Free Consultation
#compliance

ADA Website Compliance: What California Businesses Need to Know

September 17, 2026

Website accessibility lawsuits in federal court jumped sharply in 2025. These lawsuits accounted for 36% of all ADA Title III lawsuits filed in federal court in 2025, totaling 3,117 cases out of 8,667, up from 28% of filings in 2024. The underlying law has not changed much since 1990, but enforcement pressure and regulatory clarity around it keep growing.

ADA website compliance means designing and maintaining digital properties so people with disabilities can use them, measured against the Web Content Accessibility Guidelines (WCAG). The Americans with Disabilities Act (ADA) itself never mentions websites. The Department of Justice has not yet issued a clear technical accessibility standard through regulations under Title III of the ADA, which applies to businesses that offer goods and services to the public. Many businesses instead seek to comply with WCAG, an international standard referenced by federal and state courts interpreting Title III and state laws like California's Unruh Civil Rights Act. For state and local governments, the requirement is now explicit rather than inferred. This article covers who the ADA's web accessibility obligations reach, what WCAG actually requires, and why California businesses in particular carry added exposure through state law.

What Is ADA Compliance for Websites?

ADA compliance for a website refers to building and maintaining digital content so it does not create barriers for users with visual, auditory, cognitive, or motor disabilities. The ADA, enacted in 1990, was the first comprehensive federal civil rights law protecting the rights of individuals with disabilities. The Department of Justice (DOJ) enforces the law and has long applied it to the digital world even without a dedicated web statute. DOJ guidance explains how state and local governments covered by ADA Title II, and businesses open to the public covered by ADA Title III, can make their websites accessible to people with disabilities. For a digital team, the practical answer to "what is ADA compliance" is alignment with WCAG success criteria, since that is the yardstick regulators, courts, and settlement agreements consistently use.

Who the ADA's Web Rules Actually Apply To

Coverage splits along three tracks, and each carries different obligations.

Title II covers state and local governments. In 2024, DOJ finalized its Title II rule requiring state and local governments to make web content and mobile apps accessible consistent with WCAG 2.1, Level AA. Compliance dates have shifted: large entities must now comply by April 26, 2027, and smaller entities and special districts by April 26, 2028. The substance of the requirement did not change, only the timeline.

Title III covers private businesses open to the public. No regulation spells out a technical standard here. Courts and DOJ settlements commonly use WCAG 2.0, 2.1, or 2.2 Level AA as the benchmark for web accessibility compliance instead. Enforcement runs almost entirely through private lawsuits rather than agency action.

California layers on the Unruh Civil Rights Act. This state law predates the ADA and adds significant financial exposure. A 1992 amendment incorporated the ADA by reference, making any ADA violation, including an inaccessible website, a per-se violation of the Unruh Act. Statutory damages of at least $4,000 per violation make California one of the most litigated states for digital accessibility claims.

What Are WCAG Standards?

WCAG, or Web Content Accessibility Guidelines, is a technical framework developed to make digital content usable by people with disabilities. WCAG includes detailed technical specifications intended for web content developers, authoring tool developers, and accessibility evaluation tool developers. It has three conformance levels: A, the lowest, AA, the middle, and AAA, the highest. Level AA has become the working legal standard across nearly every context. DOJ adopted WCAG 2.1 Level AA, which requires 50 success criteria to make websites accessible. Those criteria touch far more than screen readers. Compliance includes converting images and documents so they can be read with assistive technology for individuals with vision loss, and providing captions for live and prerecorded videos for individuals with hearing loss.

ADA Compliance Requirements for Websites: The Practical Baseline

Regardless of which legal track applies, the technical work looks similar. Common priority areas include:

Plaintiff firms tend to target the same handful of issues repeatedly, often filing multiple complaints using consistent templates. These filings target detectable barriers such as missing alt text, form labeling failures, and keyboard traps. A remediation plan built around these known trouble spots addresses the bulk of both legal risk and genuine usability barriers at the same time.

Why California Businesses Face Outsized Risk

California's litigation pattern looks different from the rest of the country. Federal filings against California businesses stayed unusually low: California's federal courts had only four new website accessibility lawsuits in 2025, compared with 1,021 in New York and 961 in Florida. That low federal number does not mean California businesses are safe. It reflects where plaintiffs choose to file, since the Unruh Act's statutory damages structure and plaintiff-friendly remedies make California state courts the preferred venue and the primary driver of website accessibility litigation against private businesses operating in the state. Repeat litigation compounds the problem nationally as well. One in four lawsuits filed in 2024 involved companies that plaintiffs had already sued in the past, with repeat lawsuits representing over 40% of all cases filed that year. A single unresolved accessibility gap rarely produces a single lawsuit. It tends to produce a pattern.

Building an ADA Compliance Program

A workable accessibility program does not require solving every issue on day one. It requires a sequence that businesses can sustain over time:

Accessibility is not a one-time fix, since new content and platform updates can introduce new violations. Treating WCAG conformance as a maintained state, similar to patch management in information security, tends to hold up far better than a single remediation project followed by neglect.

Website accessibility now sits at the intersection of civil rights law, state litigation trends, and everyday product decisions. Businesses that treat WCAG conformance as a baseline operating standard, rather than a reaction to a demand letter, tend to manage both the legal exposure and the user experience question far more effectively. Working through the technical and legal layers with an experienced advisor helps translate WCAG's success criteria into a realistic, prioritized plan.

Planet 9 is a Bay Area cybersecurity consulting firm specializing in SOC 2, HIPAA, and CMMC readiness for small and medium-sized businesses in healthcare, SaaS, and technology. Our virtual Chief Information Security Officers and compliance managers help organizations choose the right approach, configure governance, risk, and compliance tools if needed, and get audit-ready without wasted time.

Book a Free Consultation

Schedule a free consultation today to explore how Planet 9 can help you achieve your security and compliance goals.
Book Free Consultation

FAQs

How does a vCISO service differ from hiring a full-time CISO?
A part-time CISO offers the same strategic oversight and expertise as a full-time CISO but on a flexible, cost-effective basis. It’s ideal for small to mid-sized businesses that need executive-level guidance without the overhead.
Is a virtual CISO service suitable for regulated industries like healthcare or finance?
Yes, virtual CISOs (or fractional CISOs) are especially valuable for industries with strict compliance requirements such as HIPAA, PCI DSS, or GLBA. They help ensure your organization meets regulatory standards and is prepared for audits.
What can I expect during a vCISO engagement?
Our vCISO service typically includes cybersecurity assessments, program development, compliance planning, incident response strategy, vendor risk management, and ongoing executive reporting tailored to your business.
How do I know if my business needs a CISO-as-a-Service?
If you lack in-house security leadership, struggle with compliance, or face growing cyber risks, a vCISO can fill that gap, providing strategic direction, improving resilience, and helping you make smarter security investments.

FAQs

What is ADA compliance for a website?
ADA website compliance means designing digital content so people with disabilities can access and use it without barriers, generally measured against WCAG success criteria. The Americans with Disabilities Act does not name a technical standard directly, but courts, regulators, and settlement agreements consistently treat WCAG Level AA as the practical benchmark.
Is WCAG legally required for private business websites?
WCAG is not written into the ADA's Title III text as a mandatory standard for private businesses, but it functions as the de facto legal benchmark. Courts and DOJ settlements routinely measure Title III compliance against WCAG 2.0, 2.1, or 2.2 Level AA, making conformance the safest practical target.
What WCAG level satisfies ADA compliance requirements?
Level AA is the level referenced across nearly every relevant regulation, settlement, and lawsuit, including the DOJ's Title II rule for government websites. Level AA conformance requires meeting all Level A success criteria in addition to the Level AA criteria themselves.
Does the Unruh Act create extra risk for California businesses beyond the ADA?
Yes. California's Unruh Civil Rights Act automatically treats any ADA violation as a state law violation and adds statutory damages of at least $4,000 per violation, a remedy the ADA itself does not provide. This is a major reason California drives a disproportionate share of accessibility litigation nationally.
How does a business get started with ADA website compliance?
A practical starting point involves auditing the site against current WCAG success criteria, prioritizing fixes to navigation and transactional pages, and building accessibility checks into ongoing development and vendor management processes. Treating accessibility as a maintained standard rather than a one-time project tends to reduce both legal exposure and long-term remediation cost.

Related blog posts