ADA website compliance audit (USA): a 2026 SMB guide

The Americans with Disabilities Act of 1990 has become, over the last decade, the single largest source of website-related litigation against SMBs in the United States. 5,114 website accessibility lawsuits were filed in 2025 — 3,195 of them in federal court, the rest in state courts, overwhelmingly New York and California. That is a genuine record; federal filings had dipped in 2024 before climbing back. The plaintiff bar has shifted decisively from large enterprises to SMBs whose insurance and settlement posture is more predictable. An ADA website compliance audit is how you find out where you stand before someone files.

How the ADA actually applies to websites

The ADA itself does not mention websites, it predates the modern web. Title III requires “places of public accommodation” to be accessible to people with disabilities. The litigation question for thirty years has been whether a website is a “place.”

The current state of the law:

• DOJ position: websites of public accommodations are covered. Reaffirmed in 2022 guidance and consistent in enforcement actions.
• 1st and 7th Circuits: the broad view. A website can be a place of public accommodation on its own, with no physical location behind it.
• 3rd, 5th, 6th, 9th and 11th Circuits: a nexus to a physical place of business is required. The 11th went furthest in Gil v. Winn-Dixie (2021), holding that a website is not itself a place of public accommodation; that opinion was vacated as moot, so it binds no one, but it shows where the panel sat.
• 2nd Circuit: no appellate holding, and the district courts within it are split — which has not slowed anything down, since the Southern and Eastern Districts of New York remain the busiest filing venues in the country.
• 4th Circuit: no controlling holding either way.
• State laws: California’s Unruh Civil Rights Act, New York State and City human-rights laws, and similar laws in Florida and Massachusetts often provide an independent basis for suit, including against online-only businesses, with lower thresholds than the federal ADA.

The technical bar

The ADA does not specify a technical standard, but DOJ guidance, court rulings, and settlement agreements consistently reference WCAG 2.1 Level AA (sometimes 2.0). The April 2024 DOJ rule for state and local governments (ADA Title II) mandates WCAG 2.1 AA explicitly; while it does not bind Title III, courts and plaintiffs routinely apply it as the de facto standard.

For SMB compliance work, the practical consequence is that the same WCAG 2.1 AA audit that satisfies the EAA, the UK Equality Act, and AODA also satisfies ADA Title III. One technical audit, multiple jurisdictions.

What plaintiffs actually target

Plaintiff complaints follow a recognisable pattern. The boilerplate alleges a series of specific WCAG failures observed during a screen-reader test, typically:

• Images without alt text or with empty alt on meaningful images
• Links and buttons with no accessible name (icon-only buttons are a major target)
• Form fields without labels
• Insufficient colour contrast
• Keyboard traps in modals or carousels
• Improper heading structure
• Inaccessible PDFs linked from the site
• Video without captions

Half of that list is machine-testable and half is not, and it is worth knowing which half is which before you treat a green scan as a defence.

Caught outright: missing accessible names on links and buttons, and missing form labels. Those are structural facts about the DOM, and axe-core settles them with no judgement call.

Caught in part: alt text and colour contrast. A machine can see that an alt attribute is absent. It cannot see that an empty one has been put on an image that carries meaning — to any automated check, a decorative image and a mislabelled product photo look identical. Contrast is the same story at the edges: text over a photograph, a gradient, or a translucent overlay comes back from axe-core as “needs review” rather than “fail,” and we do not promote those to violations. Reporting a maybe as a finding would make every other number in the report worth less.

Not caught at all: keyboard traps, heading semantics, PDFs, and captions on embedded video. We never drive the keyboard during a scan, so a trap in a modal or a carousel is invisible to us — SC 2.1.2 sits on our manual-criteria list and scores neutral rather than pretending. Whether an <h3> is the right heading is a question about meaning, not markup. We do not crawl or open linked PDFs. And our caption rule reads native <video> and <audio> elements, so a YouTube or Vimeo embed with no captions produces no finding.

That is the honest shape of it, and it is still a strong position. The automated half is the half the plaintiff bar screenshots into the complaint, and it is the half you can re-check on every deploy for the rest of the site’s life. A site that fails it is a cheap filing. A site that passes it has to be litigated the hard way, by someone who actually sat down with a screen reader. Run the scan first because it is fast and repeatable, then spend your manual hours where the machine is blind: the keyboard pass, the heading outline, and the PDFs.

The accessibility-overlay trap (US-specific)

US SMBs are the primary market for accessibility overlay vendors, accessiBe, AudioEye, UserWay. The pitch is that a single line of JavaScript creates ADA compliance and immunity from suit. The reality:

• FTC enforcement against accessiBe in January 2025: USD 1 million settlement for misleading marketing about overlay-based compliance.
• Plaintiff targeting: plaintiff firms have publicly stated they specifically target overlay-using sites because the failure pattern is so predictable. The Web Accessibility Initiative and the National Federation of the Blind have both issued statements warning against overlays.
• Litigation against a vendor: BloomsyBox.com LLC sued UserWay in the District of Delaware in July 2024 over its overlay marketing claims. In February 2026 a magistrate judge recommended granting the motion to dismiss only in part: the Delaware Consumer Fraud Act and negligent-misrepresentation claims survive, while breach of contract and the Magnuson–Moss Warranty Act claims do not.

Removing an overlay reduces lawsuit exposure. Adding one increases it.

The realistic SMB defence plan

Five steps, in order, that close most of the gap.

1. Run a baseline WCAG 2.1 AA audit. An automated scan only covers the machine-testable slice — roughly a third of WCAG success criteria are machine-testable at all — but the high-severity defects cluster there. Fix those first.
2. Manual screen-reader test of your top 10 pages. Home, product pages, cart, checkout, account, contact. Two-hour exercise with NVDA or VoiceOver.
3. Publish an accessibility statement. Specify the standard you target (WCAG 2.1 AA), the date of last review, known limitations, and a feedback channel. The plaintiff bar prefers easy targets; a credible statement and a real feedback mechanism shift the calculus.
4. Set up continuous monitoring. A WCAG-clean site stays clean only until the next deploy. Most regressions ship six weeks after the audit.
5. Document everything. If a complaint or lawsuit comes in, the audit-and-remediation log is your defence. Settlements depend heavily on whether the defendant can show good-faith effort.

Cost ranges

From SMBs we work with:

• Defence of a single ADA web lawsuit: USD 5,000 to 25,000 settlement, plus 2 to 6 weeks of remediation work. Repeat suits common after first settlement.
• One-time consultant audit: USD 5,000 to 15,000 depending on site size.
• Continuous scanning + ad-hoc consulting: USD 100 to 500 per month for tooling plus periodic professional review.

The ROI of pre-emptive auditing over reactive settlement is usually clear after the first lawsuit avoided.

How Veracly approaches ADA

One accessibility analysis, cited against whichever frameworks are actually in scope. Which rule packs run is decided by the visitor countries on the scan: the United States selects the ADA Title III pack, Great Britain the UK Equality Act, Canada AODA, and any of the 27 EU member states the EAA. The underlying accessibility testing is identical across all of them — axe-core against the WCAG 2.2 AA superset, meaning the 2.0, 2.1 and 2.2 A and AA rule sets together, which clears the 2.1 AA bar the ADA plaintiff bar actually applies. What changes is the statute cited and how each regime weights severity. So “all four at once” is not a thing we will promise you: it needs US, GB, CA and an EU state all listed on the same scan. A free scan resolves one country, Starter one, Growth three, and Pro and Agency have no cap.

Every violation cites the relevant WCAG criterion, the legal framework it engages, and the developer-level fix. Two limits worth stating plainly, because the CTA below is for the free tier: a free scan covers one page, explains only its top three findings, and generates no developer fixes at all — those are paid-tier work. And we do not write your accessibility statement — we tell you when one is missing and point you at the W3C generator, because a statement that a scanner drafted is a statement nobody read. What you get for the litigation file is the report itself: dated, reproducible, and worth having a run of. Run a free scan.

See also: WCAG 2.1 AA accessibility audit explained · EAA compliance for SMBs: what changes June 2025 · What is a website compliance audit?