The Rule Is Real and It Has Teeth
On April 8, 2024, the U.S. Department of Justice published the final rule titled Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities in the Federal Register (89 FR 31320). The rule amends 28 CFR Part 35, the implementing regulation for Title II of the Americans with Disabilities Act.
This is not a guidance document. It is not a technical assistance publication. It is not a "best practice" memo from a federal agency. It is a binding federal regulation with the full force of law, enforceable through the DOJ Civil Rights Division and through private rights of action in federal court.
The significance of this moment cannot be overstated. For 34 years since the ADA was signed on July 26, 1990, public entities have operated under a legal obligation to provide accessible services with no federal technical standard specifying what "accessible" meant for websites. That ambiguity ended on April 8, 2024.
Compliance Risk Escalation Meter
Complaint filed → DOJ investigation → consent decree → court-enforceable remediation + reporting requirements
Complaint filed → investigation → likely settlement with remediation timeline, third-party audit, annual certification
Good-faith evidence may reduce scope of consent decree; undue burden defense potentially available
Documented program, audit records, remediation log — minimizes exposure; complaint unlikely to escalate to litigation
WCAG 2.1 AA conformance, accessibility statement, ACRs, grievance procedure, monitoring log — minimal complaint risk
What the Final Rule Actually Says (Plain Language Summary)
The rule amends 28 CFR Part 35 by adding a new Subpart H — "Web Accessibility." Here is what the regulatory text actually requires, stripped of legalese.
WCAG 2.1 Level AA is the binding technical standard
Web Content Accessibility Guidelines (WCAG) 2.1, published by the W3C, at Level AA conformance is the specific technical standard codified in the rule. Not WCAG 2.0. Not WCAG 2.2. Not WCAG 3.0. WCAG 2.1 AA — as published on June 5, 2018 — is the floor. The rule does not prevent entities from exceeding this standard.
Covers all web content and mobile applications
The rule applies to websites and web content published or made available by the public entity, as well as mobile applications (apps). This includes PDF documents, videos, fillable forms, maps, data portals, payment systems, and any other content delivered via browser or app.
Applies to contractors and third-party content
Content made available on behalf of a public entity by a contractor or vendor is covered. If a vendor operates a service on your domain — or if you link to it as a primary service access point — you cannot outsource your ADA obligation to that vendor.
Compliance deadlines are tiered by entity size
Public entities with a population served of 50,000 or more (Title II entities with 50+ employees) must comply by April 24, 2027. Smaller entities and special purpose districts have until April 26, 2028.
Specific, narrow exceptions exist
The rule enumerates limited exceptions: archived web content, preexisting conventional electronic documents, content posted by third parties not under the entity's control, and content that would impose a fundamental alteration or undue financial and administrative burden. Each exception has conditions that must be affirmatively met.
Regulatory Text — 28 CFR § 35.200
"A public entity shall ensure that the web content and mobile apps that it provides or makes available, directly or through contractual, licensing, or other arrangements, comply with WCAG 2.1 Level AA, incorporated by reference in § 35.104, except where doing so would result in a fundamental alteration in the nature of a service, program, or activity or in undue financial and administrative burdens."
Source: 89 FR 31320 (April 8, 2024) — effective June 24, 2024
Large Entities
April 24, 2027
Population ≥ 50,000 · 50+ employees
- · Cities, counties, large school districts
- · Transit authorities, port authorities
- · Large housing & water authorities
Small Entities & Special Districts
April 26, 2028
Population < 50,000 · Under 50 employees
- · Small municipalities and townships
- · Fire districts, library districts
- · Small water and assessment districts
What "Local Government" Means Under the Rule
Title II covers "any State or local government" and "any department, agency, special purpose district, or other instrumentality of a State or States or local government." The DOJ's final rule inherits this broad definition. The phrase "special purpose district" is load-bearing — it sweeps in entities that many administrators do not think of as subject to the ADA.
Critical Warning: No Minimum Size
There is no minimum population, no minimum budget, and no minimum number of employees that exempts an entity from Title II coverage. A water district serving 400 households with a two-person staff and a basic website is fully covered. The tiered compliance deadline (2027/2028) is not an exemption — it is only a deadline extension for smaller entities.
The following entity types are covered. Many of these organizations have historically operated without structured ADA digital compliance programs:
If your entity has a website — a newsletter signup, a permitting portal, an agenda archive, a payment page — you have web content that is covered by this rule. If you are unsure whether your entity is a "public entity" under Title II, consult your agency attorney. The answer is almost certainly yes.
The 5 Documents Every Local Government Needs to Have Ready
When a complaint is filed — or when DOJ initiates a compliance review — these are the first five things an investigator will ask for. Not having them does not automatically mean you are noncompliant, but it substantially undermines any good-faith defense and accelerates the timeline to a formal finding.
An Accessibility Statement on Your Website — Current, Not from 2019
Your website must include an accessibility statement that identifies the applicable standard (WCAG 2.1 AA), provides contact information for reporting accessibility barriers, describes your grievance procedure, and is dated within the last 12 months. A statement that references "Section 508" without mentioning WCAG 2.1, or one that has not been updated since your last CMS migration, is worse than no statement — it signals neglect. The statement should also include the name and title of the ADA coordinator responsible for digital accessibility.
A VPAT or ACR for Every Procured Software System
If you procure software — your CMS, permitting system, payment portal, document management platform, or 311 system — you should have a current Voluntary Product Accessibility Template (VPAT) or Accessibility Conformance Report (ACR) for each product. "Current" means issued within the last 18 months or corresponding to the version you are running. If your vendor cannot or will not produce an ACR, that is itself a compliance signal and a procurement risk you need to document.
An ADA Transition Plan That Explicitly Includes Web and Digital
Title II has long required entities with 50 or more employees to have a transition plan for physical accessibility barriers. The DOJ final rule does not formally amend that requirement — but DOJ investigators routinely examine whether the transition plan addresses digital accessibility. If your plan was written in 2005 and only addresses curb cuts and parking stalls, it will not satisfy a digital accessibility inquiry. Your transition plan should include a web/digital section with: current state audit findings, prioritized remediation items, responsible staff, and a timeline.
A Documented Grievance Procedure
Title II requires entities with 50 or more employees to adopt grievance procedures for resolving complaints of discrimination. That obligation applies to web accessibility complaints. Your grievance procedure must: be in writing, identify the ADA coordinator by name or title, describe the steps for filing a complaint, provide a response timeline, and be posted on your website. It is not sufficient to have a general "contact us" form. The procedure must be specific to ADA complaints and must be accessible itself.
Evidence of Ongoing Monitoring — Audit Logs, Scan Reports, Training Records
Accessibility is not a one-time event. The rule requires ongoing conformance, which means ongoing monitoring. You need documentation showing: (a) when you last conducted an accessibility audit, (b) automated scan reports showing monitoring frequency, (c) who on staff has received accessibility training and when, and (d) records of user-reported accessibility barriers and how they were addressed. This body of evidence is what distinguishes a good-faith compliance program from a compliance checkbox exercise.
The Enforcement Mechanism: How DOJ Investigates
Understanding how enforcement actually works is critical for gauging your exposure. DOJ enforcement of Title II web accessibility claims follows a structured process, but it is not a slow or forgiving one.
Any person with a disability (or an advocacy organization acting on their behalf) can file a complaint at doj.gov/crt or by mail to the Civil Rights Division. There is no filing fee. The clock starts running on Day 0 — not when you learn about the complaint.
DOJ reviews the complaint for jurisdictional sufficiency and assigns it to the Disability Rights Section. A notification letter is sent to the public entity. The entity typically has 30 days to respond with documentary evidence.
Investigators conduct a technical review of the named web content, request documentation (transition plan, grievance procedure, accessibility statement, audit records), and may conduct site visits or user testing.
DOJ issues a Letter of Findings identifying specific violations. The entity is invited to negotiate a resolution before formal action is initiated.
Most cases resolve via a consent decree or settlement agreement. Common requirements include: a remediation timeline (6–24 months), a third-party accessibility audit, biannual progress reports to DOJ, and designation of an ADA digital coordinator. Unresolved cases proceed to federal litigation.
The 18–24 Month Clock Starts at Complaint Filing
Average complaint-to-resolution time is 18 to 24 months. That clock begins on the day the complaint is filed with DOJ — not the day you receive notification, not the day your attorney reviews it. The investigation is already underway before you know about it. Your audit records, grievance logs, and transition plan documents need to exist before a complaint is filed, not after.
Notable settlements include the agreement with Miami-Dade County (2019) requiring comprehensive WCAG remediation across all county websites, the consent decree with the City of Beaumont, Texas requiring biannual DOJ progress reports, and multiple school district settlements requiring dedicated accessibility coordinators and third-party audit programs. The pattern in settlements is consistent: remediation plan, third-party auditor, ongoing monitoring, annual reporting to DOJ.
The Undue Burden Defense: What It Is and What It Isn't
The undue burden defense exists in the regulatory text. It is real. But in 20 years of watching agencies invoke it, I can count on one hand the number of times it has actually prevailed as a complete defense. Here is why.
What Is NOT Undue Burden
- ✗"We didn't have budget for it this year"
- ✗"Our vendor said it would cost too much"
- ✗"We just launched a new website in 2023"
- ✗"Nobody has complained before"
- ✗"We're a small city with limited staff"
- ✗"The rule just came out"
What Might Constitute Undue Burden
- ✓Documented budget constraint with specific dollar figures
- ✓Written 5-year remediation plan with annual milestones
- ✓Alternative access method provided on request
- ✓Evidence of good-faith partial remediation
- ✓Financial analysis comparing remediation cost to total budget
- ✓Governing board resolution acknowledging the burden
The regulatory standard for undue burden under 28 CFR § 35.164 requires analysis of: (1) the nature and cost of the action; (2) the overall financial resources of the entity; (3) the number of persons employed; (4) the effect on expenses and resources; and (5) the type of operation of the entity. This analysis must be performed in writing, signed by the head of the agency, and documented before the compliance deadline — not after a complaint is filed.
Practitioner Note
Even when undue burden is legitimately documented, it is not a complete exemption. The entity must still provide access to the information or service through an alternative accessible means. "We can't fix the PDF" does not end the obligation — it shifts the obligation to providing the same information via phone, email, or in-person appointment. If you cannot provide the alternative access, you cannot claim undue burden.
The Archived Content Exception: Narrower Than You Think
The archived content exception is real. But it is being misapplied by a substantial number of agencies — treating it as a blanket exemption for any content older than the compliance date. The regulatory text is much more specific.
Under 28 CFR § 35.200(b)(1), web content qualifies as archived only if all of the following conditions are met:
The content was created before the applicable compliance deadline (April 24, 2027 or April 26, 2028)
The content has not been updated or modified since the compliance deadline
The content is maintained solely for reference, research, or recordkeeping purposes
The content is clearly identified on the page or in a label as archived content
The content is not linked from active service pages as a primary access point for current information or services
Warning: Agencies Are Mislabeling Active Content as "Archived"
The following are not archived content under the rule, regardless of how they are labeled:
- · Permit applications or forms linked from active service pages
- · Zoning maps linked from current planning department pages
- · Meeting agendas for meetings held in the last 2 years
- · Annual reports that were created before the deadline but are still linked as current
- · Any PDF that a resident would reasonably need to access a current government service
If a person with a disability needs inaccessible content to access a current government service — regardless of when that content was created — the archived exception does not apply. The test is not the age of the document. The test is whether the document gates access to a current program or service.
Contractor Responsibility: Third-Party Vendors Are No Defense
This is among the most misunderstood aspects of the rule. Public entities routinely attempt to shift accessibility liability to their vendors. The regulatory text forecloses that argument directly.
If your city's utility payment portal is operated by a vendor and that portal is inaccessible, your city is liable under Title II. If your school district uses a student information system with inaccessible parent portals, your district is liable. The vendor contract is irrelevant to the DOJ's enforcement analysis — the obligation runs to the public entity, not its contractors.
Required Procurement Practices
Require ACRs before award
Every RFP for software, SaaS, or web-based services should require the vendor to submit a current Accessibility Conformance Report (ACR) based on WCAG 2.1 AA as part of the bid package. Failure to provide an ACR should be treated as a responsiveness deficiency.
Include WCAG language in contract terms
Contracts should require WCAG 2.1 AA conformance as an ongoing obligation, not merely a delivery condition. Include a provision requiring the vendor to notify you of accessibility regressions and to remediate within a defined timeframe.
Include an audit right
Your contract should give you the right to conduct or commission an independent accessibility audit of vendor-operated systems. Without this right, you cannot meet your monitoring obligations under the rule.
Include an indemnification clause
If a vendor's inaccessible system results in an ADA complaint or DOJ investigation, you will want contractual indemnification. This does not eliminate your liability to complainants — but it provides a remedy against the vendor.
Sample RFP Accessibility Requirement Language
ACCESSIBILITY REQUIREMENTS All deliverables under this contract, including web-based applications, mobile applications, electronic documents, and multimedia content, shall conform to the Web Content Accessibility Guidelines (WCAG) Version 2.1, Level AA, as published by the World Wide Web Consortium (W3C). Vendor shall provide a current Accessibility Conformance Report (ACR) using the VPAT® 2.5 template within 30 days of contract award and within 30 days of any material system update. Vendor shall remediate identified WCAG 2.1 AA failures within 90 days of written notice from the Agency. This obligation survives contract termination.
An 18-Month Action Checklist for Large Agencies (June 2026 – December 2027)
For large entities with an April 24, 2027 deadline, you have roughly 22 months from the rule's publication to full compliance. As of June 2026, you have approximately 10 months to deadline. Here is a month-by-month implementation roadmap.
- Designate or confirm ADA digital coordinator (named individual, not just a title)
- Brief agency leadership and elected/appointed board on the rule and deadline
- Inventory all web properties: primary website, microsites, portals, apps
- Inventory all vendor-operated digital systems
- Confirm compliance deadline tier (large or small entity)
- Engage outside accessibility counsel or consultant if needed
- Commission a comprehensive WCAG 2.1 AA audit of primary website (automated + manual + assistive technology testing)
- Audit all high-traffic PDFs and documents (permit applications, forms, reports)
- Audit vendor-operated portals; request ACRs for all procured systems
- Document all findings in a remediation register
- Prioritize findings by severity and user impact
- Remediate all critical (blocker/critical severity) WCAG failures on primary website
- Remediate all public-facing forms and permit applications
- Remediate or replace inaccessible PDFs for top 50 most-accessed documents
- Negotiate remediation timelines with vendors; document in writing
- Publish updated accessibility statement
- Publish or update ADA grievance procedure
- Begin accessibility training for web content editors and IT staff
- Update ADA transition plan to include digital section
- Commission verification audit to confirm remediation outcomes
- Conduct user testing with screen reader users and keyboard-only users
- Address verification findings — prioritize any remaining critical failures
- Verify vendor-operated systems have met contractual remediation timelines
- Collect and organize ACRs for all active procured systems
- Compile complete compliance documentation package: audit reports, remediation register, ACR file, accessibility statement, grievance procedure, training records
- Finalize and adopt updated ADA transition plan with digital section
- Implement ongoing monitoring program: scheduled automated scans, quarterly manual spot checks
- Establish accessibility review process for new content and system procurements
- Brief agency leadership on compliance status
- Document any remaining open items with remediation timelines and alternative access provisions
The Procurement Angle: Every New System Must Be Accessible From Day One
The compliance deadline applies to existing web content. But for systems you procure after the deadline — or for systems you procure between now and the deadline — the obligation is immediate upon launch. A new CMS you launch in October 2026 is not grandfathered. It must be accessible when it goes live.
This creates a critical forward-procurement imperative. If your agency is evaluating or planning any of the following in 2026 or 2027, accessibility must be a first-order requirement — not a "phase 2" consideration, not a line item that gets value-engineered out, not a checkbox on the vendor's marketing materials:
Evaluating a New CMS in 2026 or 2027?
Your CMS selection process must include accessibility evaluation. This means:
- ·Requiring an ACR in the RFP response
- ·Conducting independent WCAG testing of the vendor's demo environment before award
- ·Testing the authoring interface (not just the front end) — content editors must be able to produce accessible output
- ·Requiring a remediation timeline for any failures identified during procurement evaluation
- ·Including accessibility SLAs (service level agreements) in the final contract
WPPersona is purpose-built for government accessibility compliance. Every theme template is WCAG 2.1 AA tested. The authoring interface surfaces accessibility guidance in context — flagging missing alt text, low-contrast color choices, and missing heading structure before publication. Our platform ACR is available on request, current to VPAT 2.5, and updated with every major release. For agencies evaluating CMS options in 2026 or 2027, accessibility should be a primary evaluation criterion — not an afterthought.
Don't Wait for a Complaint to Start
The DOJ final rule is in effect. Your deadline is set. WPPersona gives local governments a WCAG 2.1 AA compliant CMS platform with the documentation, monitoring tools, and ACR artifacts you need to demonstrate good-faith compliance — starting on day one.
Related Article
ADA Title II Complete 2027 Compliance Guide →Related Article
WCAG 2.1 AA for Government Websites: A Technical Guide →