Which Accessibility Law Applies to Your Store?
Someone in your business has asked whether the website is compliant. Nobody can answer, because nobody is sure which rule they are being measured against.
There are four that come up constantly for online retailers, and they are related but not interchangeable. Confusing them is expensive in both directions — businesses pay to meet requirements that do not apply to them, and skip ones that do.
Here is what each actually covers.
WCAG is the standard. The rest are laws that point at it.
Start here, because it removes most of the confusion.
The Web Content Accessibility Guidelines are not a law. They are a technical specification published by the W3C, currently at version 2.2, organised into success criteria at three levels: A, AA and AAA.
Almost every accessibility law in the world works the same way: it creates a legal obligation, then points at WCAG for the technical detail. Level AA is the level nearly all of them land on.
So when someone asks “are we WCAG compliant,” the useful question underneath is “which law applies to us, and does it require AA?” The answer is almost always yes, it requires AA.
ADA — United States, private business
The Americans with Disabilities Act is the basis for most US website accessibility litigation. Title III covers places of public accommodation, which courts have applied to commercial websites.
Applies to you if: you sell to US consumers.
Two things make the ADA awkward to plan against. It does not name WCAG in its text — courts and settlements reference it instead, overwhelmingly at 2.1 or 2.2 Level AA. And enforcement is driven by private lawsuits rather than a regulator, which means exposure arrives as a demand letter, not an inspection.
If one has already arrived, the sequence matters. I have written a technical triage checklist for that first hour.
Section 508 — United States, federal
Section 508 of the Rehabilitation Act covers federal agencies and the vendors that sell to them. It incorporates EN 301 549, which in turn incorporates WCAG Level AA.
Applies to you if: you sell to a US federal agency, or to a contractor who does.
Most retailers assume this is irrelevant to them, and usually it is. But it arrives through procurement rather than litigation: a buyer asks for a VPAT — a Voluntary Product Accessibility Template documenting your conformance — before they will contract. No VPAT, no deal. That conversation tends to happen with two weeks’ notice.
European Accessibility Act — European Union
Enforceable since 28 June 2025. It follows your customers rather than your company, so it applies to a US business selling into the EU exactly as it applies to a European one.
Applies to you if: EU consumers buy from you, and you are not a microenterprise (fewer than 10 employees and under €2 million turnover — both conditions, and the exemption covers services, not products).
Conformance is assessed against EN 301 549, which incorporates WCAG 2.1 AA. The EAA also takes documentation more seriously than US practice generally does.
I have covered this in detail: what the EAA requires of US eCommerce.
So which applies to you?
For most online retailers the honest answer is more than one. Three questions settle it:
- Do US consumers buy from you? ADA applies.
- Do EU consumers buy from you? EAA applies, unless you clear the microenterprise threshold on both counts.
- Do you sell to government, education or large enterprise? Expect to be asked for a VPAT regardless of jurisdiction.
Here is the part that saves money: the technical work is largely the same for all of them. They converge on WCAG Level AA. A site built to 2.2 AA satisfies the substance of every framework above. What differs is the documentation each expects, and the consequence of falling short.
So the practical sequence is: build to WCAG 2.2 AA once, then produce the paperwork each obligation requires. Not three separate compliance projects.
What about GDPR and HIPAA?
These come up in the same conversation and are worth separating out, because they are not accessibility law.
GDPR governs personal data — what you collect, why, and what rights people have over it. HIPAA governs protected health information in the US.
Neither requires your site to be accessible. They intersect with accessibility only at the edges: a consent banner nobody can dismiss with a keyboard is both an accessibility failure and a defective consent mechanism. A privacy notice that cannot be read by a screen reader has arguably not been provided.
My practice is accessibility — ADA, WCAG, Section 508 and the EAA. For data protection obligations, that is a separate specialism and you want someone whose practice it actually is. I flag the overlaps when I find them; I do not advise on the frameworks themselves.
What none of them can promise you
No standard, audit or certificate makes you litigation-proof. Anyone selling that is selling something they cannot deliver.
What conformance with WCAG 2.2 AA does give you is a documented, defensible position: evidence that you tested, what you found, what you fixed, and when. That is a materially better place to be than silence — and it is also, not incidentally, a site more people can actually use.
I am not an attorney and this is not legal advice. For your specific exposure, talk to qualified counsel. I work alongside legal teams and supply the technical evidence they need.
Where to start
If you do not know which frameworks apply to you, the order of operations is: establish where your customers are, then test against WCAG 2.2 AA, then produce the documentation each obligation expects.
An audit answers the middle step properly — findings mapped to individual success criteria, prioritised by what actually blocks a purchase. Remediation and certification run through EcomBack, a court-approved accessibility provider.
Book a consultation or read about accessibility services.
I am a web accessibility specialist and ADA compliance consultant — a participant in the W3C Accessibility Guidelines Working Group, DHS Trusted Tester and NVDA Expert certified. More about my background.