Which accessibility law applies to you, and since when

If you sell in the United States

The law is the ADA, the Americans with Disabilities Act. It's a federal civil rights law from 1990. It has no section about websites, because the web barely existed when it was written.

Two parts of it matter. Title II covers state and local government. Title III covers businesses open to the public: stores, restaurants, hotels, banks, clinics, gyms, schools. If you sell to US consumers, Title III is your part.

The Department of Justice, the federal agency that enforces the ADA, says the requirements reach what a business offers on the web. It also says there's no regulation setting out detailed technical standards for Title III. So you have room in how you comply. You have none in whether you comply.

Here's the part most buyers get wrong. Under federal law, a private plaintiff suing you under Title III doesn't win money from you. What a court gives them is an order to fix the site, plus their attorney's fees. The fees are what make these cases worth filing. In some states a second claim rides along with the federal one, and that one does pay money. California is the clearest case.

What this means for you. There's no deadline to miss here and no certificate to buy. What ends a claim is a site that works, and a dated report that shows the work was done. That report is the Site audit.

What a Title III case looks like in practice

• The person who brings it is a private individual, not a regulator.
• A federal court can order you to fix the site and to pay the plaintiff's attorney's fees. It can't order you to pay the plaintiff damages. Civil penalties exist, but only the US Attorney General can ask for them, and that's rare.
• Many claims arrive first as a demand letter from a law firm, and settle before anyone files anything in court. We can't tell you how many, because no public register counts letters that were never filed.
• Counts of filed cases are published by law firms and by vendors who watch court dockets. They aren't official statistics, and the yearly totals move up and down. Be careful with anyone who quotes you one number as a trend.

California: where the law puts a number on it

California has its own civil rights law, the Unruh Civil Rights Act. Two things in it change the arithmetic.

First, a violation of the ADA is automatically a violation of Unruh. The plaintiff doesn't have to show you meant to discriminate.

Second, Unruh puts a floor under the money. The California Civil Code sets damages at no less than $4,000 for each and every offense, plus attorney's fees, and up to three times actual damages. That figure is in the code itself, not in someone's marketing page.

What counts as a single offense is decided case by case, and courts haven't all gone the same way. We're not going to put a number on your exposure, and neither should anyone selling you an audit. That question belongs to a lawyer.

What this means for you. If you have California customers, an inaccessible checkout stops being a theoretical risk. Fix the blockers first: keyboard access, form labels, error messages, and anything standing between a visitor and a purchase. The Express audit tells you within days whether you have that kind of problem.

If your customer is a state or local government

This is the block with real dates in it. In April 2024 the Department of Justice published a rule under ADA Title II. It tells state and local government what accessible means, and by when.

The standard is WCAG 2.1, Level AA. WCAG stands for Web Content Accessibility Guidelines, the international guidelines published by the W3C, the body that sets web standards.

The dates moved once. In April 2026 the Department pushed them back by a year:

• April 26, 2027 for a public entity serving a total population of 50,000 or more, unless it's a special district government.
• April 26, 2028 for a public entity serving fewer than 50,000 people, and for any special district government whatever its size. A special district government is a body set up for a single purpose, such as a water, fire, or transit district.

Now the part that reaches private companies. The rule covers web content and mobile apps the government body provides directly or through contractual, licensing, or other arrangements. If your software runs your client's permit portal, their deadline is your deadline, and it will show up in your next contract.

What this means for you. If you sell to US public bodies, you want a dated conformance report before their deadline, not after it. That's the Site audit, and we can deliver it together with an ACR.

The exceptions, one state that goes further, and a caveat on the dates

The rule lists five exceptions: archived content, certain conventional documents published before the compliance date, content posted by members of the public, individualized password-protected documents, and social media posts made before the compliance date.

A public entity can also argue that compliance would fundamentally alter a program, or would be an undue financial and administrative burden. That argument has to be made and documented. It isn't something you get by default.

Colorado goes further than the federal rule. State agencies and local government bodies there have to meet accessibility standards set by the state's Office of Information Technology, and failing to do so is treated as a civil rights violation with a statutory fine payable to each plaintiff. The grace period ended on July 1, 2025.

One caveat. The one-year extension was issued as an interim final rule. It took effect the day it was published and it's the rule in force today. The comment period closed on June 22, 2026, and no final rule had replaced it when we last checked this page.

If you sell to a federal agency

Section 508 of the Rehabilitation Act binds federal agencies. It doesn't bind you directly. It reaches you through what agencies are allowed to buy.

The technical standard agencies have to meet is set by the US Access Board, and for electronic content it's WCAG 2.0, Level A and Level AA. Yes, 2.0. It's older than the standard in the Title II rule, and it hasn't been updated.

Federal purchasing rules then close the loop: when an agency buys information and communication technology, what it buys has to meet those standards, unless a listed exception applies.

So the document a federal buyer asks you for is an ACR, short for Accessibility Conformance Report. It's the VPAT template filled in for your product, criterion by criterion: supports, partially supports, does not support, or not applicable, with remarks. You report it under your own responsibility. Nobody issues it to you, and it isn't a certificate.

What this means for you. If a US agency or a prime contractor asked you for a VPAT, what they want is an ACR. We write them, on their own or with a Site audit behind them. The difference between a report and a seal is explained in which web accessibility certificates actually exist.

If you take federal health or human services funding

Section 504 of the Rehabilitation Act applies to anyone who receives federal financial assistance. In 2024 the Department of Health and Human Services wrote web and app accessibility into its Section 504 rule.

The standard is WCAG 2.1, Level AA again, and it covers web content and mobile apps the recipient provides directly or through contracts and licenses.

These dates also moved back by a year, in May 2026:

• May 11, 2027 for a recipient with fifteen or more employees.
• May 10, 2028 for a recipient with fewer than fifteen employees.

This one catches organizations that don't think of themselves as government at all: hospitals, clinics, community health centers, universities and social service providers that take money from the Department. Whether a specific funding stream makes you a recipient is a legal question about your organization, and a lawyer is the one who answers it.

What this means for you. Unlike a Title III defendant, you have a named standard and a fixed date. Work backwards from it. An audit that lands six months before the deadline leaves time to fix what it finds; one that lands the week before only documents the problem.

If you sell in the United Kingdom

Two sets of rules, and they cover different people.

The Equality Act 2010 covers private businesses that provide services to the public. It puts a duty on service providers to make reasonable adjustments, so that disabled people aren't put at a substantial disadvantage. It names no technical standard and sets no deadline. It works much like the ADA: the duty runs continuously, and it gets tested when somebody complains.

The Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 cover the public sector, and their deadlines have all passed: September 23, 2019 for websites published from September 2018 onwards, September 23, 2020 for older websites, and June 23, 2021 for mobile apps.

Two things about those regulations are worth knowing even if you're not a public body yourself:

• They require an accessibility statement, published on the site in an accessible format. It has to explain which parts are not accessible and why, describe any alternatives offered, give people a way to report a problem, and link to the enforcement procedure.
• Government guidance puts the standard at WCAG 2.2, Level AA. The regulations themselves point at WCAG Levels A and AA as amended over time, so the version moves as the guidelines move.

Monitoring is done by the Government Digital Service. Enforcement sits with the Equality and Human Rights Commission in England, Scotland and Wales, and with the Equality Commission for Northern Ireland.

What this means for you. If you supply sites, apps or content to a UK public body, the statement is part of the delivery, not an extra. We draft it. If you're a private UK business, the Equality Act gives you no deadline and no safe harbor, so the practical answer is the same as in the United States: remove the barriers, and keep a dated record that you did.

And if your UK company offers covered services to consumers in the European Union, the European Accessibility Act reaches you. Leaving the EU didn't change that. What counts is where the customer is.

If you sell to consumers in the European Union

The rule is the European Accessibility Act, Directive (EU) 2019/882. Member States have had to apply it since June 28, 2025. It isn't a deadline coming up. It's one that has passed.

Where your company is based doesn't matter. What matters is that you offer a covered product or service to consumers in the European Union. Note that word. The Act is about selling to the public. If you sell only to other businesses, it doesn't reach you by this route. It can still reach you by another: a public sector contract, or a clause your customer writes into yours.

Which products and services it covers, and who is exempt

Services covered:

• E-commerce services.
• Consumer banking services.
• Electronic communications services.
• Services providing access to audiovisual media.
• Parts of air, bus, rail and waterborne passenger transport: websites, mobile apps, electronic tickets, travel information, and self-service terminals located in the EU.
• E-books and the software made for them.

Products covered include consumer computers and their operating systems, e-readers, consumer terminal equipment such as phones and TV equipment, and self-service terminals such as ATMs, ticketing machines and check-in machines.

The microenterprise exemption applies to service providers only. A microenterprise employs fewer than 10 people and, on top of that, meets one of two conditions: annual revenue of no more than 2 million euros, or an annual balance sheet total of no more than 2 million. Either one is enough. Companies that make or distribute covered products don't get this exemption, even at that size.

What the Act does give you. Services can keep using products that were already lawfully in use before June 28, 2025, until June 28, 2030. Service contracts agreed before June 28, 2025 can run unchanged until they expire, up to five years from that date. There's also a disproportionate burden exception, which has to be assessed, documented and renewed. It isn't an open door, but it is a door.

Penalties are written by each Member State. In Spain, for example, fines under the general disability rights law run from €301 to €1,000,000.

The Act also asks service providers to prepare public information explaining how the service meets the accessibility requirements, and to keep it available for as long as the service runs. That's the European equivalent of an accessibility statement.

What this means for you. If you're in one of those sectors and you sell to EU consumers, you're already past the date. What closes it is an evaluation against EN 301 549, the European standard that carries WCAG into EU law, and the statement that rests on it. Both are part of the Site audit.

If you work with the Argentine State

Ley 26.653 has been in force since 2010. It binds the national State and its agencies, State-owned companies, holders of public service concessions, suppliers and contractors of the State, and civil society organizations that receive State money.

It doesn't bind Argentine private companies in general. We'd rather tell you that than sell you something you don't need. The Spanish version of this page goes into the detail: qué ley de accesibilidad te obliga.

One audit covers all of them

Every framework on this page points at the same guidelines: WCAG. Europe reaches them through EN 301 549. The Title II rule and the Section 504 rule name WCAG 2.1 Level AA. Section 508 still names WCAG 2.0. The UK regulations point at WCAG and follow the current version, which guidance puts at 2.2.

Different version numbers sound like a problem. They aren't. The W3C is explicit about it: Content that conforms to WCAG 2.2 also conforms to WCAG 2.0 and WCAG 2.1.

So one audit against WCAG 2.2, Level AA answers all of them at once. There's no need to audit three times, or to hire someone different in each country.

Which one applies to you

Tell us what you sell and where you sell it. We'll tell you which framework covers you and from when, at no cost and with nothing to sign.

Ask which law applies to your company or see the full service details.

And if what you're being asked for is a certificate, start with which web accessibility certificates actually exist. The short version: real voluntary programs do exist, none of them is required by law, and what the law asks for is conformance plus a document that shows it.

This page is general guidance on the state of the regulations, not legal advice. For an interpretation you can rely on, talk to a lawyer. Last checked: August 20, 2026.