ADA Compliance for Small Business Websites

ADA compliance for small business websites is not optional, and it does not scale down to zero just because your company has four employees and a part-time bookkeeper. Title III of the ADA covers "public accommodations," which is legal shorthand for almost any business that serves the public, and courts have spent the better part of two decades deciding that a website counts as an extension of that business. There's no small-business exemption written into the statute. The obligation shrinks with your resources, but it never disappears entirely, and that distinction is the one most owners get wrong.

Here's the mechanism worth understanding before anything else: the "readily achievable" standard adjusts what's expected of you based on size and budget, so a solo consultant isn't held to the same remediation clock as a national retailer. But "readily achievable" is not the same as "not required." If your site lets someone browse products, book an appointment, fill out a contact form, or just learn what you do, that site falls under Title III's reach. Full stop, no asterisk for small operations.

There's a related thread worth a paragraph of its own: in April 2024 the DOJ finalized a rule codifying WCAG 2.1 AA as the accessibility standard for state and local government websites, with compliance deadlines of April 26, 2027 for larger population entities and April 26, 2028 for smaller ones. That rule technically binds government sites, not private business. But it tells you exactly which standard the DOJ considers the benchmark, which matters when private lawsuits keep citing that same standard as the yardstick for what "accessible" means.

And then in March 2025, the DOJ withdrew a batch of ADA guidance documents. If you're waiting for federal enforcement to be the thing that gets your business in trouble, you can stop waiting; it rarely was the thing to begin with. Private lawsuits and demand letters have driven almost all small-business compliance pressure for years, and that hasn't changed one bit with the guidance rollback. The regulator stepped back an inch. The plaintiffs' bar did not.

What the lawsuit numbers actually show about who gets sued

Start with scale, because the scale is the story. Plaintiffs filed 3,117 federal website accessibility lawsuits in 2025, up 27% from 2024. Add state court filings and the total tops 5,000 digital accessibility lawsuits for the year. That's not a niche legal category anymore; that's a genre.

But lawsuits are the tip of the iceberg, and the part underwater is bigger and less visible. An estimated 35,000 to 50,000 demand letters went out in 2025, meaning for every lawsuit filed, roughly seven to ten businesses got a letter instead. Most companies facing accessibility pressure never see a courtroom. They see an envelope, a deadline, and a settlement number, and they decide whether to fight or pay.

Who gets targeted? Not the companies you'd assume. UsableNet data pegged 67% of 2024 cases against companies with annual revenue under $25 million, and a 2023 figure put that same bracket at 77%. Small companies get sued more, not less, and the reason is almost insultingly logical once you say it out loud: they have more compliance gaps, thinner legal budgets, and a much higher tendency to settle fast rather than litigate. Plaintiffs' firms are not chasing prestige; they're chasing the path of least resistance, and small business websites are that path.

Here's the part that should really get your attention: settling once does not make the problem go away. Of the 5,000-plus lawsuits filed in 2025, 1,427 targeted companies that had already been sued before. In federal court specifically, 46% of cases involved repeat defendants. Write a check, fix nothing, and you've essentially bought yourself a second lawsuit with a delay timer attached.

There's also a newer wrinkle that deserves a beat of its own: self-represented plaintiffs filed 40% more federal ADA Title III and Fair Housing Act cases in 2025 than the year prior, a jump that at least one industry group, Idea Forge Studios, attributes largely to AI-assisted drafting tools making it easier for an individual to generate a legally coherent complaint without hiring a lawyer. The barrier to filing just got lower. That trend line is probably not reversing.

Geography offers less protection than you'd hope. New York led 2025 with over 1,000 federal filings, but Illinois saw a 745% surge as plaintiff firms migrated filings after New York courts tightened standing requirements. Litigation goes where the courts are friendliest to it, the way water finds the crack in a foundation. And for a ceiling on how bad this can get: Fashion Nova settled a web accessibility class action for $5.15 million in 2025, the largest such settlement on record. Nobody's saying your five-person landscaping company is headed for a number like that. But it's useful context for what "serious exposure" actually means at the far end of the spectrum.

What WCAG 2.1 Level AA actually requires in plain terms

WCAG 2.1 Level AA is the standard courts keep pointing to in Title III cases, and it's the one the DOJ formally adopted for its 2024 Title II rule. Developed by the World Wide Web Consortium, it's organized around four principles that spell out POUR: Perceivable, Operable, Understandable, Robust. Which sounds like something out of a corporate training slide, until you translate it into what it actually asks a website to do.

Concretely, it wants images to have text alternatives so a screen reader can describe them. It wants captions on video and audio. It wants a 4.5:1 contrast ratio between text and background for normal body copy, because plenty of users cannot read light gray text on a white background no matter how trendy that palette looks in a mockup. It wants text that can resize significantly without breaking the layout, all functionality operable through a keyboard alone (no mouse required, ever), form fields with real visible labels, links that describe where they go instead of the eternally unhelpful "click here," and a declared page language so a screen reader pronounces your content correctly instead of mangling it.

None of this is arbitrary. Each rule maps to an actual person doing an actual thing: someone navigating with a screen reader, someone who can't use a mouse because of a motor impairment, someone with low vision zooming their browser to a large magnification. Once you attach a face to a checklist item, "compliance" stops feeling like paperwork and starts feeling like just building the thing correctly the first time.

Worth flagging: WCAG 2.2 came out in 2023 and became ISO/IEC 40500:2025 as of October 2025, adding nine new success criteria aimed at low-vision users, cognitive accessibility, and mobile interaction. WCAG 2.1 AA remains the legal floor right now. But the standard is clearly walking toward 2.2, and building to that slightly higher bar today saves you a second remediation project down the road.

Where most small business websites actually fail

Here's where the data gets genuinely uncomfortable. The 2026 WebAIM Million report, a scan of one million home pages published in February 2026, found that 95.9% of pages had at least one detectable WCAG failure, up from 94.8% the year before. That reverses six straight years of gradual improvement. We were getting better at this, slowly, and then we stopped.

The average page carried 56.1 distinct accessibility errors, a 10.1% jump from the prior year, and a lot of that increase traces back to heavier third-party frameworks and a wave of AI-generated code that nobody checked for accessibility before shipping. Which is its own small irony: the tools meant to speed up development are quietly adding to the pile of things that need fixing later.

Seven years running, the same six failure types dominate every scan:

• Low contrast text, the single biggest offender at 83.9% of pages in 2026, up from 79.1% in 2025
• Missing image alt text, at 53.1%, one of the only categories to improve, down slightly from 55.5%
• Missing form input labels, at 51.0%, up year over year
• Empty links, at 46.3%, also up
• Empty buttons, at 30.6%, up again
• Missing document language declaration, at 13.5%, down, the other bright spot

Four of those six categories got worse. Separately, missing alt text, unlabeled forms, and low color contrast together account for roughly 80% of all ADA complaints, which means the three most common technical failures are also the three most likely to get you sued. Fix those three and you've addressed the overwhelming majority of your legal exposure, not because the rest doesn't matter, but because that's where the actual claims are concentrated.

Part of the problem is just bloat. The average home page carried 1,437 elements in 2026, a 22.5% jump in a single year and nearly double what it was in 2019. More elements, more places for something to break; it's the web design equivalent of adding more rooms to a house without ever checking whether the wiring can handle it.

And here's the thing that should sting a little: none of these top failures are obscure edge cases buried in some technical spec. Low contrast text and missing alt text show up on the first pass of any free scanning tool. Most businesses aren't failing on the hard stuff. They're failing on the stuff a $0 tool would catch in about ninety seconds.

What a demand letter or lawsuit actually costs a small business

Demand letters tend to settle in the $5,000 to $25,000 range, and that number sits there before legal defense costs get added on top. Because the ADA requires the losing party to cover the plaintiff's attorney fees, defense costs alone can land anywhere from $10,000 to $50,000 or more, even in cases that never reach trial.

DOJ investigation is rare, but if it happens, the penalty structure is not gentle: up to $75,000 for a first violation, $150,000 for any violation after that. Layer state law on top and the math gets worse. California's Unruh Civil Rights Act allows $4,000 in statutory damages per violation, and Colorado mandates $3,500 per violation per individual for non-compliant government digital communications. These are not either-or numbers; federal and state exposure stack.

Remember that 46% repeat-defendant rate from earlier? This is where it bites. Paying a settlement without actually fixing your site doesn't close the loop, it just resets the clock until the next demand letter arrives, often from a different firm entirely. You end up paying the toll twice for driving on the same broken road.

Set that whole cost structure next to the price of a professional audit and remediation project, and the comparison stops being close. A proactive fix is, in nearly every case, a fraction of even the low end of a settlement. The financial argument for getting ahead of this isn't subtle once you put the two columns side by side.

What it costs to achieve compliance versus leaving the site as-is

Compliance work breaks into roughly three tiers, and each one covers a different slice of the problem.

Automated scanning tools, running free to around $99 a month, catch somewhere around 30 to 40% of WCAG failures. That's genuinely useful for ongoing monitoring and for catching the obvious stuff (contrast, missing alt text, empty links) fast and cheap. It is not, on its own, a compliance program; it's a smoke detector, not a fire department.

A professional manual audit picks up the remaining failures, the failures that require an actual human tester, sometimes using real assistive technology, to catch. Keyboard navigation quirks, screen reader announcement order, focus traps in a dropdown menu; none of that shows up on an automated scan because none of it is a simple pattern-match. Rates vary a lot depending on site complexity, so there's no single number to quote here honestly.

Then there's remediation itself, meaning the actual developer work to fix what the audit surfaces. Cost swings widely based on how the site was built and how deep the problems go. A site built on semantic HTML with a clean component structure might need a week of focused work. A site glued together from five different plugins and a theme nobody's updated since 2019 might need a rebuild.

That 30-to-40% ceiling on automated tools isn't a reason to skip them; it's the reason to treat them as step one, not the whole staircase. And a word of caution on overlay widgets, the third-party scripts that promise to "fix" accessibility with a single line of code: accessibility professionals broadly consider these insufficient, and several overlay vendors have themselves been named in lawsuits. Slapping a widget on a broken site is a bit like putting a Band-Aid over a check-engine light. It doesn't fix the engine.

One more point worth raising in any developer conversation: if your site's structural problems run deep, rebuilding with accessibility baked in from the start often costs less than years of retroactive patching. And even once you're compliant, you're not done; new content, new plugins, and routine site changes can quietly reintroduce failures, so ongoing monitoring is part of the real cost, not an optional add-on.

A practical starting point for auditing your own site

Start where the exposure is concentrated, because that's the efficient move. Run a free scan using WAVE, axe, or Google Lighthouse; any of the three will surface low-contrast text, missing alt text, missing form labels, and empty links in a matter of minutes. That's the bulk of what's detectable, and it costs nothing.

From there, go image by image. Does each one have alt text that actually describes it? Decorative images (a background texture, a spacer graphic) should have an empty alt attribute so a screen reader skips right past them instead of announcing "image, image, image" forty times on one page. Test your forms next: are the labels actual HTML labels attached to the input, or just placeholder text that vanishes the moment someone clicks into the field? Placeholder text is not a label. It just looks like one.

Check contrast with a dedicated contrast checker; 4.5:1 is the number for body text. Then unplug your mouse, literally or figuratively, and try navigating the entire site using Tab, Enter, and arrow keys alone. Anything that traps focus or simply refuses to respond is a failure, and you'll find these faster than you'd expect. Confirm the page language is declared in the HTML while you're at it; it's a two-second check.

Write down what you find. A spreadsheet with the issue, its location, and the WCAG criterion it violates does two things at once: it gives you an actual roadmap, and it becomes evidence of good-faith effort if a complaint ever lands on your desk. Courts and the DOJ do weigh whether a business was actively working toward compliance. Having a documented plan in motion is a meaningfully better position than having nothing at all.

Automated tools still only get you 30 to 40% of the way there, so manual testing matters, and testing with a real screen reader closes the gap further. NVDA is free on Windows; VoiceOver ships built into every Mac and iPhone. And when you're deciding what to fix first, weigh impact over volume: a broken checkout form that locks out a screen reader user matters more than a missing alt tag on a decorative background image, even if the spreadsheet says otherwise.

How to make compliance sustainable rather than a one-time scramble

A one-time fix doesn't hold, because a website is never actually finished; it's a living thing that new content gets bolted onto every week. Bake accessibility into the routine instead: every new image gets alt text before it's published, every new video gets captions, every new form field gets a real label. These aren't heroic efforts. They're thirty-second habits that quietly prevent the exact failures the WebAIM data shows piling back up year after year.

Set a cadence and actually keep it: a quarterly automated scan, an annual manual review. New plugins, theme updates, and third-party embeds have a bad habit of reintroducing failures on sites that were perfectly fine six months ago. Nobody notices until a demand letter shows up, and by then it's a much more expensive conversation.

Vendor choice matters more than most owners realize. Bolt on a booking widget or chat tool that wasn't built with accessibility in mind, and you've just inherited its problems as your own; your site is only as accessible as its least accessible component. Post a plain-language accessibility statement too: what standard you're targeting, what you're doing about it, and a contact method for users to flag problems. It costs almost nothing to write and it signals good faith before a lawyer ever gets involved.

And if you're bringing on a developer or an agency for a new build, the one question worth asking up front is whether accessibility is part of the build spec from day one, not a retrofit tacked on after launch. A site built with semantic HTML and proper heading structure from the start needs far less ongoing repair than one patched together after the fact. That's really the whole difference: a site that stays compliant versus one that cycles endlessly through audits, fixes, and the next demand letter waiting in someone's inbox.