Website Accessibility Lawsuits: What the ADA Requires, What Breaks in the Code, and What to Do When the Letter Arrives

Summary. This article explains website accessibility litigation from both the legal and the engineering side, written by an IP and technology attorney who is also a former software engineer. It covers what Title III of the ADA requires, the circuit split over whether a website is a place of public accommodation, the DOJ's 2024 Title II web rule and its 2026 compliance-date extension, state damages statutes such as California's Unruh Act, and the unresolved tester-standing question. It then explains what WCAG actually is and walks through the four code failures that generate most claims (mouse-only controls, broken navigation menus, inaccessible modals, and checkout forms), with working HTML and JavaScript fixes. The second half covers the first week after a demand letter arrives, the economics of these cases, mootness and the voluntary cessation doctrine, the repeat-target problem, why overlay widgets fail, and how to run a remediation program under privilege. A worked example, common mistakes, an FAQ, and takeaways close the article.

An email arrives on a Tuesday. It is addressed to your general inbox, it is signed by a law firm you have never heard of, and it says your website discriminates against blind users. It lists a handful of problems in language that sounds technical but vague. It proposes that you resolve this quietly for a five-figure sum. It gives you fourteen days.

Most businesses do one of two things at that point, and both are mistakes. Some forward it to their web developer with the subject line "can you fix this?" Others ignore it, because it reads like a scam.

Neither response accounts for what is actually happening. According to UsableNet's 2025 year-end report, plaintiffs filed more than 5,000 digital accessibility lawsuits in federal and state courts in 2025 (5,114 by its count), and its tracking shows more than 4,000 filings every year since 2021. That does not count demand letters, which are far more numerous and never appear in any docket. If you sell anything online, this is a live risk category, not a hypothetical one.

This article covers what the law actually requires, what the technical standard actually says, what the code problems actually look like, and what to do in the first week after a letter arrives. It is written for two audiences at once: business owners who need to make decisions, and lawyers who need to advise them. Where the material gets technical, I have kept it technical, because in my experience the single biggest failure in this area is lawyers who cannot evaluate the engineering and engineers who cannot evaluate the legal risk.

I am an IP and technology attorney and a former software engineer. I have defended businesses against these claims and I have helped others build sites that never attract them. The second is dramatically cheaper.

Three companion documents carry the practical work further. The step-by-step response sequence is in Responding to a Website Accessibility Demand Letter or Lawsuit: A Practical Guide. The page-by-page testing protocol is in Website Accessibility Self-Audit Checklist: A Practical Checklist. The letters, engagement terms, and remediation records are in Website Accessibility Defense Toolkit: Demand Responses, Privileged Audit Engagements, and Remediation Records. For a broader survey that also covers mobile apps, Section 508 procurement, and adjacent statutes, see Website and Mobile App Accessibility Under the ADA: WCAG, Litigation Risk, and Remediation.

The short answer

• The ADA reaches websites, but the courts disagree about how far. Title III requires places of public accommodation to provide full and equal access to their goods and services (42 U.S.C. § 12182). Federal courts have applied that to websites for more than a decade, but the circuits split on whether a website is itself a covered "place" or matters only when it obstructs access to a physical one.
• There is no federal technical rule for private businesses. In its absence, courts, consent decrees, and DOJ settlements have converged on a private standard, WCAG 2.1 at conformance Level AA, as the benchmark. The DOJ's 2024 rule for state and local governments adopted the same standard, which makes it harder for private defendants to argue it is unreasonable.
• Under the ADA itself, a private plaintiff gets an injunction and attorney's fees, and no damages (42 U.S.C. § 12188, 42 U.S.C. § 12205). That single fact drives nearly everything about how these cases behave, including why they settle quickly and for the amounts they do.
• Damages come from state law. California's Unruh Civil Rights Act carries statutory damages of at least $4,000 per violation, and a violation of the ADA is automatically a violation of Unruh. New York has its own regime. Where your customers live matters more to your exposure than where your company is incorporated.
• Four code failures generate most claims: controls that only work with a mouse, navigation menus that trap or vanish, modal dialogs that mishandle focus, and checkout forms that cannot be completed with a screen reader. All four are fixable, usually with native HTML.
• If you have received a letter, do three things first: preserve everything, find out whether the sender is a serial filer, and get your accessibility audit done under attorney-client privilege rather than as a standalone consulting engagement. That last point costs nothing to get right and is expensive to get wrong.
• Paying without fixing buys a release and nothing else. A large share of each year's lawsuits target businesses that have been sued before. The only durable exit is a site that passes.

Part One: What the law actually requires

The statute is older than the web

The ADA was signed in 1990. Title III, codified at 42 U.S.C. § 12181 and following, prohibits discrimination "on the basis of disability in the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation." The congressional findings and purposes, at 42 U.S.C. § 12101, describe a "clear and comprehensive national mandate," and the Supreme Court has read Title III's coverage provisions generously, most famously in PGA Tour, Inc. v. Martin, 532 U.S. 661 (2001).

The statute then lists twelve categories of public accommodation in § 12181(7). Hotels. Restaurants. Theaters. Stores. Doctors' offices. Schools. Every item on the list is a physical location, because in 1990 the alternative did not meaningfully exist.

That drafting choice is the source of every doctrinal fight in this area. The question courts have spent more than fifteen years arguing about is whether a website is itself a place of public accommodation, or whether it matters only when it obstructs access to a physical one.

The DOJ's Title III regulations, at 28 C.F.R. part 36, add a second hook that plaintiffs use constantly. They require public accommodations to furnish "auxiliary aids and services" where necessary to ensure effective communication with people with disabilities, and they list screen reader compatible formats among the examples. Much of the case law, including the most influential appellate decision, turns on that effective-communication duty rather than on the abstract question of whether a website is a "place."

The circuit split, plainly stated

The federal appellate courts have not agreed, and the Supreme Court has never resolved it. The honest description is a spectrum rather than two camps, and it is worth knowing which cases sit where, because district judges cite them by name.

The broad reading. In Carparts Distribution Center, Inc. v. Automotive Wholesaler's Ass'n of New England, Inc., 37 F.3d 12 (1st Cir. 1994), a case about a health benefit plan rather than a website, the First Circuit held that "public accommodation" is not limited to physical structures, reasoning that it would be irrational to protect someone who walks into an office to buy a service but not someone who buys the same service by phone or mail. The Second Circuit reached a similar conclusion about insurance products in Pallozzi v. Allstate Life Insurance Co., 198 F.3d 28 (2d Cir. 1999), and the Seventh Circuit, through Judge Posner, said in Doe v. Mutual of Omaha Insurance Co., 179 F.3d 557 (7th Cir. 1999), that the core of Title III reaches the owner or operator of a website or other facility, "whether in physical space or in electronic space," that is open to the public. That last statement was dictum, repeated in Morgan v. Joint Administration Board, 268 F.3d 456 (7th Cir. 2001), and the Seventh Circuit has never squarely decided a website case. District courts built on all three. Within the Seventh Circuit, a federal court in Indiana relied on those decisions in Wright v. Thread Experiment, LLC, No. 1:19-cv-01423 (S.D. Ind. Jan. 22, 2021) to hold that an online home bedding retailer's website could violate Title III on its own terms, joining what it called the growing number of courts that apply the statute to websites with no physical store; a narrower rule, on that reasoning, would let purely online businesses exclude blind customers entirely. (The ruling came on a default judgment, so it was not tested by an adversary.) In National Ass'n of the Deaf v. Netflix, Inc., 869 F. Supp. 2d 196 (D. Mass. 2012), a Massachusetts court held that a streaming service could be a place of public accommodation with no physical storefront at all. In National Federation of the Blind v. Scribd Inc., 97 F. Supp. 3d 565 (D. Vt. 2015), a Vermont court reached the same result for a digital library. And in Andrews v. Blick Art Materials, LLC, 268 F. Supp. 3d 381 (E.D.N.Y. 2017), Judge Weinstein wrote at length that a retailer's website was covered on its own terms.

The narrow reading. The Third, Sixth, and Ninth Circuits, with the Fifth and Eleventh leaning the same way, read "place" to mean a physical place. The Third Circuit said so in Ford v. Schering-Plough Corp., 145 F.3d 601 (3d Cir. 1998); the Sixth Circuit, sitting en banc, in Parker v. Metropolitan Life Insurance Co., 121 F.3d 1006 (6th Cir. 1997); and the Ninth Circuit in Weyer v. Twentieth Century Fox Film Corp., 198 F.3d 1104 (9th Cir. 2000). The Fifth Circuit's decision in Magee v. Coca-Cola Refreshments USA, Inc., 833 F.3d 530 (5th Cir. 2016), holding that vending machines are not "sales establishments," is read the same way. In those circuits a website is not itself a public accommodation, but an inaccessible website can still violate the ADA if it operates as a barrier to the goods and services of a physical place. This is the "nexus" approach. The Eleventh Circuit articulated a version of it in Rendon v. Valleycrest Productions, Ltd., 294 F.3d 1279 (11th Cir. 2002), a case about a telephone screening process for a television game show, holding that Title III covers barriers that screen people out of a physical venue even if the barrier is not itself located there.

The leading nexus case. The case every defense lawyer and every plaintiff's lawyer knows is Robles v. Domino's Pizza, LLC, 913 F.3d 898 (9th Cir. 2019). Guillermo Robles, who is blind, alleged that he could not order a customized pizza through Domino's website or app with his screen reader. Domino's argued that the ADA could not apply because the DOJ had never said what an accessible website looks like, so holding it liable would violate due process. The Ninth Circuit disagreed on every point. It held that the website and app connected customers to the goods and services of Domino's physical restaurants, that the nexus was "critical" to its analysis, and that the absence of a specific regulation did not excuse a statutory duty that had been on the books since 1990. It also declined to apply primary jurisdiction to wait for DOJ rulemaking that might never come. The Supreme Court denied certiorari in October 2019. The practical lesson of Robles is that the nexus test, which sounds narrow, is easy to satisfy for any business with physical locations: store locators, online ordering for pickup, appointment booking, and gift cards redeemable in store all supply the connection.

The case that tried to settle it. The Eleventh Circuit tried to settle the question and then unsettled it. In Gil v. Winn-Dixie Stores, Inc., 993 F.3d 1266 (11th Cir. 2021), Juan Carlos Gil, who is legally blind, sued because he could not use Winn-Dixie's website to refill prescriptions or manage coupons with his screen reader. The district court had found a nexus to the stores and entered a three-year injunction. A divided panel reversed, holding that websites are not places of public accommodation and that Gil's inability to use the site was not an "intangible barrier" to the stores, because he could still shop and pick up prescriptions in person. That decision was welcomed loudly by the defense bar and lasted about eight months. In December 2021 the panel granted Gil's petition for rehearing, vacated its own opinion and the underlying judgment, and remanded for the district court to dismiss the case as moot, because the three-year injunction had expired while the appeal was pending. Gil v. Winn-Dixie Stores, Inc., 21 F.4th 775 (11th Cir. 2021). The result is that the Eleventh Circuit has no binding published precedent on the central question, and Florida, Georgia, and Alabama are back where they started, with district courts applying a nexus analysis informed by Rendon and by the unpublished decision in Haynes v. Dunkin' Donuts LLC, 741 F. App'x 752 (11th Cir. 2018), which reinstated a website claim against a restaurant chain because the plaintiff plausibly alleged a connection to its shops.

New York, the busiest venue, is itself divided. New York federal courts receive more of these cases than any other venue, and the judges do not agree. Blick and similar decisions treat a commercial website as covered on its own. Other judges in the Eastern and Southern Districts have held that a website with no physical counterpart is not a place of public accommodation; Winegard v. Newsday LLC, 556 F. Supp. 3d 173 (E.D.N.Y. 2021), is the most cited example, and in Mejia v. High Brew Coffee, Inc., No. 1:22-cv-03667 (S.D.N.Y. Sept. 30, 2024), the court dismissed an ADA claim against a coffee company that sold only through its website, holding that the site was not a place of public accommodation. Until the Second Circuit decides the question, the identity of the assigned judge can matter as much as the facts.

A split within a single state. In Pennsylvania, judges in the Western District have repeatedly distinguished the Third Circuit's physical-place cases where the defendant owns and operates the website itself, in decisions such as Gniewkowski v. Lettuce Entertain You Enterprises, Inc., 251 F. Supp. 3d 908 (W.D. Pa. 2017), and West v. DocuSign, Inc., No. 2:19-cv-00501 (W.D. Pa. Aug. 15, 2019), while judges in the Eastern District have tended to apply Ford more strictly. Plaintiffs' firms noticed, and filing patterns shifted accordingly. District-level tendencies move, so read the assigned judge's recent decisions before building a motion around them.

For a business, the practical consequence is this: your legal exposure depends substantially on where you can be sued, and a national e-commerce operation can usually be sued in a lot of places. The table below is a starting point, not a substitute for checking the controlling district's most recent decisions.

There is no federal rule for private businesses

The Department of Justice has said for years that the ADA applies to the websites of public accommodations. Its March 2022 guidance on web accessibility said so in plain terms, and it has repeated the position in statements of interest and settlements. It has never issued a regulation saying what that means technically for a private business. Title III web rulemaking has been announced, shelved, revived, and shelved again across multiple administrations, beginning with an advance notice of proposed rulemaking in 2010.

What DOJ did do, in April 2024, was issue a final rule under Title II, which covers state and local governments. That rule, codified in a new subpart of 28 C.F.R. part 35, adopts WCAG 2.1 Level AA as the required technical standard for web content and mobile apps, and it reaches not only content an entity produces itself but content provided "through contractual, licensing, or other arrangements" with vendors. The rule was published as Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities, 89 Fed. Reg. 31320 (Apr. 24, 2024). It contains a short list of exceptions (archived content, preexisting electronic documents that are not currently used, certain third-party postings, and individualized password-protected documents among them), each narrower than it first appears.

In April 2026, DOJ published an interim final rule extending the Title II compliance dates by one year: April 26, 2027 for public entities serving populations of 50,000 or more, and April 26, 2028 for smaller entities and special district governments (the original dates were April 24, 2026 and April 26, 2027). The rule took effect immediately on publication, with comments accepted afterward. Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities 91 Fed. Reg. 20903 (Apr. 20, 2026). The technical standard did not change. Neither did the underlying obligation, which has existed under Title II since 1990 and under Section 504 of the Rehabilitation Act, 29 U.S.C. § 794, even longer.

Separately, the Department of Health and Human Services adopted parallel web and mobile accessibility requirements, also keyed to WCAG 2.1 Level AA, in its May 2024 rule under Section 504 for recipients of HHS financial assistance, codified at 45 C.F.R. part 84. In May 2026, HHS published its own interim final rule extending those dates by one year: recipients with fifteen or more employees now have until May 11, 2027 (originally May 11, 2026), and recipients with fewer than fifteen employees until May 10, 2028 (originally May 10, 2027). Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Content and Mobile Applications of Recipients of Departmental Financial Assistance, 91 Fed. Reg. 25497 (May 11, 2026). As with the DOJ extension, the standard itself did not change.

Federal agencies themselves are governed by Section 508, 29 U.S.C. § 794d, whose standards (the "Revised 508 Standards," at 36 C.F.R. part 1194) incorporate WCAG 2.0 Level AA. Section 508 does not apply to private businesses directly, but it reaches any vendor that sells software or web services to the federal government, which is why procurement teams ask for a Voluntary Product Accessibility Template (VPAT).

Title II is not Title III. A private online retailer is not bound by the DOJ rule. But the rule matters anyway, for a reason every litigator will recognize: when the federal government formally identifies WCAG 2.1 Level AA as the standard for accessible government websites, it becomes very difficult for a private defendant to argue that WCAG 2.1 Level AA is an unreasonable benchmark. Plaintiffs cite it. Courts notice it. Expect that to continue.

State law is where the money is

This is the part most business owners misunderstand, and it is the part that determines the number on the settlement agreement.

Title III provides injunctive relief and attorney's fees to a prevailing plaintiff. Section 12188(a) incorporates the remedies of Title II of the Civil Rights Act of 1964, which are injunctive only, and § 12205 authorizes a reasonable attorney's fee. It provides no damages to a private plaintiff. A pure ADA claim, standing alone, cannot produce a payment to the plaintiff personally. (The Attorney General can seek civil penalties and damages in a pattern-or-practice case under § 12188(b), but that is a government enforcement tool, not a private one.)

So the fee-shifting provision is the engine. A plaintiff's firm that can generate a fee award has an economic case regardless of whether the client recovers anything, which is precisely why demand letters propose a number and a quick resolution. One limit matters: after Buckhannon Board & Care Home, Inc. v. West Virginia Department of Health & Human Resources, 532 U.S. 598 (2001), a plaintiff is a "prevailing party" entitled to fees only if the case produces a judgment or court-ordered consent decree. Voluntary remediation that moots a case before judgment does not, by itself, generate a fee award under the federal statute. That is the legal foundation for the mootness strategy discussed in Part Five.

State statutes change the arithmetic. California's Unruh Civil Rights Act, Cal. Civ. Code § 51, provides in subdivision (f) that a violation of the ADA is also a violation of Unruh, and Cal. Civ. Code § 52 entitles a plaintiff to actual damages and up to three times that amount, but in no case less than $4,000, for each offense. The California Supreme Court held in Munson v. Del Taco, Inc., 46 Cal. 4th 661 (2009), that a plaintiff proceeding on an ADA-violation theory does not have to prove intentional discrimination. Where the plaintiff cannot rely on an ADA violation (for example, against an online-only business that the ADA may not reach), Unruh requires intentional discrimination, which is a much harder showing; the Ninth Circuit applied that rule to an online-video captioning claim in Greater Los Angeles Agency on Deafness, Inc. v. Cable News Network, Inc., 742 F.3d 414 (9th Cir. 2014). Multiply the statutory minimum by visits, or by plaintiffs, and the exposure moves quickly. The California Supreme Court also held, in White v. Square, Inc., 7 Cal. 5th 1019 (2019), that a person who visits a website intending to use its services and encounters discrimination has standing under Unruh without first entering into an agreement with the business.

California's procedural protections for small businesses, including the reduced damages and pre-suit notice provisions for "construction-related accessibility claims" in Cal. Civ. Code § 55.56, are written for physical facilities. Defendants have had little success extending them to websites, so do not assume they apply.

There is also a forum twist. Federal courts in California have increasingly declined to exercise supplemental jurisdiction over Unruh claims joined to ADA claims, under 28 U.S.C. § 1367(c), partly to stop plaintiffs from evading the state's heightened pleading and fee requirements for high-frequency litigants. The Ninth Circuit approved that practice in Arroyo v. Rosas, 19 F.4th 1202 (9th Cir. 2021) and Vo v. Choi, 49 F.4th 1167 (9th Cir. 2022). The result is that many California website cases are now filed in state court with Unruh as the lead claim.

New York's State Human Rights Law, N.Y. Exec. Law § 296, and the New York City Human Rights Law, N.Y.C. Administrative Code § 8-107, provide their own remedies, including compensatory damages, and New York has been a consistently favorable venue for these claims. Blick held that a website could be a place of public accommodation under both laws, and the City law is construed more broadly than its federal counterpart. Other states have their own analogues with varying reach.

California has also produced defense-side authority. In Martinez v. Cot'n Wash, Inc., 81 Cal. App. 5th 1026 (2022), the California Court of Appeal held that a retail website with no connection to a physical location is not a "place of public accommodation" under Title III as the court read it, so the plaintiff's Unruh claim could not ride on an ADA violation, and the complaint did not adequately allege intentional discrimination. That helps online-only retailers in California state court. It does not help a business with retail locations, and it does not bind federal courts.

A few states have started pushing back on filing volume through procedural mechanisms such as pre-suit notice and cure periods. Missouri went furthest in 2026. Senate Bill 907 (combined with SBs 1154 and 1272), signed by Governor Kehoe in May 2026 and effective August 28, 2026, creates a procedure for declaring a website or web content access suit "abusive litigation." If the defendant receives written notice of an alleged violation and in good faith begins substantial steps to correct it within ninety days, a rebuttable presumption arises that the suit is abusive. A Missouri resident or registered entity, or the Attorney General on its behalf, can seek that declaration, and the court can award fees and costs plus sanctions of up to three times the fee award. The law does not change what the ADA requires and cannot stop a federal Title III suit; its leverage is against plaintiffs and counsel who want to do business in Missouri courts. Whether that model spreads is worth watching.

Standing: sometimes a defense, sometimes a distraction

A recurring feature of this litigation is the "tester," a plaintiff who visits websites specifically to find violations and who may have no intention of buying anything.

Article III requires a concrete and particularized injury, traceable to the defendant and redressable by the court, under Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992). Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), sharpened the point: a bare statutory violation is not enough without a concrete harm. And because Title III relief is injunctive, the plaintiff must also show a real and immediate threat of future injury, typically through a plausible intent to return. The general doctrine is covered in Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims.

The Supreme Court took a case squarely on tester standing in Acheson Hotels, LLC v. Laufer, and then did not decide it. Deborah Laufer had filed hundreds of suits against hotels whose online reservation systems did not describe their accessible rooms, with no plan to stay at any of them. The circuits had split: the Second, Fifth, and Tenth Circuits found no standing (see Harty v. West Point Realty, Inc., 28 F.4th 435 (2d Cir. 2022), and Laufer v. Looper, 22 F.4th 871 (10th Cir. 2022)), while the First, Fourth, and Eleventh found it (see Laufer v. Naranda Hotels, LLC, 60 F.4th 156 (4th Cir. 2023)). On December 5, 2023, the Court unanimously dismissed the case as moot, because Laufer had voluntarily dismissed her pending suits after one of her attorneys was suspended for misconduct in other cases. Acheson Hotels, LLC v. Laufer, 601 U.S. 1 (2023). Justice Thomas and Justice Jackson each concurred in the judgment, and Justice Thomas wrote that he would have reached the merits and held that Laufer lacked standing. The question remains open.

So standing arguments are still available, and they are sometimes strong. In Calcano v. Swarovski North America Ltd., 36 F.4th 68 (2d Cir. 2022), the Second Circuit affirmed dismissal of a batch of nearly identical suits by blind plaintiffs over retailers' lack of braille gift cards, holding that boilerplate allegations of intent to return were not plausible, and noting the "Mad-Libs-style" sameness of the complaints. A plaintiff who has filed hundreds of nearly identical complaints, lives four states away, and has never purchased anything from any of the defendants presents a real question. The Ninth Circuit, by contrast, held in Langer v. Kiser, 57 F.4th 1085 (9th Cir. 2023), that a plaintiff's motivation as a tester does not defeat standing if he otherwise has a genuine intent to return, so the argument travels differently in different circuits.

The tactical judgment is separate from the legal one. Litigating standing costs money. If a plaintiff's fee demand is $12,000 and a motion to dismiss costs $25,000 to brief with no guarantee of success, winning is not the same as coming out ahead. Sometimes the standing fight is worth it because you have twelve of these letters and need to establish a reputation for not paying. Sometimes it is worth it because the plaintiff genuinely lacks standing and you want that ruling. Often it is not worth it at all. That calculation should be made deliberately rather than emotionally. For the mechanics of a factual standing attack under Rule 12(b)(1), see Pleading and Attacking Standing in Federal Court: A Practical Guide.

Part Two: What WCAG actually is

Lawyers throw the acronym around without much precision. It is worth understanding properly, because the difference between conformance levels is the difference between a strong claim and a weak one.

The basics

WCAG stands for Web Content Accessibility Guidelines. It is published by the World Wide Web Consortium, the standards body for the web, through its Web Accessibility Initiative. It is not law anywhere in the United States for private businesses. It became the operative standard through consent decrees, DOJ settlement agreements, and judicial adoption, and it now functions as the de facto rule. The Ninth Circuit described it in Robles as a set of private industry standards developed by accessibility experts, and noted that the district court could order compliance with it as a remedy even though no regulation required it.

WCAG is organized around four principles, remembered as POUR:

Perceivable. Users must be able to perceive the information. Images need text alternatives. Video needs captions. Content cannot rely on color alone to convey meaning.

Operable. Users must be able to operate the interface. Everything must work by keyboard. Users need enough time. Nothing should trigger seizures.

Understandable. Content and interface behavior must be comprehensible. Language is identified. Navigation is consistent. Errors are explained.

Robust. Content must work with assistive technologies, including ones that do not exist yet. In practice this means valid markup and correct use of ARIA (Accessible Rich Internet Applications, the attribute vocabulary that tells assistive technology what a custom control is and what state it is in).

Under those principles sit numbered success criteria. Each is testable, and each is assigned a conformance level.

Levels A, AA, and AAA

Level A is the minimum. These are the criteria whose failure blocks access outright. Keyboard operability lives here. So do text alternatives for images, and the requirement not to trap keyboard focus.

Level AA is the standard everyone actually means when they say "WCAG compliant." It includes all of Level A plus criteria addressing contrast ratios, resize behavior, consistent navigation, and focus visibility. Every regulatory adoption in the United States has landed on AA: the Revised 508 Standards (WCAG 2.0 AA), the DOJ Title II rule (WCAG 2.1 AA), and the HHS Section 504 rule (WCAG 2.1 AA).

Level AAA is aspirational. It includes things like sign language interpretation for prerecorded audio. The W3C itself says AAA conformance is not recommended as a general policy for entire sites, because some content cannot satisfy every AAA criterion. If a demand letter tells you that you are required to meet Level AAA, the sender does not know what they are talking about, and that is useful information.

This distinction matters enormously in evaluating a claim. A complaint built on Level A failures in a checkout flow is serious. A complaint built on marginal contrast ratios in a footer is not the same animal, even though both are technically WCAG failures.

Versions

WCAG 2.0 was published in 2008. WCAG 2.1, published in 2018, added seventeen success criteria addressing mobile, low vision, and cognitive disabilities. WCAG 2.2, published in October 2023, added nine more: two at Level A, four at Level AA, and three at Level AAA. The new A and AA criteria focus on mobile usability, cognitive load, and authentication (Focus Not Obscured, Dragging Movements, Target Size (Minimum), Consistent Help, Redundant Entry, and Accessible Authentication (Minimum)). WCAG 2.2 also marked the old 4.1.1 Parsing criterion obsolete. Because 2.2 otherwise builds on 2.1, a site conforming to 2.2 also conforms to 2.1.

WCAG 3.0 exists as a working draft and is years away from finalization, let alone regulatory adoption. Ignore anyone selling compliance with it.

The practical target for a business today is WCAG 2.1 Level AA, with the 2.2 additions treated as a near-term roadmap. That is the standard courts reference, and it is the standard DOJ adopted for Title II. Settlement agreements negotiated in 2025 and 2026 increasingly specify 2.2 AA, so build to 2.2 if you are rebuilding anyway.

Part Three: What actually breaks, in code

This is the section most legal articles on this subject skip, and skipping it is why so much accessibility advice is useless. If you are a business owner, this will tell you what your developers need to hear. If you are a lawyer, this will let you read a complaint and know within ten minutes whether it describes a real problem or boilerplate.

Four failure patterns generate the overwhelming majority of claims. The code samples below are simplified for readability; they show the pattern, not a production-hardened component, and a front-end developer should test them in your own stack before shipping.

Failure one: things that only work with a mouse

WCAG 2.1.1 (Keyboard, Level A) requires that all functionality be operable through a keyboard interface. This sounds trivial and is violated constantly.

Here is the canonical failure:

<!-- Broken: not focusable, not announced, not keyboard operable -->
<div class="btn" onclick="addToCart(sku)">Add to Cart</div>

A div is not an interactive element. It receives no keyboard focus. It exposes no role to a screen reader. It does not respond to Enter or Space. A sighted mouse user sees a button. A keyboard user encounters nothing at all, and a screen reader announces, at best, the words "Add to Cart" as ordinary text with no indication that anything can be done with them.

The fix is usually to stop reinventing the button:

<!-- Correct: native semantics, keyboard behavior, and accessibility API support for free -->
<button type="button" onclick="addToCart(sku)">Add to Cart</button>

Native HTML elements come with focusability, keyboard event handling, and correct roles already implemented. Most accessibility bugs in modern front ends are self-inflicted wounds from rebuilding native controls out of generic elements.

When a custom element is genuinely unavoidable, the work is manual:

<div role="button" tabindex="0"
     onclick="addToCart(sku)"
     onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();addToCart(sku);}">
  Add to Cart
</div>

That requires an explicit role, an explicit tab stop, and explicit key handling for both Enter and Space. Three things a native button does automatically, each of which is a separate opportunity to get it wrong.

The related criterion is WCAG 2.4.7 (Focus Visible, Level AA). Focus indicators must be visible. Designers dislike them, and an outline: none rule in a stylesheet is one of the most common accessibility failures on the web. If a keyboard user cannot tell where they are on the page, the site is unusable to them even if every control is technically reachable. The modern compromise is :focus-visible, which shows the ring to keyboard users without showing it on every mouse click:

/* Remove the ring only for mouse clicks, keep a strong ring for keyboard users */
button:focus:not(:focus-visible) { outline: none; }
button:focus-visible { outline: 3px solid #1a5fb4; outline-offset: 2px; }

Failure two: navigation menus that trap or vanish

Drop-down navigation is the single most common source of the "keyboard navigation" allegation in demand letters, and it usually fails in one of three ways.

The menu opens on hover only. A keyboard user tabs to the parent item and the submenu never appears, so half the site is unreachable.

The menu opens but focus never enters it. The submenu becomes visible on focus, but the child links are outside the tab order, or they are hidden with display: none while still rendered, or focus jumps past them to the next top-level item.

The menu opens and focus cannot get out. Tab cycles inside the submenu forever, and the user is stuck. That is WCAG 2.1.2 (No Keyboard Trap, Level A), and it is among the more serious failures, because the user's only remedy is to close the browser tab.

A correctly built disclosure menu looks roughly like this:

<button aria-expanded="false" aria-controls="shop-menu" id="shop-trigger">
  Shop
</button>
<ul id="shop-menu" hidden>
  <li><a href="/shop/new">New Arrivals</a></li>
  <li><a href="/shop/sale">Sale</a></li>
</ul>

const trigger = document.getElementById('shop-trigger');
const menu = document.getElementById('shop-menu');

trigger.addEventListener('click', () => {
  const open = trigger.getAttribute('aria-expanded') === 'true';
  trigger.setAttribute('aria-expanded', String(!open));
  menu.hidden = open;
});

// Escape closes the menu and returns focus to the trigger
menu.addEventListener('keydown', (e) => {
  if (e.key === 'Escape') {
    trigger.setAttribute('aria-expanded', 'false');
    menu.hidden = true;
    trigger.focus();
  }
});

Three things make this work. The trigger is a real button, so it is focusable and operable. The aria-expanded attribute tells assistive technology whether the menu is open, which is WCAG 4.1.2 (Name, Role, Value, Level A). And the hidden attribute removes the menu from the tab order entirely when closed, rather than merely hiding it visually. Escape-to-close is not strictly required by any single success criterion for a disclosure menu, but it is the behavior keyboard and screen reader users expect, and the ARIA Authoring Practices Guide recommends it.

That last point about hiding is worth dwelling on. Hiding something with opacity: 0, with visibility: hidden in some configurations, or by positioning it off screen can leave the content focusable. Keyboard users then tab into invisible content, focus disappears from view, and the page appears broken. Use hidden, display: none, or the inert attribute.

Failure three: modal dialogs and pop-ups

This is the failure pattern in nearly every "focus management during automatic pop-ups" allegation, and it is also the one businesses create deliberately, because marketing wants an email capture overlay to appear ten seconds after arrival.

An accessible modal has to do four things.

Move focus into the dialog when it opens. Otherwise a screen reader user hears nothing and keeps reading the page behind the overlay, which they cannot interact with.

Keep focus inside while it is open. Tab from the last element should return to the first. Background content should be inert or aria-hidden="true".

Close on Escape, and always offer a keyboard-reachable close button. A modal the user cannot leave by keyboard is a keyboard trap under WCAG 2.1.2.

Return focus to the triggering element on close. Otherwise focus resets to the top of the document and the user loses their place.

A minimal implementation:

let previouslyFocused = null;

function openModal(dialog) {
  previouslyFocused = document.activeElement;
  dialog.hidden = false;
  document.getElementById('main-content').setAttribute('inert', '');

  const focusables = dialog.querySelectorAll(
    'a[href], button:not([disabled]), input, select, textarea, [tabindex]:not([tabindex="-1"])'
  );
  const first = focusables[0];
  const last = focusables[focusables.length - 1];
  first.focus();

  dialog.addEventListener('keydown', function handler(e) {
    if (e.key === 'Escape') { closeModal(dialog, handler); }
    if (e.key === 'Tab') {
      if (e.shiftKey && document.activeElement === first) {
        e.preventDefault(); last.focus();
      } else if (!e.shiftKey && document.activeElement === last) {
        e.preventDefault(); first.focus();
      }
    }
  });
}

function closeModal(dialog, handler) {
  dialog.hidden = true;
  dialog.removeEventListener('keydown', handler);
  document.getElementById('main-content').removeAttribute('inert');
  if (previouslyFocused) previouslyFocused.focus();
}

This sketch omits edge cases a production component must handle: focusable elements added after the dialog opens, elements inside shadow DOM, and dialogs that contain no focusable element at all. The native <dialog> element with showModal() handles focus containment, Escape, and background inertness automatically and is now well supported in current browsers. Use it where you can:

<dialog id="signup" aria-labelledby="signup-title">
  <h2 id="signup-title">Get 10% off your first order</h2>
  <form method="dialog">
    <label for="signup-email">Email address</label>
    <input id="signup-email" type="email" autocomplete="email">
    <button value="submit">Subscribe</button>
    <button value="cancel" formnovalidate>No thanks</button>
  </form>
</dialog>

There is a second problem specific to automatic pop-ups. If an overlay appears without user action, a screen reader user may have no idea it exists, and a keyboard user may find that their next Tab press does something unexpected. WCAG 3.2.1 (On Focus) and 3.2.2 (On Input) address unexpected context changes, and 2.2.1 (Timing Adjustable) and 2.2.2 (Pause, Stop, Hide) address content that moves or changes on its own schedule. If your marketing team insists on a timed overlay, it needs to announce itself, be dismissible by keyboard, and not steal focus in the middle of a form.

Failure four: the cart and checkout

Of all the allegations in a typical demand letter, this is the one to take most seriously, and the analysis is not primarily technical.

Everything above applies to a cart dialog, because a cart dialog usually is a modal. But the legal significance is different. A user who cannot read your blog post has a real complaint. A user who cannot complete a purchase has been denied the goods and services of the business entirely, which is the exact language of the statute. There is no better fact pattern for a plaintiff and no worse one for a defendant.

Common checkout failures:

Form inputs without programmatically associated labels. A placeholder is not a label. Placeholder text disappears on input and is inconsistently announced. This implicates WCAG 1.3.1 (Info and Relationships), 3.3.2 (Labels or Instructions), and, for the autocomplete attribute below, 1.3.5 (Identify Input Purpose).

<!-- Broken -->
<input type="text" placeholder="Card number">

<!-- Correct -->
<label for="cc">Card number</label>
<input type="text" id="cc" name="cardNumber" autocomplete="cc-number" inputmode="numeric">

Error messages that appear visually but are never announced. If validation fails and the only signal is a red border, a screen reader user has no idea what happened. This implicates WCAG 3.3.1 (Error Identification), 1.4.1 (Use of Color), and 4.1.3 (Status Messages), and the fix is a live region plus a programmatic link between each field and its error:

<div role="alert" id="form-errors"></div>

<label for="zip">ZIP code</label>
<input id="zip" name="zip" autocomplete="postal-code"
       aria-invalid="true" aria-describedby="zip-error">
<p id="zip-error">Enter a five-digit ZIP code.</p>

(role="alert" already implies an assertive live region, so adding aria-live="assertive" to it is redundant, though harmless.)

Timeouts that expire a cart or session without warning, which implicates WCAG 2.2.1 (Timing Adjustable).

Multi-step flows where focus is not moved to the new step, leaving screen reader users reading the previous page's content. Move focus to the new step's heading (give it tabindex="-1" so it can receive focus programmatically) and update the document title.

Payment fields rendered in a third-party iframe with no accessible name, which the screen reader announces only as "frame." The title attribute on the iframe, and the vendor's own field labeling inside it, both matter. This is one reason vendor contracts belong in an accessibility program.

If you fix nothing else this quarter, fix checkout. It is where the exposure is concentrated and where the remediation has the clearest business return, because keyboard and screen reader users are also customers who currently cannot give you money.

A note on automated testing

Automated scanners are useful and insufficient. Depending on which study you credit, they detect somewhere between roughly a third and a little under half of WCAG issues. They are good at contrast ratios, missing alt attributes, and malformed markup. They cannot tell you whether alt text is meaningful, whether a focus order makes sense, whether a modal traps focus correctly, or whether a screen reader user can actually complete a purchase.

This matters legally as well as practically. A clean automated scan report is not evidence of conformance, and presenting one as though it were will not impress a plaintiff's expert. Manual testing with a keyboard and a screen reader is what produces defensible results. Turn off your mouse and try to buy something from your own site. Most people find the problem within four minutes. The full manual protocol, page type by page type, is in the Website Accessibility Self-Audit Checklist: A Practical Checklist.

Part Four: The letter arrived. Now what?

The first week matters more than any other week in these matters, mostly because of things you can do wrong without realizing it. What follows is the condensed version; the full sequence, with timing and costs for each step, is in Responding to a Website Accessibility Demand Letter or Lawsuit: A Practical Guide.

Do not have your developers start fixing things yet

This is counterintuitive and it is the advice I give most often.

Remediation is almost always the right destination. Getting there in the wrong order creates two problems.

The first is evidentiary. If your team runs an accessibility audit as an ordinary vendor engagement, that audit is discoverable. You have then produced, at your own expense, a document that catalogs every accessibility failure on your site, dated, itemized, and authored by someone you hired. Opposing counsel will ask for it. In many cases they will get it. Run the audit through counsel, as work product prepared in anticipation of litigation under Fed. R. Civ. P. 26(b)(3), and the analysis stands a much better chance of protection. This costs nothing extra to do correctly and cannot be repaired retroactively.

The second is strategic. Uncoordinated fixes can undercut a mootness argument, which is often the fastest exit available. More on that below.

Tell your developers to pause non-urgent accessibility changes, document current state, and wait about a week. Then remediate deliberately, on advice, with a record. (If a defect is actively preventing customers from buying, fix it, and document what you did; nobody should leave a broken checkout in place to protect a litigation position.)

Preserve everything

Send a litigation hold. It should reach your web team, your marketing team, whoever administers your CMS, and any outside development agency. The duty to preserve attaches when litigation is reasonably anticipated, and a demand letter usually qualifies; the consequences of losing electronically stored information are governed by Fed. R. Civ. P. 37(e). The mechanics are in Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case.

Preserve site analytics, deployment logs, and version history for the pages at issue. Preserve the site as it existed on the date of the alleged visit, if you can. Plaintiffs' complaints often reference a specific date, and the state of your site on that date is a fact.

If you use a third-party e-commerce platform, find out what history it retains and for how long. Some platforms overwrite theme files without versioning, which means the evidence of what your checkout looked like last month may be gone by next month.

Find out who is suing you

Run the plaintiff's name and the firm's name through federal and state court dockets. This takes thirty minutes and changes your posture completely.

A plaintiff with two prior filings is a different problem from a plaintiff with two hundred. If it is a high-volume filer, you learn several useful things: what their typical settlement number is, whether they litigate or fold when pushed, which defenses have worked against them, and whether any court has criticized their practices. All of that is public. The opinions are often blunt; the Second Circuit's description of the gift-card complaints in Calcano is a good example of what a court will say about boilerplate.

You should also check whether the same firm has sent letters to other businesses in your industry. These campaigns are often sector-specific, and industry counsel may already have a playbook.

Read the letter for what is not in it

Demand letters in this space vary enormously in quality. Some are drafted from a real audit and identify specific pages, specific controls, and specific WCAG criteria. Some are generic and could have been sent to any business on the internet.

Look for these things.

Does it identify specific URLs? Vagueness usually means nobody looked carefully.

Does it cite specific success criteria, and are they at Level A or Level AA? A letter alleging only Level AAA failures is not a serious letter.

Does it allege the plaintiff attempted a transaction and could not complete it? That is the strongest version of the claim.

Does it state when the plaintiff visited? That date matters for standing, for mootness, and for whether the alleged problem still exists.

Is it a demand letter or a filed complaint? If nothing has been filed, you have room to negotiate that disappears once a docket number exists and the plaintiff's fees start accruing in earnest. If a complaint has been filed and served, the response deadline under Fed. R. Civ. P. 12(a) is 21 days, and it does not pause for settlement talks unless the parties stipulate to an extension. Defaulting on a website complaint is common and expensive, as Wright illustrates; see Default and Default Judgment in Federal Court: Rules 55 and 60 and the Cost of Ignoring a Lawsuit.

Check your insurance this week

Look at your general liability policy, any cyber policy, and any employment practices liability policy. Some cover ADA claims, some cover defense costs only, some exclude them outright. Website accessibility claims fall awkwardly between coverage grants: they are not "bodily injury" or "property damage," they rarely fit "personal and advertising injury," and some EPL policies extend third-party discrimination coverage only by endorsement.

Whatever the answer, note the notice deadline. Policies commonly require notice within a defined period of a claim, and a demand letter is often a claim. Losing coverage because nobody read the policy in time is an entirely avoidable, entirely unnecessary loss, and I have seen it happen. For the coverage analysis itself, see Business Insurance and Coverage Disputes: CGL, E&O, Cyber, and D&O; a ready-to-send tender letter is Template 8 of the Website Accessibility Defense Toolkit: Demand Responses, Privileged Audit Engagements, and Remediation Records.

Part Five: Evaluating exposure and deciding what to do

The economics of the plaintiff's side

Understanding why these cases exist tells you how to resolve them.

Under Title III alone, the plaintiff cannot recover damages. The plaintiff's lawyer recovers fees if they prevail or settle. So the business model depends on volume and on quick resolutions. A case that settles in six weeks for $10,000 is a good outcome for a plaintiff's firm. A case that goes to summary judgment is not, unless it produces a fee award large enough to justify the time.

That asymmetry is why demand letters propose modest numbers and short deadlines. It is also why aggressive defense sometimes works and sometimes backfires spectacularly. If you fight and win early on standing, you may pay less than you would have to settle. If you fight and lose, you pay your own fees, their fees, and still have to remediate. Fee awards in civil rights cases are calculated under the lodestar method, and a defendant whose litigation choices drove up the plaintiff's hours will find that reflected in the number.

Where state statutory damages are available, the calculation changes because the plaintiff has a personal stake. California cases behave differently from cases elsewhere for exactly this reason.

Typical numbers

Reported ranges for individual website accessibility settlements commonly fall in the five to twenty thousand dollar band, with defense costs and remediation on top. Total all-in cost for a single matter is frequently quoted, by defense firms and accessibility vendors, in the forty-five to seventy-five thousand dollar range once you count everything. Class actions can be far larger: in 2025 the online retailer Fashion Nova agreed to a widely reported $5.15 million class settlement of claims by blind screen-reader users, with monetary relief for the California class tied to the Unruh Act.

Treat those figures as orientation, not prediction. They come from industry reporting rather than any systematic court data, because most of these matters settle privately before or shortly after filing. The number in your case depends on your revenue, your jurisdiction, how bad your site actually is, whether state damages are available, and whether the plaintiff's counsel thinks you will fight. For the negotiation itself, see Settlement Negotiation Tactics: Principled Negotiation, Anchoring, and Handling Hardball in Litigation.

The repeat-target problem

UsableNet counted 1,427 federal lawsuits in 2025, about 45 percent of federal filings, against businesses that had been sued before. That statistic should shape your thinking more than almost any other number in this article.

Paying to make a claim go away without fixing the underlying code buys you a settlement agreement and nothing else. Your site remains detectable by the same automated tools the next plaintiff will use, and you have now demonstrated that you pay. Businesses that settle and do not remediate get sued again, sometimes within the same year, sometimes by a different plaintiff represented by the same firm.

A prior settlement is not a shield, either. In Haynes v. Hooters of America, LLC, 893 F.3d 781 (11th Cir. 2018), the defendant had already settled an earlier website case by agreeing to remediate. When a second blind plaintiff sued, the district court dismissed as moot. The Eleventh Circuit reversed: the second plaintiff was not a party to the first agreement, could not enforce it, and the website had not actually been fixed yet, so his claim was very much alive. The release you buy from one plaintiff binds that plaintiff. It does nothing about the next one.

The only durable exit is a site that passes.

Mootness as a strategy

Because Title III relief is injunctive, fixing the problem can moot the claim. If there is nothing left to enjoin, the case may be over, and under Buckhannon a plaintiff whose case is mooted by voluntary change before judgment is generally not a prevailing party entitled to fees.

This is the fastest and cheapest resolution available in many matters, and it is underused. But it has requirements.

The fix has to be real and complete as to the issues alleged. Partial remediation leaves a live claim.

The fix has to be durable. Courts apply the voluntary cessation doctrine, under which a defendant does not moot a case simply by stopping the challenged conduct if it is free to resume. The defendant bears the "formidable burden" of showing that it is "absolutely clear the allegedly wrongful behavior could not reasonably be expected to recur." Friends of the Earth, Inc. v. Laidlaw Environmental Services (TOC), Inc., 528 U.S. 167 (2000); see also Already, LLC v. Nike, Inc., 568 U.S. 85 (2013). Websites are a hard fit for that standard, because a website can be changed by anyone with CMS access in an afternoon, and many courts have said so. Overcoming it means demonstrating the change is permanent: a written accessibility policy, testing built into your release process, staff training, and monitoring. A one-time patch with no policy behind it invites the argument that you will regress the moment the case is dismissed.

The fix has to be documented. You need a record of what was broken, what was changed, when, and how it was verified, and you will usually present it through a declaration from someone with personal knowledge on a motion under Fed. R. Civ. P. 12(b)(1). The briefing structure is in the Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing.

And mootness does not touch state damages claims. If a plaintiff has an Unruh claim, remediating the site does not eliminate the $4,000 per violation exposure that already accrued. Fixing the site handles the injunction and improves your negotiating position. It does not end a California case by itself.

When to fight

Fighting makes sense in a narrower set of circumstances than most defendants initially believe. It is worth considering when the plaintiff's standing is genuinely weak and you are in a circuit where that argument has traction; when the allegations are demonstrably false and you can prove your site conformed on the date alleged; when you are an online-only business in a circuit that requires a physical place; when you face a coordinated campaign and need to establish that you do not pay; or when the demand is so far outside market that settling is not meaningfully cheaper than litigating.

It is usually not worth it when the allegations are accurate, the demand is within the ordinary range, and your site genuinely needs the work anyway. In that situation the money is better spent on remediation than on motion practice.

A pleading challenge is also available in some cases. A complaint still has to state a plausible claim under Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), and Ashcroft v. Iqbal, 556 U.S. 662 (2009), and the Ninth Circuit held in Whitaker v. Tesla Motors, Inc., 985 F.3d 1173 (9th Cir. 2021), that an ADA complaint that does not identify the barrier the plaintiff actually encountered fails that standard. Template complaints that list generic WCAG failures without saying which ones blocked the plaintiff, on which page, and when, are vulnerable.

Part Six: Overlay widgets

A word about the products that promise to solve this with a line of JavaScript.

Accessibility overlays inject a script into your site that claims to detect and repair accessibility problems automatically, often with an accessibility icon in the corner offering font size and contrast controls. They are marketed heavily to exactly the businesses that receive demand letters.

They do not work for the failures that generate litigation. An overlay cannot restructure your DOM to give a div the semantics of a button. It cannot rewrite your modal's focus management. It cannot decide what your images mean. It can adjust some presentational properties and guess at some alt text, and that is roughly the extent of it.

Worse, they are detectable. Plaintiffs' firms know which overlays leave which fingerprints in a page, and sites running them have been targeted specifically; UsableNet's 2025 tracking recorded roughly a hundred or more lawsuits every month against sites that had an accessibility widget installed when they were sued. In some cases the overlay itself interferes with screen readers that users have already configured, creating problems that did not previously exist. The National Federation of the Blind and other disability organizations have taken public positions against these products.

The regulatory position is now explicit. In April 2025 the Federal Trade Commission, acting under its authority over deceptive practices in 15 U.S.C. § 45, finalized a $1 million order against accessiBe over claims that its automated product could make websites WCAG conformant, and over reviews and articles that did not disclose the company's material connections to their authors. The FTC announced the proposed order in January 2025. The order bars the company from claiming that its automated products can make any website WCAG compliant unless it has evidence to back the claim.

If you have an overlay and a demand letter, do not point to the overlay as your defense. If you are considering buying one after receiving a letter, do not. Spend that money on an audit and actual remediation.

Part Seven: Doing remediation properly

Audit under privilege

Engage counsel first. Counsel engages the accessibility consultant. The consultant reports to counsel. The work is done in anticipation of litigation and the record reflects that.

This is not gamesmanship; it is the same structure used for internal investigations and environmental assessments for the same reasons. Two doctrines do the work. The work-product doctrine, which began with Hickman v. Taylor, 329 U.S. 495 (1947) and is codified in Rule 26(b)(3), protects documents prepared in anticipation of litigation by or for a party or its representative, including a consultant. The attorney-client privilege can extend to a non-lawyer expert whose role is to help counsel understand technical facts and give legal advice, under the line of cases that began with United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), and the corporate privilege principles of Upjohn Co. v. United States, 449 U.S. 383 (1981). The protection is not absolute, and facts about your website are never privileged. A plaintiff can always test the site. But the consultant's analysis, prioritization, and recommendations have a meaningfully better chance of protection when the engagement is structured correctly from the start, and courts look hard at whether a report would have been prepared in the same form anyway for business reasons. For the doctrine in more depth, see Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest. A model three-party engagement letter is Template 5 of the Website Accessibility Defense Toolkit: Demand Responses, Privileged Audit Engagements, and Remediation Records.

Combine automated and manual testing

Run automated scans across the whole site for breadth. Tools built on the axe-core engine are the common choice, and they integrate into build pipelines.

Then test manually where it counts. Manual testing should cover, at minimum, your homepage, your primary navigation, search, category and product pages, cart, checkout, and account creation and login. Testing means using the site with a keyboard only, then with a screen reader. NVDA on Windows is free. VoiceOver ships with macOS and iOS. JAWS is the commercial standard and matters if your audit needs to reflect what many professional screen reader users actually run. TalkBack covers Android.

Test on mobile too. Orientation lock (1.3.4), reflow at a 320 CSS pixel viewport, which is the equivalent of 400 percent zoom on a typical desktop (1.4.10), and, under WCAG 2.2, minimum target size (2.5.8) are all AA criteria and all commonly failed.

Prioritize by legal risk, not by ticket count

Automated scans produce hundreds of findings, most of them trivial. Sorting by severity as the tool reports it is not the same as sorting by exposure.

Prioritize in roughly this order. First, anything in the transaction path, because that is where denial of goods and services is clearest. Second, Level A failures anywhere, because those are the strongest claims. Third, anything specifically identified in the demand letter, because leaving those unfixed guarantees the claim stays alive. Fourth, Level AA failures on high-traffic pages. Last, everything else.

Document the work

Build a remediation record as you go. What was found, when. What was changed, when, and by whom. How the fix was verified and by what method. Who signed off.

This record does three things. It supports a mootness argument. It demonstrates good faith if you end up in front of a judge. And it gives you a defensible answer the next time a letter arrives. Keep the record itself as a business document that you are prepared to produce, separate from counsel's privileged analysis of it; mixing the two is how privilege gets waived. A log format is Template 6 of the Website Accessibility Defense Toolkit: Demand Responses, Privileged Audit Engagements, and Remediation Records.

Make it durable

Adopt a written accessibility policy and publish an accessibility statement on your site with a real contact method. Add accessibility acceptance criteria to your definition of done. Put automated checks in CI so regressions fail the build. Schedule periodic manual testing, at least annually and after any significant redesign. Train the people who create content, because most alt text failures come from marketing uploads rather than from engineering.

And handle your vendors. Your checkout may be a third-party plugin. Your reviews widget, chat widget, and payment iframe are probably not yours. You are still responsible for the experience on your site. Put WCAG 2.1 Level AA conformance in your vendor contracts as a defined requirement with a remedy attached, and ask for a current VPAT before you buy anything that renders on your pages. The contract side is covered in Cloud and SaaS Agreements: Service Levels, Data Rights, Security, and Exit and Building a Vendor and Third-Party Risk Management Program.

Part Eight: A practical checklist

For a business that wants to know where it stands right now, work through this. It is not a substitute for an audit, but it will tell you whether you have a serious problem. The expanded version, organized by WCAG principle and page type and covering PDFs, mobile apps, third-party widgets, and governance, is the Website Accessibility Self-Audit Checklist: A Practical Checklist. For remediation after an audit, the companion is the Website Accessibility Remediation Checklist: A Practical Checklist.

Keyboard only. Unplug your mouse. Load your homepage. Using only Tab, Shift+Tab, Enter, Space, and arrow keys, try to reach every navigation item, open every drop-down, dismiss every pop-up, add an item to your cart, and complete a checkout to the payment step. Note every place you get stuck, every place the focus indicator disappears, and every place focus goes somewhere unexpected.

Focus visibility. As you tab, can you always see where you are? Search your stylesheets for outline: none and outline: 0.

Pop-ups. Does any overlay appear automatically? When it does, where does focus go? Does Escape close it? After closing, where is focus?

Cart dialog. Open it by keyboard. Can you get in, operate everything, and get out? Does focus return to where it was?

Forms. Does every input have a visible label element associated by for and id, not just placeholder text? Trigger a validation error and confirm it is announced, not merely shown in red.

Images. Do meaningful images have alt text that conveys the meaning? Are decorative images marked alt="" rather than given filler text?

Headings. View the heading structure. Is there one h1? Do levels descend without skipping? Are headings used for structure rather than for font size?

Contrast. Check body text and button text against their backgrounds. The Level AA thresholds are 4.5:1 for normal text and 3:1 for large text, and 3:1 for the boundaries of controls and other meaningful graphics.

Zoom. Set browser zoom to 200 percent and then 400 percent. Does content reflow, or does it require horizontal scrolling and overlap?

Media. Do videos have captions? Does anything autoplay with sound?

Screen reader. Turn on VoiceOver or NVDA and attempt one purchase. This is the most informative fifteen minutes you will spend.

If you fail more than two or three of these, you are a plausible target, and you would be well served to address it before someone else does it for you.

Part Nine: Notes for lawyers

A few things that come up repeatedly and are worth flagging for counsel handling one of these for the first time.

Get the technical facts before you get the legal ones. You cannot evaluate a demand letter without knowing whether the allegations are true. Have someone competent test the specific claims. Many of these letters describe problems that do not exist on the site as it currently stands, and knowing that early changes everything about your response.

Understand the difference between a Level A failure and a Level AA failure when you are assessing the strength of a claim. They are not equivalent and the distinction is easy to explain to a client.

Watch the venue question carefully. Where a case can be filed drives which circuit's rule applies, and the circuits genuinely disagree. A defendant with no physical presence in a nexus jurisdiction has a materially different case than one with retail stores.

Screen for state claims immediately. A California plaintiff with an Unruh claim is a different negotiation from a plaintiff with only federal claims. So is a New York plaintiff.

Think about mootness early, because the sequence matters. Advising remediation before you have thought about the voluntary cessation problem can waste the strategy.

Structure the audit under privilege from the outset, and tell the client explicitly not to commission one on their own in the meantime. Clients do this reflexively and it is hard to unwind.

Consider whether this is one letter or a campaign. Businesses that receive one often receive several, and the right strategy for a single letter is frequently the wrong strategy for the fifth.

Write settlement terms for the next plaintiff, not just this one. A release binds only the releasing party, as Haynes v. Hooters shows. Negotiate a realistic remediation timeline, a cure-notice provision before any enforcement motion, a standard you can actually meet (2.1 AA, with 2.2 as a target if you can), and a clear allocation of fees. If the plaintiff insists on a court-entered consent decree, understand that it makes the plaintiff a prevailing party and keeps a federal court in your business for years. For the general architecture of a release, see Settlement Agreements, Releases, and Rule 68: Ending a Case on Terms That Hold.

Consider a Rule 68 offer in a fee-driven case. An offer of judgment under Fed. R. Civ. P. 68 that includes injunctive relief and accrued fees shifts post-offer costs if the plaintiff does worse at trial. Under Marek v. Chesny, 473 U.S. 1 (1985), where the underlying fee statute defines fees as part of "costs," the offer also cuts off post-offer fees; whether § 12205's wording ("a reasonable attorney's fee, including litigation expenses, and costs") does so has been argued both ways, so check your circuit. Draft it carefully: an ambiguous offer is construed against the offeror.

A worked example: one letter, start to finish

Consider a composite case. Harbor & Hearth Goods, Inc. is a home-furnishings retailer with twelve stores in Pennsylvania and New Jersey and an online store that produces about a third of its revenue. On a Tuesday in March, its general inbox receives a letter from a New York firm on behalf of a blind New York resident. The letter says the plaintiff tried to buy a lamp on February 18 and could not, lists "inaccessible navigation menus, missing alternative text, and improper focus management during automatic pop-ups," cites WCAG 2.1 Level AA without naming any success criterion, demands $18,500 plus a remediation commitment, and gives fourteen days.

Day 1. Harbor & Hearth's controller forwards the letter to outside counsel instead of to the web agency. Counsel sends a litigation hold that afternoon to the e-commerce manager, the marketing director, and the agency, and asks the agency to export the theme version history and deployment log for January through March. The platform keeps theme versions for ninety days, so the February 18 version is still recoverable. Counsel tells the agency to pause the planned accessibility "cleanup sprint" the e-commerce manager had already scheduled after seeing the letter.

Day 2. A docket search shows the plaintiff has filed more than 150 website suits in the Southern and Eastern Districts of New York in three years, nearly all against retailers, and nearly all closed by voluntary dismissal within four months. Two were dismissed on standing grounds after Calcano. The firm has sent letters to at least four other home-goods retailers in the past six weeks. This is a campaign, and the firm settles.

Day 3. The controller pulls the insurance policies. The CGL policy excludes discrimination claims. The cyber policy does not mention accessibility. The EPL policy has a third-party discrimination endorsement that covers "claims alleging discrimination against a customer," with a notice requirement of "as soon as practicable" and a $25,000 retention. Counsel sends a tender letter to the EPL carrier the same day, enclosing the demand.

Days 4 to 8. Counsel engages an accessibility consultant under a three-party letter: the consultant reports to counsel, its findings go to counsel, and its deliverable is a privileged memorandum rather than a "compliance report." The consultant tests the homepage, navigation, search, three product pages, cart, and checkout with keyboard, NVDA, and VoiceOver. Findings: the mega-menu opens on hover only (2.1.1, Level A); the email capture modal appears after eight seconds, does not move focus, and cannot be closed by keyboard (2.1.2, Level A); the cart drawer returns focus to the top of the page on close (2.4.3, Level A); product images have alt text but it is the SKU number (1.1.1, Level A); and the checkout's ZIP code error is shown only as a red border (3.3.1, Level A). Everything else is AA contrast in the footer and some heading-order issues.

Day 9. Counsel's assessment. The claim is real: every alleged category has an actual Level A failure, and the checkout error message is in the transaction path. Harbor & Hearth has stores, so the nexus is easy, and in the Southern or Eastern District of New York the website might be covered even without them. Standing is arguable (the plaintiff lives in New York; the nearest store is in New Jersey), but the plaintiff alleges an attempted purchase, which makes his claim stronger than a bare tester's. New York state and city law claims could add compensatory damages. A motion to dismiss would cost more than the demand. The right posture is to remediate quickly, document it, and negotiate from the remediation.

Days 10 to 35. The agency rebuilds the mega-menu as a disclosure pattern with real buttons, replaces the custom modal with a native <dialog>, fixes cart focus return, rewrites alt text for the top 400 products and adds an alt-text field requirement to the product upload workflow, and adds a live-region error summary to checkout. It adds axe-core checks to the deployment pipeline. Each fix goes into a remediation log with the ticket number, the commit, the date deployed, and the verification method. The consultant retests and confirms each item to counsel.

Day 12. Counsel responds to the demand within the fourteen days. The letter does not admit liability, notes that the business has retained counsel and an independent accessibility consultant, describes the remediation program in general terms, and proposes a resolution at $6,500 inclusive of fees, with a release, an eighteen-month remediation commitment to WCAG 2.1 AA, a sixty-day cure-notice requirement before any enforcement, and no admission. The plaintiff's firm counters at $12,000. They settle at $9,000 on Day 31, before any complaint is filed. The EPL carrier, which accepted the tender subject to a reservation of rights, treats the settlement as within the retention.

Day 60 and after. Harbor & Hearth adopts a written accessibility policy, publishes an accessibility statement with a monitored email address and phone number, adds accessibility clauses and a VPAT requirement to its next two vendor renewals (the reviews widget and the payment provider), and schedules a manual retest every six months. Nine months later, a second firm sends a nearly identical letter on behalf of a different plaintiff. This time counsel responds in four days with a short letter attaching nothing privileged, describing the remediation dates and the program, and inviting the firm to identify any specific barrier it actually encountered. The firm does not reply.

The numbers are illustrative, not predictive, but the sequence is the point. The second letter cost a fraction of the first because the first was handled in the right order.

Common mistakes

Forwarding the letter to the developer. The developer fixes what is easy, documents nothing, and sometimes produces an unprivileged audit report in the process.

Ignoring the letter because it looks like a scam. Some letters are low-quality. Many are followed by a federal complaint, and a defaulted website case ends with a judgment, an injunction, and a fee award entered without anyone arguing the other side.

Buying an overlay. It does not fix the code, it can be detected, and the FTC has now said in an enforcement order that claims of automated compliance are deceptive when they are not substantiated.

Pointing to a clean automated scan. A scan that passes says nothing about keyboard operability, focus order, or whether a screen reader user can check out.

Settling without remediating. The release covers one plaintiff. The site remains a target for every other one, and a large share of each year's suits go to businesses that have been sued before.

Agreeing to a standard you cannot meet. Settlement agreements that promise full WCAG 2.2 AA conformance across every page, including third-party content, by a fixed date sixty days out create a breach claim instead of ending one.

Missing the insurance notice. A late notice defense is a coverage loss nobody needed to suffer.

Treating every circuit the same. An online-only business in a physical-place circuit has a defense that a retailer with stores in New York does not, and the reverse is also true.

Frequently asked questions

Is my website legally required to meet WCAG 2.1 AA? Not by any regulation that applies to private businesses. But Title III requires equal access, courts and DOJ treat WCAG 2.1 AA as the measure of whether you have provided it, and the DOJ adopted that standard for government websites. As a practical matter, it is the standard you will be measured against.

We only sell online. Does the ADA apply to us? It depends on where you can be sued. In the First Circuit, and in many New York and Seventh Circuit district courts, probably yes. In the Third, Fifth, Sixth, Ninth, and (functionally) Eleventh Circuits, an online-only business has a substantial argument that it is not a place of public accommodation. State laws, especially New York's, may reach you regardless.

Can the plaintiff get money from us? Under the ADA alone, the plaintiff gets an injunction and the plaintiff's lawyer gets fees. Under California's Unruh Act, the plaintiff can recover at least $4,000 per violation. New York's state and city laws provide compensatory damages. Most settlement payments are, functionally, fee payments plus whatever state-law damages the plaintiff can credibly threaten.

If we fix the website, does the case go away? Sometimes. A complete, documented, and durable fix can moot the federal claim for injunctive relief, but courts apply the voluntary cessation doctrine strictly, and remediation does not erase state damages that already accrued.

Does a settlement with one plaintiff protect us from the next? No. A release binds the person who gives it. Haynes v. Hooters holds that a different plaintiff can sue over the same website even while the first settlement's remediation is under way.

Are mobile apps covered too? The same legal theories apply, and Robles involved both a website and an app. The DOJ and HHS rules expressly cover mobile apps. WCAG applies to apps with some interpretation, and mobile-specific criteria such as orientation and target size matter more there.

What does a privileged audit cost compared with an ordinary one? About the same. The difference is in the paperwork: who engages the consultant, to whom it reports, what the deliverable is called and contains, and whether the engagement is tied to anticipated litigation.

Should we publish an accessibility statement? Yes, if it is accurate. A statement with a real contact method gives users a way to report problems before they become lawsuits and is evidence of good faith. A statement that claims full conformance you do not have is evidence of something else.

The part nobody says out loud

Most of this article treats accessibility as a litigation risk, because that is what brings people to a lawyer's website at two in the morning.

That framing is incomplete. The Centers for Disease Control and Prevention estimates that roughly one in four American adults has some type of disability. Millions of people use screen readers, keyboard-only navigation, magnification, or voice control to browse the web. When your checkout does not work with a keyboard, some number of people who wanted to buy something from you could not, and you never saw a support ticket about it because they simply left.

The businesses I have seen handle this best stopped treating it as a compliance exercise partway through and started treating it as a defect class. Their sites got better for everyone. Their support volume went down. Their SEO improved, because a lot of what makes a page accessible also makes it parseable. And they stopped receiving demand letters, which was the original point.

The businesses that handle it worst pay a settlement, install an overlay, change nothing, and pay again eighteen months later.

Where this is heading

Three developments are worth watching.

The first is the public-sector compliance dates, now April 26, 2027 and April 26, 2028 under the DOJ's Title II rule, and May 11, 2027 and May 10, 2028 under the HHS Section 504 rule. As public entities and federally funded health and social-service providers come under a firm technical standard, expect the plaintiffs' bar to shift some attention toward defendants where the obligation is explicit, and expect the WCAG 2.1 Level AA benchmark to become even harder for private defendants to contest. Both extensions were issued as interim final rules with post-publication comment periods, so watch for further changes.

The second is state legislative activity in both directions. Some states are expanding remedies. Others are considering or adopting pre-suit notice and cure periods designed to reduce filing volume, with Missouri's 2026 abusive-litigation statute the most aggressive example so far. The patchwork is getting more complicated, not less, and for a business selling nationally that means exposure is increasingly determined by customer geography.

The third is the standing question the Supreme Court left open in Acheson. The next tester case to reach the Court with a live controversy could reshape the economics of serial filing overnight, in either direction.

What is not going to happen anytime soon is a federal regulation telling private businesses exactly what to do. Title III rulemaking has been promised and abandoned repeatedly across administrations. Plan for the current framework to persist.

If you have a letter in front of you

The first week is worth handling deliberately: preserve the evidence, learn who is on the other side, get the audit structured correctly, and check your insurance. Then decide whether this is a matter to resolve or a matter to fight, with the actual technical facts in hand rather than a guess.

This is the kind of matter I handle, and the engineering background is usually the reason clients call. Being able to read the code, evaluate whether the allegations are accurate, and tell a development team specifically what to change tends to produce faster and cheaper outcomes than routing everything through a consultant as an intermediary.

If you do not have a letter and you are reading this because something made you nervous, the checklist above is a free hour that may save you a great deal more than that.

Takeaways

• Title III reaches websites in every circuit at least through the nexus test; whether it reaches online-only businesses depends on where you are sued.
• WCAG 2.1 Level AA is the working standard, reinforced by the DOJ and HHS rules even though neither binds private businesses. Build to 2.2 if you are rebuilding.
• The ADA gives private plaintiffs injunctions and fees; state laws such as Unruh supply the damages. Customer geography drives exposure.
• Four code failures (mouse-only controls, menus, modals, and checkout forms) generate most claims, and native HTML fixes most of them.
• In the first week: preserve, investigate the sender, audit through counsel, and tender to insurers. Do not start uncoordinated fixes.
• Mootness can end the federal claim if the fix is complete, documented, and durable, but it does not erase accrued state damages.
• Overlays do not work, invite targeting, and are now the subject of FTC enforcement.
• Settlement without remediation buys one release. A site that passes is the only durable defense.

This article is general information about the law, current as of the date of last modification. It is not legal advice, and reading it does not create an attorney-client relationship. Accessibility law is unsettled and varies by jurisdiction; the right answer for your business depends on facts this article cannot know. Consult a licensed attorney about your specific situation.

Related Documents

Related Articles

• Website and Mobile App Accessibility Under the ADA: WCAG, Litigation Risk, and Remediation: the broader survey, including Section 508 procurement and adjacent statutes.
• Disability Rights in Everyday Life: The ADA, Service Animals, and Accessible Housing: the ADA's structure beyond the web.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the doctrine behind tester-standing challenges.
• Settlement Negotiation Tactics: Principled Negotiation, Anchoring, and Handling Hardball in Litigation: how to negotiate against a fee-driven demand.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: preserving site versions and logs.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: the foundation for a privileged audit.

Related Guides

• Responding to a Website Accessibility Demand Letter or Lawsuit: A Practical Guide: the step-by-step response sequence, for defendants and their counsel.
• Pleading and Attacking Standing in Federal Court: A Practical Guide: Rule 12(b)(1) motions against serial plaintiffs.
• Drafting a Settlement Agreement and Release: A Practical Guide: general release drafting.
• Requesting Disability Accommodations and Enforcing Access Rights: A Practical Guide: the same law from the user's side.

Related Checklists

• Website Accessibility Self-Audit Checklist: A Practical Checklist: the expanded version of Part Eight.
• Website Accessibility Remediation Checklist: A Practical Checklist: remediation and governance after an audit.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: the first-day preservation tasks.

Related Toolkits

• Website Accessibility Defense Toolkit: Demand Responses, Privileged Audit Engagements, and Remediation Records: response letters, the privileged audit engagement, remediation logs, and settlement terms.
• Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing: briefing a standing or mootness motion.
• Settlement Toolkit: Term Sheets, Releases, Offers of Judgment, and Enforcement: term sheets and Rule 68 offers.