A business owner who asks whether their website is accessible is usually asking a compliance question: who checks, and against what? The uncomfortable answer is that nobody issues a certificate. No agency inspects private-sector websites, no filing makes a site officially accessible, and anyone selling an accessibility certification is selling a document with no legal standing.
What exists instead is a written standard, a written testing methodology, and a growing stack of court orders and settlements that all point at the same target. This article covers where the standard comes from, how a site is actually evaluated against it, and what holds up when a claim arrives. For who these claims are aimed at and what one costs, see ADA Website Lawsuits: Who Is Actually Being Sued.
The Standard Everyone Converges On
The Americans with Disabilities Act was signed in 1990 and never mentions websites. The Department of Justice spent years drafting web regulations for businesses, then withdrew the effort in December 2017 without issuing a rule. In March 2022 it published guidance restating that the ADA covers the websites of businesses open to the public, and that businesses have flexibility in how they meet that obligation. The guidance points to one technical reference for what accessible means in practice: the Web Content Accessibility Guidelines, known as WCAG.
WCAG is published by the World Wide Web Consortium, the standards body for the web itself. It is organized into numbered success criteria, each a specific requirement a page either meets or does not: text must reach a defined contrast ratio against its background, every function must be operable from a keyboard, every image must carry a text alternative, and so on through several dozen criteria. The current version is WCAG 2.2, published in 2023, and the conformance level nearly everyone targets is Level AA.
Everywhere the law does commit to a technical standard, it commits to WCAG. Section 508 has required WCAG 2.0 Level AA of federal agencies since 2018. In April 2024 the Department of Justice issued a rule requiring state and local government websites to meet WCAG 2.1 Level AA, the first time WCAG entered a binding federal regulation for the public web; in April 2026 the compliance dates were extended to 2027 and 2028 while the department reconsiders parts of the rule. Settlement agreements and consent decrees in private litigation routinely specify WCAG remediation. And when the long-running Robles v. Domino's case finally produced a merits ruling in 2021, the court found the company's website violated the ADA and ordered it brought into conformance with WCAG 2.0. There is no web accessibility regulation for private businesses, and there is also no real dispute about which yardstick gets used.
How Testing Actually Works
A reasonable worry is that anything beyond the automated tools must be subjective: one reviewer's taste against another's. The standard is deliberately built the other way. Each WCAG success criterion is written as a testable statement, specific enough that two knowledgeable evaluators applying it to the same page should land on the same answer. A contrast ratio is arithmetic. Keyboard operability is observable. Whether a form field has a programmatic label is a fact about the code.
The testing procedure itself is also published. WCAG-EM, the W3C's conformance evaluation methodology, defines the process end to end: define the scope, explore the site, select a representative sample of pages, evaluate every criterion on each, and document the findings. It was updated as WCAG-EM 2.0 in July 2026. A companion standard, the ACT Rules Format, standardizes how individual test rules are written so that different tools and different human testers checking the same thing produce the same result; the rule libraries inside the major automated engines are implementations of it. Human testing done to these documents is not an opinion survey. It is criterion-by-criterion measurement against published, reproducible procedures.
Automated scanners such as WAVE, axe, and Lighthouse run the subset of those checks a machine can decide. They are genuinely valuable: Deque, the company behind axe, analyzed roughly 300,000 issues across more than 2,000 audits and found 57 percent of issue instances were detectable by automation. The remainder require judgment no scanner has: whether alt text actually describes the image, whether focus moves in an order that makes sense, whether an error message tells the user what to fix. A complete evaluation combines the automated pass, a manual pass through the criteria, and testing with the assistive technology real visitors use, including keyboard-only navigation and screen readers.
What Happens When a Claim Arrives
Most demand letters arrive with an automated scan printout attached. It is worth understanding what that document is: a list of machine-detectable findings, produced in minutes, by the subset of tests that run without judgment. The errors it lists are allegations to be examined, not an adjudication. The reverse is equally true, and less comfortable: a clean scan does not establish conformance, because most of the standard is outside what the scanner can see.
In the small fraction of cases that are litigated on the merits, each side retains accessibility experts who evaluate the site against WCAG using the kind of methodology described above, and courts weigh that testimony the way they weigh any technical expert evidence. When courts order a fix, they order it in WCAG terms, as the Robles court did. No court decides these cases on a screenshot from a scanning tool.
One caution belongs here, and it echoes something the Federal Trade Commission acted on in 2025 when it barred an accessibility widget vendor from claiming its product makes websites compliant: nothing makes a website provably immune from a claim, and promises of immunity are the clearest warning sign in this market. What a business can have is something more durable than a promise. It can have a site that conforms to the standard, and records that demonstrate it: which version of WCAG was tested, when, by what method, what was found, and what was fixed. That documentation is the difference between asserting accessibility and being able to demonstrate it.
What This Means for a Business Website
- Target the real standard. Build and test to WCAG 2.2 Level AA. Claims of being ADA compliant or ADA certified have no defined meaning; conformance testing against a named WCAG version does.
- Test both ways, and keep the records. Automated scans plus the manual criterion work, with results, dates, and remediation written down as the site changes.
- Publish an accessibility statement with a working contact path. A visitor who hits a barrier should have somewhere to report it, and a business should be able to show that channel existed.
- Treat legal questions as legal questions. What a specific demand letter means for a specific business is a conversation with your attorney, and this article is not a substitute for it.
What We Manage on Your Behalf
For clients whose sites we manage, this is built into the work rather than added after:
- Designed and tested against ADA (WCAG) standards at build. Automated scanning with multiple tools plus the manual criterion checks, including computed contrast values for every text and background pair.
- Documented as we go. The standard tested against, the results, and the reasoning behind accessibility decisions are recorded for every site we build and maintain.
- Rechecked on every change. New pages, images, documents, and embedded media are reviewed as they are added, which is where conformance is usually lost.
For sites we did not build, a site audit establishes where things actually stand. Details of the ongoing work are on our management page, and if a demand letter has already arrived, let us know.
---
Sources: U.S. Department of Justice, Guidance on Web Accessibility and the ADA, March 18, 2022; Federal Register, Notice of Withdrawal of Four Previously Announced Rulemaking Actions, December 26, 2017; Federal Register, Accessibility of Web Information and Services of State and Local Government Entities, April 24, 2024, and Extension of Compliance Dates, April 20, 2026; U.S. Access Board, Information and Communication Technology Standards and Guidelines (Section 508 refresh), January 18, 2017; Robles v. Domino's Pizza LLC, summary judgment order, U.S. District Court, Central District of California, June 23, 2021; W3C, Web Content Accessibility Guidelines 2.2, WCAG Evaluation Methodology (WCAG-EM) 2.0, July 2026, and ACT Rules Format 1.1, February 2026; Deque Systems, automated testing coverage study.
Notice: provided for informational purposes only; not legal, financial, or professional advice.
Notice: The information provided in this document is for informational purposes only and does not constitute legal, financial, or professional advice. All materials and guidance offered by Generose Corporation dba Risingline are subject to its Client Services Agreement and are provided without warranty as to accuracy, completeness, or applicability to any specific situation. While Risingline takes reasonable precautions to ensure the reliability of the information presented, compliance with regulatory requirements varies based on specific circumstances, jurisdiction, and evolving standards. Recipients are encouraged to conduct independent due diligence and consult with qualified professionals before implementing any recommendations. Generose Corporation dba Risingline expressly disclaims any liability for actions taken or not taken based on this document. Receipt of this information does not establish a client, advisory, or fiduciary relationship between Risingline and the recipient.