DigitalBlake

← All Articles

Web Accessibility Standards and Law: WCAG 2.1 and 2.2, the European Accessibility Act, and US Requirements

Posted: By Blake Cerecero

There are two layers to web accessibility. One is a standard, the other is a law. The standard is the Web Content Accessibility Guidelines (WCAG), and the law differs by territory and over time. The standard is relatively stable and is updated by standards bodies, whereas the law is a moving target.

Two of those movements make 2026 a useful point to take stock. The European Accessibility Act became applicable on June 28, 2025, extending accessibility requirements to a large part of the private sector across the EU. In the United States, the Department of Justice finalized a rule in 2024 that binds state and local governments to WCAG 2.1 Level AA, with compliance dates now landing in 2027 and 2028. This article is the standards and legal reference: what applies to whom, and to which version of WCAG. The developer side, how you actually test a site against these criteria with tooling, manual review, and AI, is covered in a companion article.

Web Content Accessibility Guidelines (WCAG)

WCAG is published by the World Wide Web Consortium through its Web Accessibility Initiative. It is the reference every accessibility law below points to, either directly or through a regional standard.

Conformance levels

WCAG groups its success criteria into three conformance levels:

  • Level A is the minimum. Failing it tends to make content unusable for some people.
  • Level AA is the level nearly every law adopts. It covers the common barriers: color contrast, text resizing, keyboard operation, form labels, and error identification.
  • Level AAA is the strictest and is not expected as a blanket requirement, because some content cannot meet all of it.

When a regulation says “WCAG 2.1 AA,” it means every Level A and Level AA success criterion in that version.

Versions: 2.0, 2.1, and 2.2

WCAG uses point releases that are backward compatible. Meeting a later version means you also meet the earlier ones.

  • WCAG 2.0 was published on December 11, 2008.
  • WCAG 2.1 was published on June 5, 2018 and added 17 success criteria over 2.0, largely covering mobile, low vision, and cognitive needs.
  • WCAG 2.2 was published on October 5, 2023 and adds nine success criteria over 2.1. It was also adopted as the international standard ISO/IEC 40500:2025.

Most laws still cite WCAG 2.1 AA. WCAG 2.2 AA is the direction regional standards are moving toward, so it is the sensible target for new work.

What WCAG 2.2 adds (as of October 5, 2023)

WCAG 2.2 adds nine new success criteria:

WCAG 2.2 also removed the old 4.1.1 Parsing criterion, which is now obsolete. For what these criteria look like in code, with passing and failing examples, see the companion article on testing.

The European Accessibility Act

The European Accessibility Act (EAA) is Directive (EU) 2019/882, adopted on April 17, 2019. It became applicable on June 28, 2025. Its purpose is to harmonize accessibility requirements across member states so that covered products and services move freely within the single market.

The scope reaches a defined set of private-sector products and services: computers and operating systems, smartphones, payment terminals and self-service machines such as ATMs and ticketing kiosks, e-commerce, consumer banking, electronic communications, e-books, and elements of passenger transport services. The EAA complements the earlier Web Accessibility Directive (EU) 2016/2102, which already covered public-sector websites and apps.

The obligation follows the market where a product or service is sold. A business established outside the EU that places a covered product or service on the EU market falls within scope.

The technical benchmark is the harmonized standard EN 301 549. Its published version, V3.2.1 (2021-03), incorporates WCAG 2.1 Level AA for web content. A draft V4.1.0 (2025-11) moves the standard toward WCAG 2.2 Level AA. Conforming to EN 301 549 is the accepted way to show conformity with the directive’s requirements, with the formal harmonized-standard citation for the EAA still being finalized through the V4.x revision. It is the practical thing to build against.

A few boundaries matter for planning:

  • Microenterprises that provide services and have fewer than 10 employees and annual turnover under 2 million euros are exempt from the service obligations.
  • Existing service contracts agreed before June 28, 2025 may continue until they expire, and no later than June 28, 2030.
  • Penalties are set by each member state in national law, so the specific fines and enforcement steps vary across the EU.

Accessibility law in the United States

There is no single US web accessibility statute. Different laws cover different entities, and they reference different WCAG versions.

ADA Title II: state and local government

In 2024 the Department of Justice finalized a rule under Title II of the Americans with Disabilities Act requiring state and local governments to make their web content and mobile apps conform to WCAG 2.1 Level AA. The rule was published on April 24, 2024. Compliance dates depend on population, and an April 2026 interim final rule set them as follows: entities serving 50,000 or more people must comply by April 26, 2027, and smaller entities and special districts by April 26, 2028. The scope is broad, covering websites, mobile apps, online forms, documents, and third-party platforms used to deliver government services.

The rule and its WCAG 2.1 Level AA standard remain in effect. The current administration’s DOJ has not rescinded it; its actions so far are the deadline extension above and a September 2025 regulatory notice signaling a possible future rulemaking to revisit some requirements. No such proposed rule had been published as of this writing, so WCAG 2.1 Level AA is still the operative standard.

Section 508: federal agencies

Section 508 of the Rehabilitation Act covers information and communications technology that federal agencies develop, procure, maintain, or use, which in practice reaches the contractors and vendors that sell to them. The Revised 508 Standards incorporate WCAG 2.0 Level AA and have been in effect since January 18, 2018. This leaves a version gap: federal agencies sit on WCAG 2.0 while the newer Title II rule for state and local government uses WCAG 2.1. A refresh toward a newer WCAG version has been discussed but is not yet adopted.

Section 504: recipients of HHS funding

Section 504 of the Rehabilitation Act bars disability discrimination by programs that receive federal financial assistance. In May 2024 the Department of Health and Human Services finalized a rule setting WCAG 2.1 Level AA as the standard for the web content and mobile apps of entities that receive HHS funding, which reaches most hospitals, health centers, physician practices, and human services programs. The rule took effect July 8, 2024. After a 2026 extension, recipients with 15 or more employees must comply by May 11, 2027, and smaller recipients by May 11, 2028. The extension moved only the dates; WCAG 2.1 Level AA remains the required standard.

ADA Title III: private accommodations

Title III of the ADA covers private businesses that are public accommodations. There is no regulation setting a specific web technical standard for them. Enforcement runs through litigation, and courts and settlements commonly treat WCAG 2.1 Level AA as the practical benchmark. For a private business, the absence of a codified standard does not remove the exposure.

California

California adds real teeth for private businesses through the Unruh Civil Rights Act (California Civil Code section 51), which incorporates the ADA. An ADA website violation is therefore also an Unruh violation, and Unruh carries statutory damages of 4,000 dollars per violation plus attorney fees. The exposure is clearest for a business with a physical presence or other nexus in California. How far it reaches a purely online, out-of-state business is unsettled: in Martinez v. Cot’n Wash (2022), the California Court of Appeal held that a website-only business with no physical location is not a place of public accommodation under the ADA, and so not liable under the Unruh Act, bringing California in line with the Ninth Circuit. That question is still up in the air, but a business with any California footprint should treat WCAG 2.1 AA as the expectation.

A proposed bill, AB 1757 (2023 to 2024 session), would have written WCAG 2.1 AA into California law with a private right of action. It did not pass; the official legislative record lists it as an inactive bill that died in committee. Some accessibility vendors state that it took effect; that is incorrect. Liability today still flows through the Unruh Act’s incorporation of the ADA.

For California state agencies, a separate framework applies. Government Code sections 11135 and 7405 set nondiscrimination and ICT accessibility obligations tied historically to Section 508, and Government Code section 11546.7 (from AB 434) requires executive-branch agencies to certify, on a signed biennial certification, that their sites conform to WCAG 2.0 Level AA or later.

How the standards and the laws line up

Law or rule Who it covers WCAG version Key date
European Accessibility Act Private-sector products/services in the EU 2.1 AA (via EN 301 549) Applies Jun 28, 2025
ADA Title II US state and local government 2.1 AA Apr 26, 2027 / Apr 26, 2028 by size
Section 508 US federal agencies and contractors 2.0 AA In effect since Jan 18, 2018
Section 504 (HHS) Recipients of HHS federal funding 2.1 AA May 11, 2027 / May 11, 2028 by size
ADA Title III US private accommodations No codified standard (2.1 AA in practice) No fixed date; litigation-driven
California Unruh Act / ADA Businesses doing business in California 2.1 AA in practice In effect; $4,000 per violation
California Gov. Code 11546.7 / AB 434 California executive-branch agencies 2.0 AA or later Biennial certification

The table above is your reference guide for where things stand today.

What this means in practice

For most teams, WCAG 2.1 Level AA is the baseline to build and test against. It satisfies the EAA through EN 301 549 and the US Title II rule today, and it is the practical benchmark courts apply under ADA Title III and the Unruh Act. WCAG 2.2 Level AA is the forward-looking target, since EN 301 549 is moving to it and meeting 2.2 also meets 2.1. Section 508’s WCAG 2.0 requirement is the one exception, and it is a subset of 2.1, so a site built to 2.1 AA already covers it.

Two practical notes. The EAA reaches a business through where it sells, so a US site serving EU customers is in scope even with no physical presence in the EU; California’s Unruh Act is narrower for purely online, out-of-state businesses, as noted above. The compliance dates are staggered, so the relevant deadline depends on which law applies to the specific site.

Regardless of which legal jurisdiction applies to you, the target standard is the same in most cases. How you actually reach it, the tooling, automated testing, manual review, and where AI now fits, is the subject of the companion article: Testing for WCAG Conformance.

References

Looking for a senior developer? I'm open to new opportunities (opens in a new tab) or send an email .

Related Posts