On April 24, 2024, the U.S. Department of Justice (DOJ) published in the Federal Register a final rule on Accessibility of Web Information and Services of State and Local Government Entities. These regulations are at 28 C.F.R part 35. The new regulation largely tracks the DOJ’s Notice of Proposed Rulemaking (NPRM). The new regulations will have a great impact on public entities, including all public colleges and universities.

There will be a ripple effect for all recipients of federal financial assistance because regulations under Section 504 of the Rehabilitation Act must be consistent with those under Title II. DOJ will be coordinating with other federal agencies such as the Departments of Education, and Health and Human Services will need to adopt or modify their Section 504 regulations. Those future regulations will affect private colleges, health care providers, and other recipients of federal financial assistance, as well as private entities covered by Section 1557 of the Affordable Care Act. While the rule would not directly affect private businesses, plaintiffs’ attorneys and courts are likely to cite and rely on the rule in website accessibility claims under ADA Title III against places of public accommodations.

Effective Dates

DOJ kept its proposed “Compliance Dates” by which public entities must comply. Public entities with a population of 50,000 or more must begin complying by June 24, 2026. Smaller entities have until June 24, 2027. Coverage will usually be determined by the population of the parent entity. For example, if a community college is considered a county entity, coverage is determined by the county’s population, but most four-year public colleges would be considered entities of the state.

WCAG 2.1 Level AA

DOJ adopted and incorporated by reference the Web Content Accessibility Guidelines (WCAG) 2.1, published in 2018. Public entities must comply with the WCAG 2.1 Level AA success criteria and conformance requirements (which include Level A). This standard and criteria cannot be changed by DOJ without future rulemaking.

What is Covered

The regulations apply to all “web content” and “mobile apps” “that a public entity provides or makes available, directly or through contractual, licensing or other arrangements.” This means all websites and mobile apps used in connection with or supporting any programs or services provided by public entities are covered under ADA Title II. This includes all mobile apps used by public entities directly to provide or support its services, programs, or activities, as well as websites or apps of third parties used in providing services, programs or activities. For example, a city that uses the ParkMobile app for paid street parking would be required to ensure the ParkMobile app is accessible.

Exceptions

The final rule includes five exceptions:

1. Archived web content – This includes web content that (1) was created before the Compliance Date; (2) is retained exclusively for reference, research, or recordkeeping; (3) is not altered or updated after the date of archiving; (4) is not altered or updated after being archived; and (5) is organized and stored in a dedicated area or areas clearly identified as being archived. Public entities will thus have an incentive to archive materials not being regularly used by the public and in programs and services.  
2. Preexisting conventional electronic documents – This includes documents created before the Compliance Date that are in PDF, word processor file formats, presentation file formats, and spreadsheet file formats. The exception does not apply to documents currently used by members of the public to apply for, gain access to, or participate in a public entity’s services, programs or activities.
3. Content posted by third parties on a public entity’s website – This includes content for which the public entity has no control, such as public comments on a message board or filings made in court. However, if the public entity chooses to post third-party content on its website, or as part of its services, programs or activities (e.g., calendars, scheduling tools, maps, reservation systems, or payment systems developed by an outside technology company), they must be accessible.
4. Individualized password-protected or otherwise secured conventional electronic documents. These are documents about a specific person or their property and are secured by a password or other means.
5. Preexisting social media posts by the public entity, but not if they are referred to or used by the entity after the Compliance Date.

If the public entity is linking to or using third parties to provide programs or services, those websites or apps must be accessible. If the entity is merely linking (e.g. to local businesses), only the link must be accessible.

There is a limited ability to provide conforming alternate versions of web content as defined by WCAG 2.1. Entities can also raise other Title II defenses, including fundamental alteration, undue burden, technical feasibility or legal limits.

Almost 100% Compliance

In the NPRM, DOJ discussed a variety of possible methods that could be used to demonstrate compliance, such as establishing and following policies and practices for accessibility feedback, testing, and remediation. Ultimately DOJ rejected alternative approaches. Instead, in Section 35.205, DOJ provided an additional defense for “noncompliance that has a minimal impact on access.” In its guidance, DOJ said this should help deter litigation over minor nonconformance issues, but at the same time suggested that it would be very rare that a public entity could meet the criteria for this defense.

Given the explosion of website accessibility lawsuits in recent years, as a practical matter, the best defense is going to be mooting the claims. That means having processes in place by the Compliance Date to regularly detect and promptly correct WCAG 2.1, Level AA nonconformance and the ability to quickly show that any issue identified in a lawsuit has been corrected.  

Compliance with these regulations requires high-level engagement by the CIO/IT, legal, finance and procurement, compliance and disability services and HR (including training); use of outside accessibility experts; and integration of digital accessibility across all content providers.

The clock is ticking.