Website Accessibility in 2026: The WCAG 2.2 Business Guide

A founder we know got a letter this summer. Not an email — a physical letter, from a New York law firm, naming his ecommerce store and listing fourteen accessibility failures on his website. Missing alt text. Unlabeled checkout fields. Text you could not read if your eyesight was imperfect. He had thirty days to respond. The settlement discussion opened at a number with five digits in it.

He runs his store from Pakistan. His customers are mostly American. Neither fact made the letter go away.

Stories like his are no longer rare. They are the fastest-growing legal pattern in American ecommerce, and 2026 is on track to set another record. Website accessibility has crossed a line: it is no longer a design virtue you aspire to. It is a compliance problem you either handle on your schedule, or pay for on a lawyer's schedule.

This guide is the business owner's version of what we do in our studio for clients in the US and Pakistan. The real lawsuit numbers, what WCAG 2.2 actually demands, what fixing a site costs, and the order to fix things in. No moralising. Just the mechanics.

The numbers are ugly, and getting worse

Trackers who monitor digital accessibility litigation — firms like UsableNet and Seyfarth Shaw's ADA Title III group — put the 2026 numbers in plain language. Plaintiffs filed 1,037 ADA website lawsuits in US federal courts in the first quarter of 2026 alone, a 5.5% increase over the same quarter last year. UsableNet projects roughly 6,176 digital accessibility lawsuits for the full year, about 20% above 2025's count of 4,928. Independent assessment firms call it a record pace and expect filings to top 6,000.

Those are the cases that reach a courtroom. The shadow number is bigger: an estimated 35,000 to 50,000 demand letters went out to US businesses in 2025. Most never become lawsuits, because most businesses settle or remediate quietly. Every one of them still cost money to answer.

Three patterns in the 2026 data matter for where you sit:

Ecommerce takes the beating. Roughly three quarters of 2026 filings target online retail. Food service, healthcare, and entertainment follow. If your site takes money online, you are the demographic.

Four states drive the filings. New York, Florida, California, and Illinois account for roughly three quarters of all cases. California's Unruh Act attaches statutory damages to each violation, which makes it financially attractive to plaintiff firms. But the internet is the internet — a store registered in Karachi selling to customers in California is exposed there regardless of where the office is.

A case costs six figures. Industry trackers put the total cost of a single ADA website case at $55,000 to $270,000 once you add legal defence, settlement, remediation under a court schedule, and monitoring. The plaintiff-side firms have industrialised: over forty firms are now actively filing these cases, and a handful of serial plaintiffs file dozens each. Courts have started scrutinising the worst of the repeat-filer patterns, but most cases survive early dismissal motions. The machine keeps running.

And here is the number that should end one persistent myth. More than a quarter of the companies sued in 2026 already had an accessibility widget installed on their sites. The little floating icon in the corner — the one sold as legal protection — has not proven to be a meaningful deterrent, legally or practically. In some cases it showed up in the complaint as evidence that the company knew the problem existed and bought a cosmetic answer instead.

The letter usually comes before the lawsuit

The filed cases are the visible tip. Below them sits the demand-letter economy: an estimated 35,000 to 50,000 letters in 2025, each one naming specific failures and each one demanding a response. Most never reach a court because the recipient either settles or remediates. That makes the letter, not the lawsuit, the threat you are most likely to meet — and it is the cheapest one to defuse. A business that can answer a demand letter with a dated audit, a remediation log, and a monitoring schedule is negotiating from strength. A business that answers with "we didn't know" is negotiating with a number. We have watched Pakistani founders and US small businesses alike discover this the same way: the letter arrives on a Tuesday, and the next thirty days cost more than the audit would have.

Why 2026 is the year this caught fire

Accessibility lawsuits have grown every year since 2017. So what changed this year to push them to a record?

The benchmark finally exists

For years, defendants could argue about which standard applied. The DOJ has never issued detailed Title III regulations for web content — it left businesses with "flexibility" and a general duty of nondiscrimination, which is another way of saying nobody knew exactly what compliance meant. That argument is now gone. As of January 2026, WCAG 2.2 Level AA is the explicit legal benchmark for US federal agencies, and plaintiff lawyers have adopted it as the de facto standard in complaints. The ambiguity that used to protect you has evaporated. Auditors, judges, and opposing counsel all point at the same document now.

The overlay era is over

The accessibility widget industry sold a seductive promise: install a script, get a floating toolbar, become compliant. In 2025 the US Federal Trade Commission approved a final order requiring accessiBe to pay $1 million over allegedly deceptive claims that its accessWidget could make any website WCAG-compliant and keep it that way. The order bars the company from making such representations without supporting evidence.

That case killed the industry's central marketing claim. What it did not kill is the installed base: thousands of sites still run overlays, and plaintiff-side research now treats their presence as a tell. Our position is blunt. An overlay changes how a site looks to a passing visitor; it does not change how the site behaves for a screen reader, and it does not fix your markup. Buying one in 2026 is paying for the illusion of compliance while preserving the exposure. The defence that actually works, in the words of the assessment firms who testify in these cases, is documented WCAG conformance: audit, remediate, monitor, and keep dated evidence of all three.

Enforcement got personal for small business

One of the loudest complaints in 2026's small-business communities is bewilderment: owners describing getting a summons with no idea which rule they had broken. The three failures named most often in complaints are missing image alt text, unlabeled form fields, and pages that cannot be used with a keyboard. These are not exotic technical defects. They are the kind of things a template theme ships with out of the box. A large share of defendants are small businesses, not enterprises — which is exactly why this matters to you more than a Fortune 500 compliance programme matters to them. The big companies have legal departments. You have a website.

What WCAG 2.2 actually asks of your site

WCAG — the Web Content Accessibility Guidelines — is the W3C's standard for making web content usable by people with disabilities. Version 2.2, published in 2023, is current. It keeps everything from 2.1 and adds nine success criteria, concentrated in three areas: focus visibility, touch-target size, and cognitive accessibility (especially authentication). Level AA is the target. Not AAA — that is aspirational for most commercial sites and is not the legal standard. Aim at AA and you aim at what the lawsuits are argued against.

The litigation research is remarkably consistent about where sites fail. Six failures account for roughly 96% of all accessibility errors and appear in almost every complaint. Here they are, with the fix that actually resolves each one:

The three new WCAG 2.2 criteria most likely to bite you:

Focus appearance (2.4.11). When a keyboard user tabs to an element, the focus indicator must be clearly visible — strong contrast, sufficient thickness, and never obscured by a sticky header. If your designer removed the default browser outline because it "looked ugly" and replaced it with nothing, WCAG 2.2 calls that a failure. Bring it back, styled to your brand.

Target size (2.5.8). Interactive elements need a minimum target of 24 by 24 CSS pixels. Tiny pagination links, icon-only buttons jammed together, and microscopic "remove from cart" crosses are the usual offenders. On mobile this matters doubly — small targets are a barrier for anyone with a tremor, arthritis, or just a six-year-old phone.

Accessible authentication (3.3.8). If your login requires solving a puzzle, remembering an obscure detail, or completing a visual challenge like a CAPTCHA, you must offer an alternative that does not depend on a cognitive test. Password managers, passkeys, and email magic links all qualify. A CAPTCHA-only login does not.

The contrast problem is a fashion problem

A study published in October 2026 — an assessment of 750 UK care provider websites — found that 89% of sites had text somewhere failing the contrast standard, and a quarter of all text sampled across every page failed. Just 19 of the 750 passed every automated check.

The researcher put the blame squarely where it belongs: pale grey on white is the fashion, and has been for a decade. It looks restrained on a designer's colour-calibrated monitor in a dim room. It disappears on a six-year-old phone held at arm's length in a hospital corridor by someone in their seventies. That contrast failure is not a technical footnote — it is the single most common barrier actual visitors hit, and it is a choice. Somebody picked that grey. Pick a darker one. This is the cheapest accessibility fix that exists, and most sites still have not made it.

Your newest visitor doesn't have eyes

Here is the twist that makes accessibility a 2026 business decision rather than a legal one. Jakob Nielsen's UX Roundup from September 2026 reported on a three-week field study in which eight blind screen-reader users delegated 1,258 real desktop tasks to an AI agent. The agent fully completed 53% of them — graded against perfection, a coin toss, but graded against the realistic alternative (screen-reader users complete roughly 25–55% of comparable tasks after thirty years of accessibility work), the agent is already competitive. And agent capability is improving roughly 30 percentage points a year on desktop benchmarks, against the one to three points a year that screen-reader accessibility manages.

Two things follow from this. First, disabled users are getting a second way into your site: through an agent that reads your pages on their behalf. Second — and this is the part business owners should hear — those agents read the same machine structure that accessibility depends on: real labels, real headings, real form semantics. A site with proper landmarks, descriptive alt text, and logical heading order is not only accessible to a blind person. It is legible to the AI agents that are increasingly browsing, comparing, and buying on behalf of everyone.

John Maeda's 2026 Design in Tech report gave this shift a name: AX, agent experience. Checkout pages and forms are being rebuilt for a user that has no eyes and no patience for ambiguity. Visa, Mastercard, and Stripe have all shipped protocols in the last year letting an AI agent hold a payment token and complete a purchase directly, without a human ever looking at a checkout screen. The cheapest way to be ready for that future is the work you were going to do for WCAG anyway: clean semantic markup, labelled everything, text that means what it says. Accessibility is not a parallel track to the agent era. It is the on-ramp.

What an accessibility audit costs in 2026

The honest answer is that it costs a fraction of one lawsuit. But "a fraction" is not a budget, so here is the range as we see it in our own studio practice, in both markets:

The US–Pakistan price gap is overhead, not rigour. A senior accessibility auditor in Lahore uses the same Axe engine, the same NVDA screen reader, and the same WCAG criteria as one in New York. What you should never pay for is the scan-only tier dressed up as an audit — a PDF of automated results is what you can generate yourself in an afternoon, and no court treats it as evidence of conformance.

A word on timelines: a 10–25 page site takes four to eight weeks end to end — roughly a week for the audit, two to four for remediation, and a final week of testing and documentation. Large ecommerce sites take longer because every template variant, filter interaction, and checkout step needs its own pass. We wrote up the general process behind our website UX audits separately; accessibility is the compliance-focused branch of that same discipline.

How we fix sites: the order that matters

When a client hires us for accessibility work, we do not start with a redesign. Redesigns are expensive, slow, and — worst of all — they reset every documented fix you made. We start with the list above and work in this order:

0. The theme triage

Most sites we see run on WordPress, Shopify, or a bought template, and templates are where most barriers are born. Before anything else, we check whether the theme itself is fighting us: a page builder that emits divs instead of buttons, a slider plugin with no keyboard support, a mega-menu that only opens on hover. Sometimes the cheapest fix is replacing one plugin, not patching fifty pages. If your theme cannot produce labelled, keyboard-operable output, no amount of content work will save it — know this before you budget for the rest.

1. The contrast and colour pass

Darken the greys, fix the failing pairings, enforce a minimum 4.5:1 ratio for body text. This is a stylesheet change on most sites, measured in days, and it removes the most common barrier visitors actually hit. Run every colour pairing through a contrast checker — not just the body text, the placeholder text, the disabled buttons, the footer links, the cookie banner.

2. Alt text and labels

Every informative image gets a description written by a human who knows what the image is trying to say. Decorative images get empty alt attributes so screen readers skip them. Every form input gets a real label. This is tedious, unglamorous, and the single most-cited failure in lawsuit complaints. There is no shortcut that survives scrutiny — certainly not an AI that writes "a photo of a product" and calls it done. (We do use AI to draft alt text for large image libraries, then have a human approve each one. Draft, never publish blind.)

3. The keyboard pass

Unplug the mouse and use the site. Every menu, modal, dropdown, carousel, and checkout step must be reachable and operable by keyboard alone, in a sensible order, with a visible focus indicator everywhere. This is where template themes fail most often: modals that trap nothing and trap everything, mega-menus that open on hover and never on focus, date pickers that only respond to clicks. Fix the traps, restore focus to the element that opened the modal, and never remove a focus outline without styling a better one.

4. Structure and landmarks

Rebuild the heading outline so it reads like a table of contents: one h1 per page, h2 sections, h3 subsections, in order, no skips. Add landmark regions — header, nav, main, footer — so assistive technology can jump around the page. This is also the step that pays off for the agent era: machine readers navigate by structure, and a page with a clean outline is a page an agent can understand.

5. Forms and error handling

Forms are where real users suffer most. Labels first, then clear error messages tied to the field they describe (not "invalid input" floating at the top of the form), then the authentication check: if your login relies on a puzzle or a visual CAPTCHA, add a passkey or magic-link alternative to satisfy WCAG 2.2's accessible-authentication criterion. Good form design and accessible form design are the same discipline — every clarity improvement converts better for everyone.

6. The evidence file

Document everything: the audit report with dates, the remediation log showing what changed and when, the re-test results, and a statement of ongoing monitoring. This is the file you hand over if a letter ever arrives. Lawsuits are fought on evidence, and "we fixed it" without dates and re-tests is a story, not a defence. Schedule quarterly rescans, because every deploy adds small frictions that compound quietly — a regression in a new component can undo months of work in one merge.

FAQ

Does my small business really need WCAG compliance?

If your website does business in the United States — takes orders, books appointments, or serves US customers in any way — the lawsuit data says yes. The majority of defendants in 2026's filings are small and mid-sized businesses, not enterprises, because they are easier targets with thinner legal departments. Compliance is also just good business: the fixes improve conversion for every visitor, and the cost of a planned audit is a small fraction of a single case.

Is WCAG 2.2 Level AA enough, or should I aim for AAA?

AA. That is the explicit benchmark for US federal agencies as of January 2026, the level plaintiff lawyers argue against, and the level every serious auditor targets. AAA includes criteria — like sign-language interpretation for all video — that are not realistic for most commercial sites and are not the legal standard. Get to AA, document it, and maintain it.

How is a WCAG 2.2 audit different from the UX audits agencies sell?

A UX audit hunts for conversion friction broadly — messaging, information architecture, speed, persuasion. A WCAG audit hunts for barriers against a defined standard, tested with assistive technology. They overlap heavily (unclear forms hurt everyone), and the smartest engagements run them together. But a general UX audit with no screen-reader testing and no WCAG criteria is not evidence of accessibility conformance, whatever the proposal document implies.

We installed an accessibility widget last year. Are we covered?

Almost certainly not. More than a quarter of companies sued in 2026 had a widget installed, and regulators have moved against the industry's central claims — the FTC's $1 million order against accessiBe in 2025 barred it from claiming its tool could make sites WCAG-compliant. Treat any widget as decoration. Then commission the audit.

What does accessibility cost for a Pakistani business specifically?

Because most accessibility lawsuits target US-facing commerce, Pakistani businesses face the same exposure at local prices. Our observed range for a Pakistani studio: PKR 150,000–400,000 for a manual audit of a typical business site, PKR 300,000–1,200,000 for remediation, and PKR 800,000–2,500,000 for a full ecommerce remediation. If you earn in dollars and pay for the fix in rupees, accessibility is one of the cheapest risk reductions you can buy. We break down what studios charge for design work in the same way.

Can AI fix my site's accessibility automatically?

No — and this is the one AI claim you should refuse. AI agents are excellent at the mechanical parts: scanning pages, flagging missing alt text, detecting contrast failures. They cannot judge whether alt text is meaningful, whether a label's wording makes sense, or whether a keyboard flow feels right. We use AI for the scan and humans for the verdict. A site that was "fixed by AI" with no human verification is still exposed, and now you have spent money on a story instead of a fix.

How often should we re-check accessibility after the fix?

Quarterly at minimum, plus a check on every deploy that touches interactive components. Accessibility regresses silently: a new modal ships without focus trapping, a marketing page goes live with pale grey body text, a plugin update breaks a label. The sites that stay compliant treat accessibility like security patching — a standing practice, not a project with an end date.

Make it a project, not a panic

The demand letter is how most businesses first think about accessibility, and by then the options are bad: settle, remediate on a court's schedule, or litigate at six figures. The alternative is unglamorous and cheap by comparison — an audit, a prioritised fix list, documented re-tests, and quarterly rescans. That is the entire programme. It is the same discipline as any other maintenance, and it protects you from the fastest-growing legal risk in American ecommerce while making your site better for every human — and every agent — that visits it.

We run WCAG 2.2 audits and remediation for businesses in the US and Pakistan. If you would rather handle this on your schedule than on a lawyer's, talk to us — we will tell you where your site stands before anything costs you money.