ADA, Section 508, and the EAA: What Web Accessibility Laws Actually Require
WCAG is the technical standard, but it isn't a law. Here's what the ADA, Section 508, and the European Accessibility Act actually require of websites — and why they mostly point back to the same guidelines anyway.
WCAG explains what “accessible” means at a technical level — contrast ratios, resizable text, keyboard operability. What it doesn’t do is tell you who’s legally required to follow it, or when. That part comes from a separate set of laws and regulations, and they don’t all say the same thing. Here’s what the three most commonly cited ones — the ADA, Section 508, and the EAA — actually require, and where each one does or doesn’t point back to WCAG.
WCAG is a standard, not a law
Worth repeating up front, because it trips people up constantly: the W3C that publishes WCAG has no enforcement power. It can’t fine anyone or file a lawsuit. WCAG becomes legally meaningful only when a law, regulation, or court decision adopts it as the benchmark for what “accessible” means in that specific context. That adoption isn’t automatic or uniform — it happens law by law, and sometimes it references an older WCAG version than the current one, which is why the details below don’t all line up neatly.
The ADA: Title II now has an explicit standard, Title III still doesn’t
The Americans with Disabilities Act splits into titles that apply to different kinds of organizations, and the two relevant here have ended up in very different places.
Title II covers state and local government entities, and as of a final rule the Department of Justice issued in April 2024, it now has an explicit technical standard: WCAG 2.1 Level AA, applied to both websites and mobile apps. The original compliance deadlines were April 2026 and April 2027 depending on the government entity’s population, but DOJ extended both by a year in April 2026 — public entities with a population of 50,000 or more now have until April 2027, and smaller entities or special district governments until April 2028. Either way, this is the clearest case of a U.S. law directly naming a WCAG version and conformance level as a legal requirement.
Title III covers private businesses (“places of public accommodation” in the statute’s language), and it’s a messier picture. The ADA itself was written in 1990, long before the modern web, and the Department of Justice still hasn’t issued a Title III regulation that names a specific technical standard the way it did for Title II. In practice, courts hearing website accessibility lawsuits and the settlements that resolve them have converged on WCAG 2.1 AA as the de facto yardstick — but it’s a pattern that’s emerged through litigation, not a codified rule a business can point to the way state and local governments now can under Title II.
Section 508: the standard for U.S. federal agencies and contractors
Section 508 of the Rehabilitation Act applies to U.S. federal agencies, and by extension to contractors and organizations building technology for them. It’s the oldest of the three in its current technical form: the “Section 508 Refresh,” finalized in January 2017 and effective January 2018, requires federal electronic and information technology to conform to WCAG 2.0 Level A and AA.
Note the version: 2.0, not 2.1. That refresh intentionally aligned Section 508 with WCAG rather than writing separate criteria from scratch, but it hasn’t been updated again since, so it’s still anchored to a WCAG version that’s now over a decade old. Content that meets 2.0 AA generally meets most of 2.1 AA too, since WCAG 2.1 only adds criteria on top of 2.0 rather than replacing any — but the reverse isn’t guaranteed, which matters if you’re building for both federal and state/local government audiences.
The European Accessibility Act (EAA): the EU’s version, but broader reach
The European Accessibility Act (EAA) is an EU directive, and enforcement began on June 28, 2025. It doesn’t apply only to government sites — it covers specific categories of consumer-facing products and services, including e-commerce, banking, e-books, and transport information, sold within the EU. Importantly, it applies based on where a product or service is sold, not where the company selling it is based, so a business outside the EU can still fall under it if it serves EU consumers.
The EAA’s technical benchmark is EN 301 549, a European standard originally built to harmonize with WCAG. Its current version aligns with WCAG 2.1 Level AA, and meeting it creates what’s generally described as a “presumption of conformity” — regulators treat compliance with the standard as evidence the legal requirement is met. Since enforcement began, non-compliance can carry penalties, and in some cases products can be pulled from the EU market entirely.
The common thread: almost everything points back to WCAG
Line the three up and a pattern shows up immediately:
| Law | Who it covers | Technical standard | Level |
|---|---|---|---|
| ADA Title II | U.S. state & local government | WCAG 2.1 | AA |
| ADA Title III | U.S. private businesses | No codified standard — WCAG 2.1 AA used in practice | AA (de facto) |
| Section 508 | U.S. federal agencies & contractors | WCAG 2.0 | A and AA |
| EAA | Consumer products/services sold in the EU | EN 301 549 (aligned with WCAG 2.1) | AA |
None of these laws invented their own accessibility criteria from scratch. They all lean on WCAG, directly or through a standard built on top of it — which is exactly why understanding WCAG itself is useful even if you never read a single regulation. The version and the enforcement mechanism differ; the underlying technical bar is close to identical across all four rows.
What this means if you’re just trying to read a webpage
Everything above describes obligations that fall on the organization running a website — not something an individual reader can invoke in the moment a page is hard to get through. Filing a complaint or joining a lawsuit is a real option when a site is inaccessible, and it helps to be able to name the specific problem (a contrast ratio, a missing text alternative) rather than just “this is hard to read” — which is exactly what WCAG’s specific success criteria are useful for, law aside.
But none of these laws move at the speed of “I’m trying to read this article right now.” A site that’s years away from an ADA Title II deadline, or a small business nobody has sued yet, can be just as hard to read today as one that’s already been found non-compliant. That gap is exactly where personal reading tools do their work — adjusting contrast, font, spacing, or reading it aloud yourself, regardless of what a law will eventually require the site’s owner to fix. ReadEase applies the same kinds of adjustments WCAG describes — contrast, font size, line height, letter spacing — directly in your browser, independent of whether the site you’re on is currently compliant with anything.
Frequently asked questions
Is a website breaking the law if it’s hard to read?
Not necessarily, and not automatically. Whether a specific law applies depends on who runs the site (government vs. private business), where it operates, and which regulation covers that category. A site can be genuinely hard to read without violating any specific law currently in force, especially under ADA Title III, which still has no codified technical standard the way Title II now does.
Does meeting WCAG guarantee legal compliance?
It significantly reduces risk under all four frameworks above, since each one leans on WCAG (or a standard aligned with it) as its practical benchmark. It isn’t an absolute guarantee, partly because the laws reference different WCAG versions and partly because compliance assessments can look at more than the automated or technical criteria alone.
Does the European Accessibility Act apply to companies outside the EU?
Yes, if they sell covered products or services to consumers within the EU. The EAA applies based on where something is sold, not where the company selling it is headquartered.
Why does Section 508 still reference WCAG 2.0 instead of a newer version?
Section 508’s technical requirements were last substantively updated in the 2017–2018 refresh, which adopted WCAG 2.0 AA at the time and hasn’t been revised to a newer WCAG version since. Content built to WCAG 2.1 AA will generally satisfy Section 508 as well, since 2.1 only adds criteria on top of 2.0 rather than removing any.