Overview
Almost every organization with a website ends up needing WCAG compliance eventually, but the legal reason differs depending on who you are. There is no single law that says “everyone must comply.” Instead, several separate rules overlap, and most businesses are caught by more than one.
If you only read one section, read the next one. It covers private ecommerce, which is most of Axevoo’s readers.
Private businesses (ADA Title III)
Title III of the ADA covers “places of public accommodation,” and courts have consistently applied that to commercial websites, including ecommerce stores. There is no official revenue or employee size threshold that exempts a business, a common misconception covered in who is exempt from ADA compliance. If you sell to US customers online, this applies to you regardless of how small the store is.
State and local government (ADA Title II)
Title II covers government entities: city sites, public school and university sites, transit authority apps. DOJ finalized a rule in 2024 requiring WCAG 2.1 AA, with deadlines recently extended to April 2027 and April 2028 depending on jurisdiction size. This is a separate legal track from Title III and does not apply to private businesses. See what the new ADA guidelines actually cover for the full breakdown.
Federal agencies and contractors (Section 508)
Section 508 of the Rehabilitation Act requires federal agencies, and companies that sell to them, to meet accessibility standards for their technology. This is why a VPAT, documentation showing WCAG conformance, becomes relevant the moment a store starts selling into government or enterprise procurement.
Businesses selling into the EU (European Accessibility Act)
If you sell products or services to consumers in the EU, the EAA can apply regardless of where your business is based. It uses similar accessibility principles to WCAG but is a separate law with its own scope and exemptions.
Anyone under state-specific accessibility law
Some states go further than federal law. California’s Unruh Civil Rights Act, for example, allows a minimum statutory damages award per violation, part of why California accounts for a disproportionate share of website accessibility lawsuits nationally.
Example
A mid-size supplement brand assumed WCAG only mattered if they got sued. Then a big-box retail partner asked for a VPAT before finalizing a wholesale deal, and separately, a new investor’s due diligence checklist asked whether the storefront had been audited. Compliance had already become a business requirement before a single lawsuit was filed.
Common mistake
Assuming “compliant” is one fixed target. A store can be reasonably positioned against ADA Title III and still fail an EAA review, or lack the VPAT documentation an enterprise buyer needs. The safest baseline is a full WCAG 2.1 AA audit, since it is the standard referenced across nearly every one of these tracks, covered in what a real accessibility audit looks like.