Picture a small business owner who built their website years ago, hasn't touched it since, and one morning gets an email from a law firm they've never heard of, citing a federal statute and giving them thirty days to fix a list of technical problems on their homepage or face a lawsuit. That scenario plays out for real, thousands of times a year now, and it's not just large companies getting these letters — small businesses are actually the more common target, not the exception, because they're the ones least likely to have addressed this already.
This isn't written to scare you into buying something. It's written because this is a genuinely confusing area — three different legal frameworks depending on where your customers are, referencing a technical standard most business owners have never heard of — and most of what's online about it is either a law firm's ad or a widget company's sales page.
What the law actually says, by region
United States: Title III of the Americans with Disabilities Act applies to any business open to the public, and courts have consistently extended that to business websites. There's no small business exemption written into the statute — revenue and employee count don't matter. The technical standard referenced in almost every lawsuit and settlement is WCAG 2.1 Level AA, even though the ADA itself doesn't name a specific standard; it's simply what courts and the Department of Justice have converged on in practice.
United Kingdom: The Equality Act 2010 covers website accessibility for UK businesses, alongside the Public Sector Bodies Accessibility Regulations for public sector sites specifically. Both point to the same WCAG 2.1 AA standard as the practical benchmark.
European Union: The European Accessibility Act took effect in June 2025 and covers private-sector digital services and e-commerce sold to EU customers. Here's the part that catches people off guard — it isn't limited to businesses based in the EU. A UK or US company selling to EU customers online is expected to comply for that part of their business, regardless of where the company itself is headquartered.
The practical takeaway across all three: if you treat WCAG 2.1 Level AA as your floor and WCAG 2.2 AA (the newer, slightly more thorough version) as your actual target, you're covering the legal requirement in essentially every region your customers might be in. You don't need three separate compliance projects.
Why this has gotten more urgent, not less
The honest numbers: thousands of website accessibility lawsuits are filed in US federal and state courts every year at this point, and the trend has been climbing rather than leveling off. The overwhelming majority of business websites — independent audits regularly put the figure north of 90% — have at least some detectable accessibility failures. That combination is exactly what plaintiff's law firms look for: a huge, mostly non-compliant pool of targets. Most cases don't start as a lawsuit either — they start as a demand letter offering to settle before anything gets filed, which is unpleasant but at least gives you a chance to respond properly rather than already being in court.
What WCAG actually asks for, without the jargon
The full standard is long, but it organizes around four ideas: content should be perceivable (people can actually see or hear it, or get an equivalent), operable (people can navigate and interact with it, not just view it), understandable (it behaves predictably and reads clearly), and robust (it works properly with assistive technology like screen readers). In practice, a small number of issues account for most real-world violations and most lawsuits:
- Missing alt text on images, so screen readers have nothing to announce.
- Poor color contrast between text and its background, which affects low-vision users far more than it might seem from a design perspective.
- Keyboard navigation gaps — menus, forms or buttons that only work with a mouse, locking out anyone who navigates by keyboard.
- Unlabeled form fields, so a screen reader user can't tell what a given input is actually asking for.
- Missing captions on video content.
None of these are exotic engineering problems. They're the kind of thing that gets missed when a site is built quickly and nobody's specifically checking for it — which describes most small business websites, not because anyone was careless, but because it's just not on the radar unless someone raises it.
A word of caution on the "quick fix" widgets
A whole industry has grown up around one-line accessibility overlay scripts that promise instant compliance. Worth knowing before you rely on one: accessibility advocates and a number of legal cases have specifically pushed back on overlay-only fixes, because they patch the surface without touching how the underlying page is actually built, and can behave inconsistently with real assistive technology. They're not necessarily useless as one layer of a broader effort, but treating one as your entire compliance strategy is a real risk, not a shortcut — a site can have an overlay installed and still get sued.
A realistic path, not a panic response
- Get an actual audit — automated scanning tools catch a meaningful share of issues, but a real review (ideally including some manual keyboard and screen-reader testing) catches what automated tools miss.
- Fix the highest-impact issues first — alt text, contrast and keyboard navigation typically resolve the bulk of real risk before you touch anything more involved.
- Publish an accessibility statement — a short public page stating your target standard and how to report an issue. It signals genuine effort, which matters if a dispute ever happens.
- Build it into how new pages get made — a site fixed once and never checked again just drifts back out of compliance as content gets added.
Where we fit into this
How CodeGIF Developers actually handles accessibility
This isn't something we bolt on at the end of a project — here's specifically what it looks like when we build or fix a site with this in mind.
The takeaway
This isn't a fringe risk anymore, and it isn't limited to large companies or one country. If your website serves customers in the US, UK or EU, some version of this law already applies to you. The good news is that the actual fixes are well understood and usually not dramatic — the risk is mostly in not knowing where you stand, not in the difficulty of the fix itself.