordPress home pages.

Two readings of that chart are wrong and one is right. It is not evidence that Squarespace or Wix make a site accessible: they score well partly because they constrain what an average user can build, which is also the reason businesses outgrow them. It is not evidence that WordPress is inaccessible: WordPress carries an enormous unmanaged long tail of themes and plugins, and the median WordPress site is not built by a professional.

The right reading is that no platform on that list gets you close. The best score on the chart still means roughly thirty detected barriers on a single home page. Whatever you build on, someone has to care about this, and that person is your builder. We have written elsewhere about choosing between WordPress and a modern framework, and accessibility is one of the few dimensions where the honest answer is that the decision barely moves the needle.

The same report shows every industry failing. Business home pages averaged 52.6 errors, health and fitness 54.4, law, government and politics 46.6. There is no sector quietly doing this well.

Prevention is nearly free, retrofitting is not

The cost difference between building accessibly and fixing it later is the single most useful number in this article, and it is not a number, because we will not invent one. Nobody publishes a credible average cost of remediation, and the range depends entirely on how big your site is and how bad the templates are.

What we can describe is the shape of the work. During a build, contrast is one decision about a palette, made once, applied everywhere. Labels and button names are written into components as they are created. Alternative text becomes a field in the content process. The marginal cost is close to zero because the work is happening anyway.

Retrofitting inverts all of that. Somebody has to audit every template, find every instance, change markup that other things depend on, and test the result without breaking the design that was signed off. Then the content team has to go back through the images. On a fifty page site that is a project, not a task, and it competes for budget with everything else you wanted to do this quarter.

This is the argument for doing it at the moment you are rebuilding anyway, which most businesses do every three or four years regardless.

If you sell into Europe

Different law, different standard, and it is worth knowing which one applies before you assume the ADA travels. The EU Web Accessibility Directive obliges public sector bodies to make their websites and apps accessible, referencing the harmonised standard EN 301 549 v3.2.1. It requires three things American rules do not: a published accessibility statement naming the non-accessible content and alternatives, a feedback mechanism so users can report problems, and regular monitoring by member states with reports to the Commission every three years.

That directive entered into force on 22 December 2016 with a transposition deadline of 23 September 2018. A second instrument, the European Accessibility Act, extends accessibility requirements to a wide range of products and services in the private sector, so businesses selling into the EU should get specific national advice rather than relying on a US checklist.

The practical consequence for anyone selling both ways is small: build to WCAG Level AA and you are aligned with the substance of both, then handle the statement and feedback obligations separately as documentation.

Five questions for whoever builds your site

The answers separate a team that has done this from a team that will learn on your budget, and they take about ten minutes to ask.

Which WCAG version and level will you build to, and will you write it into the contract? How will you test it, and does that testing include using the site with a keyboard only and with a screen reader, rather than only running an automated scanner? Are you installing an accessibility widget, and if so, what specifically do you expect it to fix? Which of the six most common failures does your component library prevent by default? And after launch, what stops the next person who adds a page from undoing it?

That last one catches more teams than the others combined. Accessibility is not a state you reach, it is a property that decays every time somebody uploads an image without a description.

What we do about this, and when we are the wrong choice

We build websites, and accessibility is part of how we build rather than a line item you buy separately. That means WCAG 2.1 AA as the working target, contrast checked in the design phase instead of after sign-off, real text on every control, labelled form fields, and keyboard testing before launch. We do not sell an overlay and we would talk you out of one.

Pricing is public so you can decide without talking to anyone: $1,499 flat for a focused build, paid once, or $2,499 a month for an ongoing design and development partnership, both set out on the pricing page. The record behind those figures is 200+ projects shipped, a focused build that typically launches in about two weeks, and partnership requests answered inside 48 hours. Cornerstone Healing Center saw website conversions rise 20 percent after the rebuild we did for them.

Now the part most agencies leave out. We are not accessibility auditors and we do not issue conformance reports, so if you need a formal audit, a VPAT, or an expert witness, hire a specialist firm, and if a demand letter is already sitting on your desk, call a lawyer before you call us. If your site is a large enterprise application carrying a decade of legacy templates, remediation at that scale is a different discipline than ours. Where we fit is narrower and more useful than either: you are rebuilding anyway, and you want the replacement built properly the first time. That describes most of the healthcare practices and law firms who reach us.

A ten minute check you can run right now

You can find most of your problems yourself, without buying anything. Open your home page and put your mouse away. Press Tab repeatedly and watch where the focus indicator goes. If it disappears, if it never reaches the menu, or if you cannot tell what is selected, that is failure one, and it affects everyone who cannot use a mouse.

Next, zoom the browser to 200 percent and see whether text overlaps or controls fall off the screen. WCAG 2.1 sets that one at Level AA: text must resize "up to 200 percent without loss of content or functionality". Then right click, view page source, and look at the very first line for a lang attribute on the html element. Run your two main text colors through any contrast checker and compare against the 4.5 to 1 ratio that WCAG 2.1 requires for normal text. Finally, look at your search icon, your menu icon and your social icons, and ask whether any of them carries text a screen reader could actually announce.

Five minutes of that tells you more about where you stand than any scanner score, and it costs nothing. If the results bother you, the fix belongs in your next build, not in a widget.