A recent wave of ADA accessibility lawsuits is renewing pressure on small business owners to check whether their websites can be used by people with disabilities. The legal theory is not new, but the website-accessibility landscape remains unsettled enough that a business can face different risks depending on where it operates, where it is sued and whether its online services are tied to a physical location.
The practical risk is clear even without a single nationwide private-sector web standard. Plaintiffs, regulators and accessibility advocates continue to argue that customer-facing websites must provide meaningful access to goods and services. Small businesses often do not discover their exposure until a demand letter or complaint arrives, when the cost of legal advice and technical remediation can quickly exceed what an advance website audit would have cost.
Title III applies to public accommodations, but private website rules remain uneven
Title III of the ADA prohibits disability discrimination by businesses open to the public, including many retailers, restaurants, banks, hotels, medical offices and other public accommodations. The Department of Justice has long taken the position that the ADA can apply to goods, services and activities offered online by public accommodations, including websites and mobile apps.
The clearest federal technical rule now applies to state and local governments, not private businesses. The DOJ’s Title II web and mobile app rule, published in 2024 and later extended by interim final rule, requires covered public entities to meet WCAG 2.1 AA by April 26, 2027 or April 26, 2028, depending on population size. That public-entity rule is likely to influence private-sector expectations, but it does not create an equivalent final technical standard for every private business website.
For private businesses, the DOJ says there is no detailed regulation setting out one mandatory web standard. Instead, businesses have flexibility in how they comply with the ADA’s general nondiscrimination and effective-communication requirements. In practice, WCAG 2.1 AA remains the benchmark most often used by courts, plaintiffs, consultants and settlement agreements because it provides a concrete way to evaluate whether a website is perceivable, operable, understandable and robust.
That means the safest practical question for a small business is not whether WCAG is formally mandatory in every case. It is whether a customer using a screen reader, keyboard navigation, captions or other assistive technology can complete the same core tasks as other customers.
Small websites are easier to scan and harder to defend
Digital accessibility lawsuits have become a recurring risk for companies with customer-facing websites and apps. Industry trackers have reported thousands of filings in recent years, while national reporting has documented law firms filing large numbers of similar web-accessibility cases against smaller businesses. One 2024 report described a single New York firm as filing more than 1,100 web-accessibility lawsuits in a year, accounting for roughly a quarter of the digital ADA cases tracked by UsableNet.
Small businesses are vulnerable because their sites are often built on templates, plugins and third-party themes that do not guarantee accessibility by default. Common issues include missing image alt text, insufficient color contrast, unlabeled forms, inaccessible menus, mouse-only navigation and checkout flows that screen-reader users cannot complete.
Those problems are often detectable with automated scanning tools, which allows plaintiffs’ firms to identify targets at scale. Larger companies can respond with in-house counsel, outside accessibility consultants and established remediation budgets. A small retailer, restaurant or service provider may have none of those resources and may feel pressure to settle even when the underlying legal claim is fact-specific or contestable.
The cost risk is also different from the penalty framing many businesses assume. Private ADA Title III suits generally focus on injunctive relief and attorney’s fees under federal law, not statutory damages for every individual plaintiff. But legal fees, settlement payments and emergency website remediation can still run into the thousands or tens of thousands of dollars. Some state laws may add separate damages exposure.
Court splits leave private businesses in a compliance gray zone
Federal courts have not adopted one uniform rule for when a private website is covered by Title III. Some courts require a nexus between the website and a physical place of public accommodation. Others have been more willing to treat online-only access barriers as actionable where the website itself offers goods or services to the public.
That split matters for small businesses that sell across state lines. A company may be based in one jurisdiction, serve customers nationally and still be sued in a plaintiff-friendly venue. Because the Supreme Court has not resolved the private-sector website-accessibility question in a way that gives businesses a complete rulebook, accessibility risk remains partly dependent on venue, facts and settlement posture.
Overlay widgets and AI accessibility plugins do not eliminate that risk. Automated tools can identify some issues and may help users with certain needs, but the DOJ has cautioned that automated checkers and overlays must be used carefully because a clean scan does not necessarily mean a site is accessible. Lawsuits have also targeted websites that already used accessibility widgets, reinforcing that a plugin is not a substitute for fixing inaccessible code, navigation and content structure.
Small businesses should audit accessibility before a demand letter arrives
- Run automated scans, then do manual testing. Free or low-cost tools such as WAVE and axe can flag many common issues, but automated tests should be paired with manual keyboard testing and, where possible, screen-reader review.
- Use WCAG 2.1 AA as the working benchmark. Even where WCAG is not a private-sector regulation, it remains the most widely recognized technical standard. Priorities include alt text, keyboard access, visible focus indicators, sufficient contrast, clear headings and labeled forms.
- Fix the underlying site, not just the surface layer. Accessibility widgets may help in limited ways, but they should not be treated as a legal shield. Structural fixes to HTML, CSS, JavaScript, forms and checkout flows are more defensible.
- Publish an accessibility statement. A statement should identify the standard the business is working toward, name known limitations and give users a clear way to report barriers. It is not a complete defense, but it creates a documented channel for resolving problems before litigation.
- Review vendor responsibility. Businesses using Shopify themes, WordPress plugins, booking platforms, payment tools or third-party menus should confirm who is responsible for accessibility defects and how quickly vendors will fix them.
- Speak with counsel before responding to a demand letter. A rushed response can waive defenses or lock a business into a costly settlement. An attorney familiar with ADA Title III litigation can assess venue risk, serial-filing patterns and whether the alleged barriers are actually present.
Regulators and courts will keep shaping the private-sector standard
The DOJ’s public-entity rule gives governments a concrete WCAG 2.1 AA timeline and may shape expectations in private litigation. But for businesses open to the public, the standard will continue to be built from DOJ guidance, circuit-court decisions, settlements and state-law developments unless Congress or the DOJ creates a clearer private-sector rule.
Until that happens, small businesses should treat accessibility as part of ordinary website maintenance rather than an emergency legal project. The same enforcement dynamic that drives regulatory penalties against under-resourced businesses in other compliance areas applies here as well: the cost of fixing a known problem before enforcement is usually lower than the cost of defending it after a complaint arrives.
Â
