DigitalBlake

← All Articles

Web Accessibility Law and WCAG: EAA, ADA, and Section 508

Posted: Updated: By Blake Cerecero

WCAG is the technical standard for web accessibility. It is published by the World Wide Web Consortium and updated on its own schedule. The laws that require accessibility are separate from it. They differ by territory, and each one names a WCAG version.

Two of those laws changed recently. The European Accessibility Act became applicable on June 28, 2025 and extended accessibility requirements to part of the private sector across the EU. In the United States, the Department of Justice finalized a rule in 2024 requiring state and local governments to meet WCAG 2.1 Level AA, and the compliance dates now fall in 2027 and 2028.

Web Content Accessibility Guidelines (WCAG)

WCAG is published by the World Wide Web Consortium through its Web Accessibility Initiative. Every law below points to it, either directly or through a regional standard.

Conformance levels

WCAG sorts its success criteria into three levels, A, AA, and AAA.

  • Level A is the minimum. Content that fails it is unusable for some people.
  • Level AA is the level nearly every law adopts. It includes the criteria for color contrast, text resizing, keyboard operation, form labels, and error identification.
  • Level AAA is the strictest. No law requires it across a whole site, because some content cannot meet all of it.

When a regulation says “WCAG 2.1 AA,” it means every Level A and Level AA success criterion in that version.

Versions: 2.0, 2.1, and 2.2

WCAG point releases are backward compatible. Meeting a later version means you also meet the earlier ones.

  • WCAG 2.0 was published on December 11, 2008.
  • WCAG 2.1 was published on June 5, 2018 and added 17 success criteria over 2.0, covering mobile, low vision, and cognitive needs.
  • WCAG 2.2 was published on October 5, 2023 and added nine success criteria over 2.1. It is also the ISO standard ISO/IEC 40500:2025.

Most laws still name WCAG 2.1 AA. The EU’s EN 301 549 moves to WCAG 2.2 AA in its next version, so new work should target 2.2.

What WCAG 2.2 adds (as of October 5, 2023)

WCAG 2.2 adds nine new success criteria:

WCAG 2.2 also removed 4.1.1 Parsing, which is now obsolete. Passing and failing markup for these criteria is in the companion article on testing.

The European Accessibility Act

The European Accessibility Act (EAA) is Directive (EU) 2019/882, adopted on April 17, 2019. Member States had to publish their transposing laws by June 28, 2022 and apply them from June 28, 2025. The directive sets one set of accessibility requirements across member states so covered products and services can move within the single market.

Article 2 covers these products placed on the market after June 28, 2025:

  • consumer general purpose computer hardware and the operating systems for it
  • payment terminals
  • ATMs, ticketing machines, check-in machines, and interactive information terminals
  • consumer terminal equipment used for electronic communications services, such as smartphones
  • consumer terminal equipment used to access audiovisual media services
  • e-readers

It covers these services provided to consumers after June 28, 2025:

  • electronic communications services
  • services providing access to audiovisual media services
  • websites, mobile apps, electronic tickets, and travel information for air, bus, rail, and waterborne passenger transport
  • consumer banking services
  • e-books and dedicated software
  • e-commerce services

The Web Accessibility Directive (EU) 2016/2102 already covered public-sector websites and apps.

The directive defines a service provider as any natural or legal person who provides a service on the Union market or makes offers to provide such a service to consumers in the Union. It does not require the provider to be established in the EU, so a business outside the EU that sells a covered service to consumers in the EU is in scope.

The technical benchmark is the harmonized standard EN 301 549. The published version, V3.2.1 (2021-03), builds its web clause on WCAG 2.1, with the Level A and Level AA criteria normative and the Level AAA criteria informative. Draft V4.1.0 (2025-11) moves that clause to WCAG 2.2 and adds an Annex ZB mapping the standard to the requirements of Directive 2019/882. That draft ran through the ETSI approval process from November 13, 2025 to February 11, 2026, so the formal harmonized-standard citation for the EAA is still being finalized. Conforming to EN 301 549 is the accepted way to show conformity with the directive’s requirements.

Three limits on the scope:

  • Microenterprises that provide services are exempt from the service accessibility requirements. The directive defines a microenterprise as one that employs fewer than 10 people and has an annual turnover of 2 million euros or less, or an annual balance sheet total of 2 million euros or less.
  • Existing service contracts agreed before June 28, 2025 may continue without alteration until they expire, and no longer than five years from that date, which is June 28, 2030.
  • Penalties are set by each member state in national law. The directive only requires that they be effective, proportionate, and dissuasive, so the fines and enforcement steps vary across the EU.

Accessibility law in the United States

There is no single US web accessibility statute. Different laws cover different entities, and they name different WCAG versions.

ADA Title II: state and local government

In 2024 the Department of Justice finalized a rule under Title II of the Americans with Disabilities Act requiring state and local governments to make their web content and mobile apps meet WCAG 2.1 Level AA. The rule was published on April 24, 2024. An interim final rule published on April 20, 2026 extended the compliance dates. Entities with a total population of 50,000 or more must comply by April 26, 2027, and entities with a total population under 50,000 and special district governments by April 26, 2028. The rule covers websites, mobile apps, and documents such as word processing files, presentations, PDFs, and spreadsheets, with exceptions for archived content, preexisting documents, and third-party posts.

The WCAG 2.1 Level AA standard is still in effect. In the regulatory agenda it published on September 22, 2025, the Department of Justice said it plans to publish a Notice of Proposed Rulemaking to reconsider whether some of the provisions of the April 24, 2024 rule could be made less costly. That agenda entry lists the NPRM date as “To Be Determined,” and no proposed rule had been published as of this writing.

Section 508: federal agencies

Section 508 of the Rehabilitation Act covers information and communications technology that federal agencies develop, procure, maintain, or use, which in practice reaches the contractors and vendors that sell to them. The Access Board issued the Revised 508 Standards on January 18, 2017, and they went into effect on January 18, 2018. They incorporate the Level A and Level AA success criteria and conformance requirements of WCAG 2.0.

Federal agencies are therefore on WCAG 2.0 while state and local governments are on WCAG 2.1 under the Title II rule.

Section 504: recipients of HHS funding

Section 504 of the Rehabilitation Act bars disability discrimination by programs that receive federal financial assistance. In May 2024 the Department of Health and Human Services finalized a rule requiring the web content and mobile apps of entities that receive HHS funding to meet the WCAG 2.1 Level A and Level AA success criteria. It was published on May 9, 2024 and took effect on July 8, 2024. An interim final rule published on May 11, 2026 extended the compliance dates. Recipients with 15 or more employees must comply by May 11, 2027, and recipients with fewer than 15 employees by May 10, 2028. The extension moved only the dates. WCAG 2.1 Level AA is still the required standard.

ADA Title III: private accommodations

Title III of the ADA covers private businesses that are public accommodations. No regulation sets a web technical standard for them. Enforcement runs through litigation, and courts and settlements commonly treat WCAG 2.1 Level AA as the benchmark.

California

The Unruh Civil Rights Act is California Civil Code section 51. It states that a violation of a person’s rights under the ADA is also a violation of section 51. Civil Code section 52 sets damages for an Unruh violation at up to three times actual damages “but in no case less than four thousand dollars ($4,000),” plus attorney’s fees the court determines.

How far the Unruh Act reaches a purely online business is limited. In Martinez v. Cot’n Wash (2022), the California Court of Appeal affirmed the dismissal of an Unruh claim over a retail website that was not compatible with screen reading software. The court held that under current law it could not read “place of public accommodation” in the ADA as including retail websites with no connection to a physical space, and that the discriminatory effect of a facially neutral website is not on its own a basis for inferring the intentional discrimination the Unruh Act otherwise requires. A business with a physical location in California should treat WCAG 2.1 AA as the expectation, since an ADA violation there is also an Unruh violation.

Assembly Bill 1757 in the 2023 to 2024 session would have written WCAG 2.1 AA into California law with a private right of action. It did not pass. The legislature’s bill status page lists it as an inactive bill that died, with a last action of “From Senate committee without further action” on November 30, 2024. Some accessibility vendors state that it took effect, which is incorrect. Liability today runs through the Unruh Act’s incorporation of the ADA.

California state agencies have a separate set of obligations. Government Code section 11135 requires programs that receive state funding to meet the protections and prohibitions of Section 202 of the ADA with respect to disability. Government Code section 7405 requires state governmental entities, and entities that contract with state or local entities, to comply with Section 508 of the federal Rehabilitation Act. Government Code section 11546.7, added by AB 434, requires each state agency director and chief information officer to post a signed certification on the agency’s website home page, before July 1, 2019 and every two years after, that the site complies with sections 7405 and 11135 and with WCAG 2.0 or a later version at a minimum of Level AA.

How the standards and the laws line up

Law or rule Who it covers WCAG version Key date
European Accessibility Act Private-sector products/services in the EU 2.1 AA (via EN 301 549) Applies Jun 28, 2025
ADA Title II US state and local government 2.1 AA Apr 26, 2027 / Apr 26, 2028 by size
Section 508 US federal agencies and contractors 2.0 AA In effect since Jan 18, 2018
Section 504 (HHS) Recipients of HHS federal funding 2.1 AA May 11, 2027 / May 10, 2028 by size
ADA Title III US private accommodations No codified standard (2.1 AA in practice) No fixed date; litigation-driven
California Unruh Act / ADA Businesses doing business in California 2.1 AA in practice In effect; $4,000 minimum damages
California Gov. Code 11546.7 / AB 434 California executive-branch agencies 2.0 AA or later Biennial certification

What this means in practice

For most teams, WCAG 2.1 Level AA is the baseline to build and test against. It satisfies the EAA through EN 301 549 V3.2.1 and the Title II rule, and it is the benchmark courts apply under ADA Title III and the Unruh Act. WCAG 2.2 Level AA is the next target, since EN 301 549 V4.1.0 moves to it and meeting 2.2 also means meeting 2.1. Section 508 requires WCAG 2.0 AA, which is a subset of 2.1, so a site built to 2.1 AA already meets it.

The EAA applies based on where a service is offered, so a US site that offers a covered service to consumers in the EU is in scope with no EU presence. The Unruh Act is narrower for a purely online, out-of-state business, per Martinez v. Cot’n Wash. The compliance dates are staggered, so the deadline that applies depends on which law covers the site.

The tooling and process for testing a site against these criteria, including automated scanners, manual review, and where AI fits, is in the companion article on Testing for WCAG Conformance.

References

Looking for a senior developer? I'm open to new opportunities (opens in a new tab) or send an email .

Related Posts