If you run a city, county, school district, transit authority, utility, library or any other state or local government entity, the Department of Justice now sets a specific technical standard for your website and mobile apps. The deadline is closer than most budgets assume, and the rule reaches further than the homepage.

Quick answer: Under the DOJ’s Title II rule, your web content and mobile apps must meet WCAG 2.1 Level AA. Entities serving 50,000 people or more must comply by April 26, 2027. Smaller entities and all special districts must comply by April 26, 2028. The rule covers content you publish directly and content you provide through vendors, including payment, permitting and application portals.

What the rule requires

The Department of Justice published its final rule under Title II of the Americans with Disabilities Act in April 2024. It adds a new subpart to the Title II regulations (28 CFR Part 35, Subpart H) that requires state and local governments to make their web content and mobile apps readily accessible to and usable by people with disabilities.

For the first time, the rule names a technical standard: the success criteria and conformance requirements of the Web Content Accessibility Guidelines (WCAG) 2.1, Levels A and AA. That gives agencies, vendors and auditors a shared, testable benchmark instead of a general duty to be accessible.

The requirement applies to web content and mobile apps a public entity provides or makes available directly or through contractual, licensing or other arrangements. If a vendor runs your utility billing portal, your court e-filing system or your job application site, that content is part of your obligation.

The deadlines, and who gets which one

In April 2026 the DOJ issued an interim final rule that pushed both compliance dates back by one year. The technical standard did not change. The current dates are:

  • April 26, 2027: public entities, other than special district governments, with a total population of 50,000 or more.
  • April 26, 2028: public entities with a total population under 50,000, and every special district government regardless of the population it serves. That includes water, fire, hospital, transit and many school districts.

Population is generally measured using U.S. Census Bureau data for the jurisdiction. Entities that are part of a larger government, such as a city department or a public university system, take the date that applies to the parent entity. Check the definitions in 28 CFR 35.104 if your status is unclear.

Plan to the published dates. The DOJ has said it may propose further changes to the rule, and the National Federation of the Blind has filed a lawsuit challenging the extension. Neither has changed the dates as of November 2026. Your existing duty under Title II to provide equal access, through accessible content or reasonable modifications, applies today.

What counts as web content and mobile apps

Agencies often scope this as a website project. The rule is broader. Inventory everything a resident, student, employee or business uses online to get information or complete a task with you, including:

  • Your main website and every subsite, microsite and department page.
  • Online forms, applications, payments, scheduling and account portals.
  • Documents posted online: PDFs, Word files, spreadsheets, agendas, minutes, budgets, maps and permits.
  • Video and audio, including recorded meetings, which need captions, and live streams.
  • Mobile apps you publish or provide through a vendor.
  • Third-party platforms you contract for: agenda management, permitting, e-filing, parks reservations, job applications, learning management systems and payment processors.

The documents and vendor platforms are where most agencies find the largest gaps, because they sit outside the web team’s day-to-day control.

The five exceptions, and their limits

The rule lists five exceptions in 28 CFR 35.201. Each one is narrower than it first appears.

  • Archived web content. Content kept only for reference, research or recordkeeping, created before the compliance date (or a reproduction of pre-existing physical media), not altered after archiving, and stored in a clearly marked archive area. Labeling active content “archived” does not qualify it.
  • Preexisting conventional electronic documents. PDFs, word-processing files, spreadsheets and presentations posted before your compliance date, unless they are currently used to apply for, gain access to or participate in your services. A 2019 permit application still in use must be accessible.
  • Content posted by third parties. Comments, posts and uploads from members of the public, unless the third party posts because of a contractual, licensing or other arrangement with you. Your vendors are not third parties under this exception.
  • Individualized, password-protected documents. Documents about a specific person, their property or their account, such as a water bill or a tax statement, that are password-protected or otherwise secured. The portal people use to reach those documents is still covered.
  • Preexisting social media posts. Posts made before your compliance date. New posts after that date must meet the standard.

Even when an exception applies, a person with a disability can still request access to excepted content, and you must provide it through an effective alternative.

Four provisions that shape how you comply

Conforming alternate versions are a last resort. A separate accessible version of a page may be used only where making the original accessible is not possible because of technical or legal limitations (28 CFR 35.202). A text-only site maintained alongside an inaccessible main site does not meet the rule.

Equivalent facilitation is allowed. You may use a different design, method or technique when it provides substantially equivalent or greater accessibility and usability (28 CFR 35.203).

Undue burden and fundamental alteration have a process. If full compliance would fundamentally alter a program or impose undue financial and administrative burdens, the head of the entity or a designee must make that decision in writing, after considering all resources available for the program, and the entity must still provide access to the maximum extent possible (28 CFR 35.204).

Minimal-impact deviations are a narrow defense, not a target. An entity that is not fully compliant may still meet the rule if it can show the deviation has such a minimal impact that people with disabilities can access the same information, engage in the same interactions, conduct the same transactions and participate in the same services with substantially equivalent timeliness, privacy, independence and ease of use (28 CFR 35.205). Build to full conformance and treat this as protection against small, unavoidable defects.

A practical plan to reach compliance

Accessibility programs stall when they start with a site-wide scan and a long list of errors. Start with the services residents depend on, then fix the shared parts that affect every page.

  • Inventory. List every site, subsite, app, portal and document library, with an owner and whether you or a vendor controls it.
  • Prioritize by service. Rank by what people need to do: pay, apply, register, report, attend a meeting, read an emergency notice. Fix those journeys first.
  • Test properly. Combine automated scanning with manual testing: keyboard-only use, screen readers, 200% and 400% zoom, captions and forms. Automated tools find only part of the WCAG issues that matter.
  • Fix templates and components first. Headers, navigation, page templates, form controls and color tokens repeat across hundreds of pages. One fix there removes thousands of errors.
  • Decide your document strategy. Convert high-use documents to accessible web pages, remediate the PDFs people must use, archive what qualifies, and stop publishing new inaccessible files.
  • Bring vendors into scope. Ask every vendor for an Accessibility Conformance Report (ACR) based on the VPAT, test their product yourself, and set remediation dates in writing.
  • Train the people who publish. Headings, link text, alt text, tables, captions and documents are content decisions. Code alone cannot fix them.
  • Publish an accessibility statement and a feedback channel. Tell people how to report a barrier and how to get information in another format, and respond on a defined timeline.
  • Keep it current. Add accessibility checks to procurement, publishing and every release so new barriers do not replace the ones you fixed.

Put it in your vendor contracts

Because the rule covers content provided through contracts and licenses, procurement is now an accessibility tool. For every new purchase and renewal, require conformance with WCAG 2.1 Level AA (or WCAG 2.2 AA, which also covers 2.1 AA requirements), a current ACR, the vendor’s cooperation with your testing, a defined remediation timeline for defects, and notice before updates that change the user interface.

For existing contracts, start the conversation now. A vendor that needs a product release to fix a checkout flow or an application form may need most of the time you have left.

How long it takes

Timelines depend on the number of sites and documents, the age of your platforms and how much sits with vendors. A focused small site can be audited and remediated in weeks. A county with dozens of departments, legacy document libraries and several vendor portals should expect a multi-phase program. For entities on the April 2027 date, that means budget and contracting decisions belong in the current fiscal cycle.

What to do in the next 30 days

  1. Confirm your compliance date: April 26, 2027 or April 26, 2028.
  2. Assign an owner and build an inventory of sites, apps, portals, documents and vendors.
  3. Scan your highest-traffic pages and test your top five resident tasks by keyboard.
  4. Request Accessibility Conformance Reports from every vendor that hosts a public-facing service.
  5. Stop publishing new inaccessible PDFs and set a captioning rule for recorded meetings.
  6. Publish or update your accessibility statement with a way to report barriers.

Questions agencies ask

Does the rule apply if we serve fewer than 50,000 people?

Yes. Smaller public entities follow the same WCAG 2.1 AA standard. Your compliance date is April 26, 2028.

We are a special district. Which date applies?

April 26, 2028, regardless of the population your district serves. That includes school, water, fire, hospital and transit districts.

Is this the same as Section 508?

No. Section 508 applies to federal agencies and the technology they procure. Title II covers state and local governments. Both rely on WCAG, so work done for one usually supports the other.

Should we target WCAG 2.1 or WCAG 2.2?

The rule requires WCAG 2.1 AA. Building to WCAG 2.2 AA is a sound choice for new work because it includes the 2.1 requirements and adds a few more, which keeps you ahead of future updates.

Will an accessibility overlay or widget make us compliant?

No. An overlay cannot repair inaccessible code, documents, video or vendor platforms, and some create new barriers for screen-reader users. Fix the underlying content and code.

Do we have to fix every old PDF?

Not every one. Documents posted before your compliance date are excepted unless people currently use them to apply for, access or participate in your services. Those must be accessible, as must anything you post after the deadline.

What happens if we miss the deadline?

Title II is enforced through DOJ investigations and complaints, and individuals can bring lawsuits. Beyond legal exposure, inaccessible services shut residents out of essential programs. Documented, measurable progress is far better than waiting.

Trusted resources

Know where you stand before the deadline

EVOBRAND helps cities, counties, school districts and special districts meet WCAG 2.1 AA: audits, template and document remediation, vendor reviews and conformance documentation. Start with a free accessibility scan, see our accessibility services, or find our certifications and vendor details on the government & procurement page. Ready to plan? Book a call.