What does ADA compliance mean for a website?
For businesses open to the public, the Department of Justice says the ADA requires websites to be accessible to people with disabilities, but it has no regulation with detailed web standards for businesses; it points to the Web Content Accessibility Guidelines (WCAG) as helpful guidance. State and local governments, and healthcare providers that receive HHS funding, have rules that adopt WCAG 2.1 Level AA with set compliance dates.
The Department of Justice’s guidance says businesses “have flexibility in how they comply with the ADA’s general requirements of nondiscrimination and effective communication. But they must comply with the ADA’s requirements,” and that the Department “does not have a regulation setting out detailed standards” for business websites (ADA.gov: Guidance on Web Accessibility and the ADA). The guidance points to the Web Content Accessibility Guidelines (WCAG) and the federal Section 508 Standards as existing technical standards. The underlying law for businesses is Title III of the ADA (42 U.S.C. 12182).
Which rules set a specific standard and deadline?
| Who | Rule | Standard | Compliance dates |
|---|---|---|---|
| State and local governments with a population of 50,000 or more | DOJ Title II rule, 28 CFR 35.200 | WCAG 2.1 Level A and AA | April 26, 2027 |
| Smaller state and local governments and special district governments | Same | Same | April 26, 2028 |
| Health care providers and others receiving HHS federal financial assistance, 15 or more employees | HHS Section 504 rule, 45 CFR 84.84 | WCAG 2.1 Level A and AA | May 11, 2027 |
| Same, fewer than 15 employees | Same | Same | May 10, 2028 |
DOJ extended its dates by one year in April 2026 (91 FR 20902), and HHS extended its dates in May 2026 (91 FR 25496). Both rules have exceptions; whether one applies to your organization is a question for your attorney. If your organization is a medical practice, Clinic Security’s guide to the HHS rule covers it in detail.
What does WCAG ask for?
WCAG is organized around four principles: content must be perceivable, operable, understandable and robust. Level A and Level AA success criteria cover things like text alternatives for images, captions for video, keyboard access to every function, enough color contrast, clear form labels and error messages, and content that works with assistive technology such as screen readers (WCAG 2.1).
How do you check your website?
No single test covers everything. Start with these seven checks:
- Keyboard only. Put the mouse aside and use Tab, Shift+Tab, Enter and Space. Can you reach every link, menu, button and form field, and always see where you are on the page?
- Images. Do meaningful images have text alternatives that describe them, and are decorative images hidden from screen readers?
- Forms. Does every field have a visible label? When you submit with a mistake, does the error say what’s wrong and where?
- Contrast. Is normal text at least 4.5:1 against its background, and large text at least 3:1 (WCAG success criterion 1.4.3)?
- Zoom. At 200% zoom, does the page still work without text overlapping or content being cut off?
- Media and documents. Do videos have captions? Are your PDFs and forms readable by a screen reader, or are they scanned images?
- Automated scan. Free automated checkers find many common problems quickly, but not all of them. A full review also needs testing by a person, ideally including someone who uses a screen reader.
Write down what you tested, when, and what you found. A dated record shows the work you’ve done and what’s still open.
Why an overlay widget is not a fix
Some products add a script to a site that promises to make it compliant automatically. The script runs on top of the page; it doesn’t change the page’s underlying code, and it can’t fix problems such as untagged PDFs, inaccessible third-party booking or payment tools, or forms that never had labels. In 2025 the FTC finalized an order against one overlay vendor over its compliance claims. Our briefing Why overlay widgets fall short covers the details.
How Internet Security Consultants helps
We audit sites against WCAG 2.1 AA, fix the issues in the source code on a private staging copy you approve, and document what was tested and changed. If you’ve received a demand letter, talk to your attorney first; we work with counsel on the technical record.
General information only, not legal advice. Which accessibility rules apply to your organization, and how, is a question for your attorney.
Sources: ADA.gov web guidance; 42 U.S.C. 12182; 28 CFR 35.200; DOJ extension, 91 FR 20902; 45 CFR 84.84; HHS extension, 91 FR 25496; WCAG 2.1.