Section 508 vs the ADA vs WCAG: Which Standard Actually Binds You?

These three terms get used as though they were interchangeable. They are not the same kind of thing at all, which is why the question "are we ADA compliant?" so often produces an unsatisfying answer.

One is a civil rights statute. One is a federal procurement standard. One is not a law in any country — it is a technical specification that laws point at. Sorting out which is which takes about two minutes and saves a great deal of confusion, including the expensive kind that shows up in a contract. For where these three sit among everything else that can bind a site, see website legal requirements.

WCAG is the specification, not the law

The Web Content Accessibility Guidelines are published by the World Wide Web Consortium, an international standards body with no enforcement power whatsoever. Nobody can sue you for failing WCAG as such.

What makes WCAG matter is that it is the thing every regulation, contract and court settlement points at when it needs to define what "accessible" means. It is the measurable specification underneath the legal language. That is also why arguing about whether you are "ADA compliant" is unproductive while arguing about whether you meet a named WCAG version and level is productive: only the second can be tested.

WCAG comes in versions — 2.0, 2.1 and 2.2 — and levels: A, AA and AAA. AA is the operative tier essentially everywhere. AAA is not designed to be achievable across an entire site, and a requirement demanding it usually indicates the phrase was copied from somewhere without being understood.

The ADA is the statute, and for private business there is no web rule

The Americans with Disabilities Act is a civil rights law. It predates the commercial web and does not mention websites. Two of its titles matter here.

Title II covers state and local government. This one now has a specific rule: the Department of Justice published a regulation naming WCAG 2.1 Level AA, with staged compliance dates. Those dates were extended by a year in April 2026 and now fall in April 2027 for entities serving 50,000 or more people, and April 2028 for smaller entities and special districts. We cover it in detail in our guide to the Title II rule.

Title III covers private businesses open to the public — shops, restaurants, clinics, banks, most commercial websites. Here is the part that surprises people: there is no web accessibility regulation under Title III. The rulemaking has been paused indefinitely, and since September 2025 the DOJ has said it is re-examining its ADA regulations generally.

That absence is routinely misread as meaning private businesses are unregulated. The opposite is closer to true. Because no rule defines conformance, the question of what Title III requires is answered case by case, in litigation, and courts have overwhelmingly been willing to apply the statute to websites. Thousands of web accessibility suits are filed each year, and the practical standard that plaintiffs, defendants and settlements converge on is WCAG AA — the very specification no regulation obliges private businesses to meet.

So the honest summary for a private business is: no deadline, no regulator coming, and real exposure. It is a litigation risk rather than a compliance one, which changes how you should think about it but not whether you should.

Section 508 is procurement, and it reaches further than you think

Section 508 of the Rehabilitation Act applies to federal agencies: what they build, buy and use must be accessible. Its technical standard incorporates WCAG — and this is where the version confusion begins, because it still incorporates WCAG 2.0 Level AA. The Access Board has been reviewing alignment with newer versions, but the standard itself has not moved.

The reason 508 matters to organizations that are not federal agencies is procurement. If you sell to the federal government, or subcontract to someone who does, 508 conformance is typically a contract condition, and you will be asked for evidence. That is also why the VPAT exists: it was created to answer 508 procurement questions, and it has since become the general-purpose format for reporting conformance to anyone who asks.

Many states have their own procurement rules modelled on 508, which is how the standard reaches suppliers who have never sold to a federal agency in their lives. If you are bidding for public work of any kind, read the solicitation rather than assuming.

The rule that catches healthcare

There is a fourth requirement that belongs in this list and is missing from almost every article comparing the other three.

A rule issued under Section 504 of the Rehabilitation Act requires recipients of federal funding from the Department of Health and Human Services to meet WCAG 2.1 Level AA. That reaches a very large share of American healthcare — community health centres, Head Start agencies, and providers participating in Medicare, Medicaid and CHIP. Its deadlines were also extended by a year and now fall in May 2027 and May 2028, staged by employee count.

If you are a healthcare organization, this is probably the requirement that actually binds you, and it is not the ADA. Our post on the HHS web accessibility rule covers scope, exceptions and what to do first.

The version table nobody prints

Put the four together and something awkward becomes visible.

• Section 508 — WCAG 2.0 Level AA
• ADA Title II (state and local government) — WCAG 2.1 Level AA
• HHS Section 504 (recipients of HHS funding) — WCAG 2.1 Level AA
• ADA Title III (private business) — no rule, no named version; WCAG AA in practice

Not one of them cites WCAG 2.2, which has been the current published recommendation since October 2023 and is what most checklists, tools and agency proposals now teach.

This is not a reason to build to an older version. WCAG 2.2 is backward compatible with 2.1, which is backward compatible with 2.0, so a site meeting 2.2 AA meets all three by construction. Build to 2.2.

It is a reason to be careful about what you write down. In a contract, a grant report, an RFP or an accessibility statement, name the version the rule that applies to you names. Claiming conformance with a version nobody asked about — or worse, claiming conformance you have not tested — creates a discrepancy that is entirely avoidable. Our guide to accessibility requirements in a website RFP shows how to word this so the build target and the contractual floor can differ without contradicting each other.

Two more that may apply to you

State law. Several states impose their own requirements, and state civil rights statutes are where most private-sector litigation now happens — roughly four in five accessibility claims are filed in state rather than federal court, because state statutes often carry damages the ADA does not. California's Unruh Civil Rights Act, with statutory damages starting at $4,000 per violation, is the best-known example and a large part of why California is a filing hotspot.

The European Accessibility Act. If you sell into the EU, it has applied since June 2025, it is extraterritorial in the same way GDPR is, and conformance is assessed against the European standard EN 301 549. A US company shipping to European customers can be in scope regardless of where it is incorporated.

So which one binds you?

Work down this list and stop at the first that fits.

State or local government body: ADA Title II, WCAG 2.1 AA, April 2027 or 2028.

Recipient of HHS funding, which includes most healthcare providers: the Section 504 rule, WCAG 2.1 AA, May 2027 or 2028.

Federal agency, or selling to one: Section 508, WCAG 2.0 AA, and expect to supply a VPAT.

Selling into the EU: the European Accessibility Act and EN 301 549.

Everyone else — private business open to the public: no rule, no deadline, and a real and active litigation risk measured against WCAG AA.

In every one of those cases the engineering answer is the same, which is the useful part: build and test to WCAG 2.2 Level AA. What changes between them is the deadline, the evidence you have to produce, and the number you write in the contract. If you want to know where your site currently stands, an accessibility audit is the place to start, and we have written about what one costs. Our Section 508 compliance service covers the procurement side.

This article is general guidance and not legal advice. Which requirements apply to your organization is a question for your counsel.