The 'Mandatory' Myth in Web Accessibility — ADA, EAA & WCAG (US/EU)

Written: 2026-06 / Jurisdiction focus: United States & EU (Japan is covered in the Japanese edition) / last_updated: 2026-06-20 Changelog: 2026-06-04 first published as an international (US/EU) edition / 2026-06-20 added glossary entries (web accessibility, ADA, HHS) and a microenterprise threshold gloss

About this series: part of YATA-NODE's "rights basics" series. The hub is the pre-ship rights checklist; related pieces are how to read AI service terms (the contract side of the AI you use) and how "AI regulation" is not one law (a map of which rules bite in which jurisdiction). Each piece stands on its own (no required reading order).

A few terms (for newcomers):

• Web accessibility: making a website's information and functions usable by everyone, including older people and people with disabilities (and the degree to which it is). WCAG (below) is a common technical yardstick, but "improving accessibility" does not mean "blanket conformance to one fixed standard." This article maps which parts are legal duties and which are merely advisable.
• WCAG: the Web Content Accessibility Guidelines, an international technical guideline for web content published by the W3C. The latest Recommendation is WCAG 2.2 (published 2023-10; 2.0 and 2.1 also remain Recommendations). It is guidance, not a law in itself.
• Conformance levels A / AA / AAA: WCAG's three tiers, A being the minimum and AAA the highest. In practice AA is the commonly cited reference level — but it is not a legal baseline imposed on the private sector at large.
• ADA (Americans with Disabilities Act) — Title II vs. Title III: the ADA is the 1990 US federal law prohibiting disability discrimination. Title II covers state and local government, while Title III covers private public accommodations (businesses open to the public). They are treated very differently for web technical standards. (Whether Title III reaches a website turns largely on its connection — "nexus" — to the goods and services of a physical place of business; how far it reaches online-only operations still varies by circuit.)
• Section 508: a US rule requiring federal agencies (only) to meet referenced accessibility standards (WCAG 2.0 A/AA). It does not reach the private sector as direct regulation (though federal procurement contracts routinely flow 508-based requirements down to private vendors as a contractual obligation).
• HHS (U.S. Department of Health and Human Services): the US federal department for health and welfare. It issues the Section 504 rule that ties a direct WCAG duty to recipients of HHS federal funding (private hospitals and health centers included) — see the US section.
• EAA (European Accessibility Act): EU Directive 2019/882, which sets accessibility requirements for an enumerated set of products and services (not "all websites"), with an exemption for service providers that are microenterprises (in EU terms, fewer than 10 employees and annual turnover or balance-sheet total of €2 million or less).
• Harmonised standard / EN 301 549: a European standard; conforming to a harmonised standard once its reference is published in the OJEU gives a presumption of meeting the legal requirements (for the EAA specifically, the EAA-aligned citation was still being finalised around the application date — see the EU section). It is built on WCAG but is not the same as a direct WCAG mandate in the statute.

"Is web accessibility now mandatory, and does it reach my site?" — the honest answer is more nuanced than the headline. What follows is the accurate line: neither "it's all required now" nor "individuals are off the hook."

The accurate scope of "it's now mandatory" — what is actually required vs. blanket WCAG

Start with the conclusion. In the United States, the duty itself is real, but the technical standard is not. Under Title III, the ADA reaches the web-delivered goods and services of public-accommodation businesses — most clearly where a site connects to a physical place of business, while its reach to online-only operations is still unsettled and varies by circuit — yet there is no binding federal rule that says "your website must meet WCAG level AA." The frequent claim that "WCAG conformance is now mandatory for everyone" mistakes a non-existent technical mandate for the real, narrower duty. This gap between "a duty exists" and "a specific technical standard is required" is the heart of the misconception.

What is mandated is the duty of access, not a fixed technical spec

The US Department of Justice's position is that the ADA applies to the goods and services of a business, including its website — but DOJ has not adopted a specific web technical standard as a binding regulation for private businesses. WCAG is described as "helpful guidance," leaving flexibility in how you achieve access. So the operative rule for the private sector is a duty of accessibility, not a command to conform to "WCAG level AA."

In other words, "WCAG (a technical spec) is now required by law" mistakes the object of the duty. What the law requires of a private business is access; the specific deliverable spec of your site is not fixed by a federal standard.

Government is the exception that proves the rule

Where WCAG is directly required, it is for government — plus one funding-conditioned carve-out for federally funded entities in the health sector:

• Title II (state & local government): DOJ's 2024 final rule requires conformance to WCAG 2.1 level AA. This is a government obligation; it does not reach private businesses.
• Section 508 (federal agencies): applies only to federal agencies, referencing WCAG 2.0 A and AA. Again, not the private sector.
• Section 504 (recipients of HHS federal financial assistance): a separate track, and the one place a direct WCAG duty reaches private entities. HHS's 2024 rule (45 CFR §84.84) requires WCAG 2.1 AA of organizations that receive HHS funding — including private hospitals, community health centers, and Medicare/Medicaid participants. It is a direct WCAG mandate, but it is conditioned on accepting federal funds in one sector, not a blanket rule for all private sites (a 2026 interim final rule extended the deadlines — see the June 2026 box).

This is the decisive contrast. The same word — "mandatory" — describes two different things: a binding technical standard for government, and a binding duty of access (with no fixed technical standard) for the private sector. Conflating them is what produces the headline myth.

Common claims and the accurate scope (a quick check)

Because this topic is so widely mis-stated, here is a table for not believing the framing at face value. When you see a claim on the left, re-read it as the scope on the right.

This table does not mean "you can ignore accessibility." The duty of access is real, and accessibility is good practice regardless. The point is to hold the accurate middle line — neither "nothing required" nor "all of WCAG AA, mandatory for everyone."

How other jurisdictions differ and where WCAG sits — no blanket private-sector mandate in these major jurisdictions

A common line is "the US and the EU already mandate web accessibility across the board, so it's only a matter of time everywhere." But blanket, direct WCAG conformance for private-sector sites does not exist in the three major jurisdictions this article covers (US / EU / Japan). (Some subnational regimes do go further — Ontario's AODA, for instance, requires WCAG 2.0 AA on the public websites of larger private and non-profit organisations — but that is outside this article's US/EU/Japan focus.) The places that do mandate WCAG directly are government rules — and that two-layer structure (a binding duty for the private sector, a binding standard for government) repeats across them. Let's walk through it.

Where WCAG itself sits (a quick framing)

• WCAG is the W3C's technical guideline for web content. Versions are backward-compatible and additive; the latest Recommendation is WCAG 2.2 (published 2023-10). It is guidance, not law.
• Conformance is judged at levels A / AA / AAA. AA is the level most often referenced in practice and in government rules — but referencing it does not make it a private-sector legal baseline.

United States — the ADA: private (Title III) has no technical standard; government (Title II / 508) does

The US ADA treats private businesses (Title III) and government (Title II) very differently.

• Title III (private = public accommodations): DOJ takes the position that the ADA applies to a business's web-delivered goods and services, but it has not adopted a specific binding web technical standard. WCAG is "helpful guidance," and the practical rules develop through case law. The leading example is Robles v. Domino's Pizza (9th Cir. 2019, 913 F.3d 898). The Ninth Circuit held that ADA Title III applies to Domino's website and app because their inaccessibility impeded access to the goods and services of its physical pizza franchises (the "nexus" to a physical place was critical to the holding) — but it did not command which technical standard (WCAG, etc.) to follow, and it expressly left open how the ADA applies to sites with no such physical-location nexus (the Supreme Court declined to hear the appeal, leaving it in place). So the state of play is "the ADA reaches you, but the technical bar is unsettled — and the reach of online-only sites varies by circuit."
• Title II (state & local government): DOJ's 2024 final rule requires WCAG 2.1 level AA. This is a government rule and does not reach private businesses.
• Section 508 (federal agencies): covers federal agencies only, referencing WCAG 2.0 A and AA. Not the private sector.

→ The US is a two-layer structure: WCAG is mandated for government (Title II / Section 508), while the private sector (Title III) is governed case by case with no settled technical bar — with one funding-conditioned exception, Section 504, that does impose WCAG 2.1 AA directly on private recipients of HHS financial assistance (hospitals, health centers). The mistake is to read the government layer as if it applied to every private site.

European Union — the EAA: an enumerated private-sector duty, not a direct WCAG mandate

Europe has two strands of web-accessibility regulation.

• EAA (European Accessibility Act = Directive (EU) 2019/882): aimed at the private sector, but its scope is not "all websites" — it is an enumerated list of products and services (computers and operating systems, ATMs and ticketing machines, smartphones, e-books, e-commerce, banking services, passenger transport services, and so on). It became applicable on 2025-06-28, and services provided by microenterprises (fewer than 10 employees and annual turnover or balance-sheet total of €2 million or less) are exempt. Importantly, Article 32 sets time-limited transitional measures — service contracts agreed before 28 June 2025 may continue until they expire but no longer than five years from that date (to 28 June 2030 at the latest), and services relying on products lawfully used before that date may continue using them until 28 June 2030 (and self-service terminals such as ATMs and ticketing machines lawfully in use before that date may keep running to the end of their economic life, up to 20 years from entry into use) — so this is not a blanket five-year grace for all existing services. Conformance is built toward a presumption-of-conformity framework via harmonised standards, with EN 301 549 the widely used / expected benchmark (its OJEU citation specific to the EAA was still being finalised around the 2025 application date — confirm the current status), rather than the statute mandating WCAG directly (the harmonised standard is based on WCAG but can include requirements beyond it).
• WAD (Web Accessibility Directive = Directive (EU) 2016/2102): this one is for public-sector bodies, requiring conformance via the harmonised standard EN 301 549. Its scope is entirely different from the EAA's.

→ Even in the EU, what falls on the private sector is an accessibility duty over an enumerated list, not a blanket WCAG mandate over all websites. For a solo or side-project developer, it becomes relevant only when you offer an in-scope service (e-commerce, e-books, banking, etc.) into the EU.

Another jurisdiction in brief — Japan

For contrast: in Japan, what became mandatory (April 2024) for private operators is the duty to provide "reasonable accommodation" — not blanket WCAG conformance. Improving web accessibility (WCAG/JIS) is classified as "developing the environment," an effort obligation, not a hard duty. So Japan, too, fits the pattern: a duty for the private sector, with no blanket WCAG mandate. The full Japanese-law treatment (reasonable accommodation vs. environmental improvement, scope for sole proprietors, the minimum baseline) is in the Japanese edition.

The cross-jurisdiction takeaway: the US (private = case-law based, technical bar unsettled), the EU (an enumerated list + microenterprise exemption + Article 32's time-limited transition), and Japan (a reasonable-accommodation duty) all decline to impose blanket, direct WCAG conformance on private-sector sites. WCAG is mandated for government — directly in the US (Title II / Section 508), with a narrow funding-conditioned exception for private recipients of HHS assistance (Section 504) — and via the harmonised standard EN 301 549 in the EU's WAD. "It's universal abroad, so it will be here" is not accurate.

How far it reaches your own site — a self-check flow

Now apply the scope above to your own site. The trick is not to think in country-by-country yes/no terms, but to sort by attribute, in order.

"I'm an individual, so it doesn't apply" is wrong — but scale is weighed

First, the point most people get backwards. Whether you are in scope as a "business operator" does not turn on being a company. If you operate a website as a business — repeatedly and continuously, with a commercial character — a sole proprietor can be in scope too. "I'm an individual, so it doesn't apply" is wrong.

That said, you don't need to over-prepare. Where a jurisdiction limits the duty by proportionality — the ADA's "undue burden," the EAA's "disproportionate burden," Japan's "undue burden" — business scale, financial resources, and feasibility are part of the analysis. In practice, scale is a real cushion for individuals and small operators. But "because I'm small" is not a blanket excuse to refuse access; the expectation is a constructive look at alternatives (information by another route, etc.).

The self-check flow (apply in order)

1. Business character: do you run the site as a business — repeatedly and continuously, with a commercial character? → No (a purely hobby/personal site) and you are unlikely to be the direct addressee of a private-sector accessibility duty. Yes → go to 2.
2. A specific request for access: has a user with a disability made a concrete request? Note first that Title III's general duty of access already covers a public accommodation's web-delivered goods and services regardless of any request (as set out in the scope section above) — a concrete request additionally sharpens the interactive layer: in the US, Title III's duty of effective communication (reasonable modifications and auxiliary aids and services); in Japan, the reasonable-accommodation moment. Weigh proportionality and look at alternatives through constructive dialogue (an individual route — email, phone, an alternate channel — can be a realistic line before a full technical retrofit of the site).
3. EU in-scope service: do you offer an in-scope EAA service (e-commerce, banking, e-books, etc.) into the EU? → Yes → the EAA (previous section) is in play. A purely domestic site that doesn't serve the EU is generally not reached.
4. Even if little of the above applies: improving information accessibility (the minimum baseline in the next section) is worth starting — it is good practice everywhere and reduces the friction of any future request.

Drawing the line between a pure hobby site and a business site

A pure hobby / non-commercial personal site (no ads, no products, no commercial character) is unlikely to be the direct addressee of a private-sector duty, while a site with a commercial character (ad revenue, product sales, orders, paid services) can be in scope as a business. But whether a site has "business character," and where the line of "disproportionate / undue burden" falls, is an individual determination — when in doubt, it's a question for a lawyer (this article stops at helping you triage).

Summary — a minimum 5-item baseline and role-based checklists

"Meet all of WCAG AA" can be disproportionate for an individual or a small operator; "do nothing" sits poorly with both the duty of access and good practice. As the middle ground, here is a minimum 5-item baseline that costs almost nothing and does a lot of the work, mapped to WCAG's four principles. This is not a guarantee that "this alone makes you legally safe" — it is a starting point.

1. Alternative text (alt): give informative images alt text; use empty alt (alt="") for purely decorative ones. Screen-reader users can't see the image itself, so without alt the information is simply lost (Perceivable).
2. Contrast ratio: keep enough contrast between text and background. WCAG 2.2 success criterion 1.4.3 (level AA) asks for 4.5:1 for normal text and 3:1 for large text (18pt, or 14pt bold, and above). Light-gray text fails for low-vision, older, and outdoor readers (Perceivable).
3. Keyboard operation: every function (links, forms, menus) should work without a mouse, with a visible focus indicator. Killing the focus ring with outline:none is a classic trap (Operable).
4. Heading structure: nest h1→h2→h3 by meaning, without skipping levels just for looks. Assistive tech uses headings to grasp page structure and jump around; if you only want bigger text, style it with CSS instead of misusing headings (Understandable / Robust).
5. Form labels: associate a label with each input (for/id, or nesting) so assistive tech can announce what the field is for. Placeholder-only fields lose their description on focus, leaving the user unsure what to type (Perceivable / Understandable).

The checklist below sorts "what to do next" by role. Paste it into a dev note or an internal review sheet. You don't need a "yes" on every line — pick what fits your situation.

[Solo / side-project builder]
□ 1. Understood that what's mandated is a duty of access, not blanket WCAG conformance (don't over-read the headline)
□ 2. Checked whether my site has a commercial character (if it does, the duty of access can apply — individuals included)
□ 3. Started the minimum 5 items (1.alt 2.contrast 4.5:1/large 3:1 3.keyboard + visible focus 4.heading structure 5.form labels)
□ 4. Checked whether I offer an EU in-scope service (e-commerce / e-books / banking) — if so, look into the EAA
□ 5. Prepared an alternative channel (email / phone / another route) for when a specific access request comes in

[Company web team]
□ 1. Can explain internally the difference between "a duty of access (binding)" and "a fixed technical standard (only for government)"
□ 2. If we sell to or serve government, confirmed the applicable WCAG conformance level (Title II AA / Section 508; government procurement) as a separate track
□ 3. Built the minimum 5 items into our implementation guidelines (with WCAG 2.2 AA stated as the target level)
□ 4. Sorted out whether we have EU customers / in-scope services, and whether the microenterprise exemption or the Article 32 transitional measures apply
□ 5. Set up a process for handling individual access requests (constructive dialogue, alternatives, records)
□ 6. Stopped taking an agency's "all of WCAG AA, mandatory" sales pitch at face value, and confirm the actual scope

The axis has three parts. ① The accurate scope of "mandatory" (a duty of access is binding; a fixed WCAG standard is required only of government, not the private sector at large). ② Other jurisdictions fit the same pattern (neither the US nor the EU imposes blanket WCAG on the private sector; direct WCAG mandates are government-centric — with one narrow funding-conditioned exception, Section 504 / HHS, reaching private recipients of HHS financial assistance). ③ Individuals can be in scope as business operators, but scale is weighed via proportionality (the accurate middle line — neither over-reading nor complacency).

From here, the line of whether a specific request is a "disproportionate / undue burden," or whether a specific site is non-compliant, is beyond this article's scope. When in doubt, consult a qualified attorney / your legal department. The whole rights picture is fastest to navigate from the pre-ship rights checklist hub.

References

Primary materials where available. A trailing (primary) marks a primary source (statute / regulation / official guidance / court opinion); (supporting) marks a docket or commentary used to locate primaries. All sources reflect verification as of 2026-06; fast-moving deadlines and draft statuses should be re-confirmed when you act.

United States (primary — government / case law)

• ADA.gov — Guidance on Web Accessibility and the ADA(primary — Title III: no binding technical standard; WCAG = helpful guidance)
• ADA.gov — Fact Sheet: New Rule on the Accessibility of Web Content (State & Local Governments)(primary — Title II: WCAG 2.1 AA / deadlines)
• U.S. Access Board — Information and Communication Technology (Section 508)(primary — federal agencies only; WCAG 2.0 A/AA referenced)
• 45 CFR §84.84 — Requirements for web and mobile accessibility (HHS Section 504 rule)(primary — WCAG 2.1 AA required of recipients of HHS federal financial assistance, private hospitals/health centers included; a 2026 interim final rule extended deadlines to 2027-05-11 / 2028-05-10)
• Robles v. Domino's Pizza, 913 F.3d 898 (9th Cir. 2019) — opinion(primary — court opinion; Title III applies, technical standard not commanded)
• 42 U.S.C. §12182 — Prohibition of discrimination by public accommodations (Title III)(primary — statutory text; operative terms are reasonable modifications / auxiliary aids and services, not "reasonable accommodation")
• 28 CFR Part 36 — ADA Title III regulations (DOJ)(primary — implementing regulation)

European Union (primary — statutes / official)

• European Commission — European Accessibility Act (EAA)(primary — Directive 2019/882; enumerated products/services)
• EUR-Lex — Directive (EU) 2019/882 (full text, CELEX:32019L0882)(primary — applicable 2025-06-28 / microenterprise exemption / Art. 32 up-to-5-year transition for existing services)
• EUR-Lex — Directive (EU) 2016/2102 (Web Accessibility Directive, public-sector bodies)(primary)
• European Commission — Web Accessibility Directive: standards and harmonisation (EN 301 549)(primary)

International WCAG (primary — standards body)

• W3C WAI — WCAG 2 Overview(primary — name / backward compatibility / levels A·AA·AAA / WCAG 2.2 published 2023-10)
• W3C — Understanding WCAG 2.2 (the four POUR principles; SC 1.4.3 contrast)(primary)
• W3C — WCAG 3.0 Working Draft (2026-03)(primary — draft status, not a Recommendation; supports the "still a draft" point)

Japan (supporting for this edition — covered fully in the Japanese edition)

• Cabinet Office — Promotion of the Elimination of Discrimination against Persons with Disabilities(primary — reasonable-accommodation duty mandatory for private operators from 2024-04-01)

On AI assistance: starting from points the author already knew, the author used LLMs (Claude by Anthropic, with a second, independent model cross-checking the legal facts) to research, organize, and summarize, then verified the facts against the primary sources cited above and revised accordingly. Accessibility rules and effective dates change, so fast-moving points (deadlines, draft statuses) should be re-confirmed against the primary sources at the time of use. For the "not legal advice" note and what is out of scope, see the disclaimer at the top.

About the author

More than 20 years of electrical and software development — from control engineering at a major electronics manufacturer — plus about 10 years of solo development. Across hardware and software, and across enterprise and individual work, I publish the basics that "become a risk if you don't know them," and I plan to cover practical ways to use AI as well. More at About this blog.