Posted on
I was a guest on Talking Drupal episode #498 (releasing Monday, April 21st) to talk about the Department of justice accessibility ruling. While that podcast is focused on Drupal as a content management framework, the topic is not platform specific.
What is the U.S. Department of Justice Accessibility Ruling?
The Web Content Accessibility Guidelines (WCAG) Version 2.1, Level AA is now the technical standard for state and local governments’ web content and mobile apps within the United States.
The rule became effective June 24, 2024.
Read the full text of the rule (PDF).
Read the fact sheet provided by ADA.gov
Here is a condensed summary of the exceptions:
- “Archived” web content that was created before the date of required compliance that is clearly for reference, research, and/or record keeping in a separate section of the site that has not been updated.
- Preexisting conventional electronic documents (Word, PDF, Powerpoint, Spreadsheets, etc.) created before the date of required compliance. (Hard to audit externally, so expect records requests.)
- Content posted by a third party where the posting is not due to contractual, licensing, or other arrangements with the public entity. This does not include applications provided by a third party via a contract with the government including scheduling, calendaring, reservations systems, maps (Google Maps, ArcGIS, etc.), payment systems.
- Individualized documents that are password-protected such as a water bill PDF or a file that the person can download associated with their account. (I’m really not sure why this is an exception. The wording seems to allow some pretty critical service-delivery documents, such as a personalized water bill, to be exempt.)
- Preexisting social media posts.
- Only technical or legal limitations apply to the use of conforming alternate versions. (I don’t think this one will stand up to scrutiny.)
It will be up to the state or local government to show that a “minor” infringement of WCAG 2.1 AA is still accessible. In practice, that is going to mean a lot of back and forth in the first few rulings against a state or local government that is out of compliance. The cost of the burden of proof will disproportionately fall on the government entity.
Who is impacted? What makes it a government website or mobile application?
First, there is a little bit of a misunderstanding of part of this ruling. It is not aimed at federal websites. Federal websites have been required to be accessible since 1998 with rules and policies over time that have slowly clarified the requirement for WCAG compliance. These standards are known as Section 508.
This new rule is specifically aimed at state, local, and special districts with a timeline for compliance based on the size of the organization.
Examples of state and local governments include:
- State and local government offices that provide benefits and/or social services, like food assistance, health insurance, or employment services
- Public schools, community colleges, and public universities
- State and local police departments
- State and local courts
- State and local elections offices
- Public hospitals and public healthcare clinics
- Public parks and recreation programs
- Public libraries
- Public transit agencies
So this definition is interesting. A school district would be required to use the population of its containing city to know when to comply. That is likely going to get challenged by schools that sit in two cities, but I would imagine, the rule will be enforced more strictly rather than having exceptions for smaller districts within large cities at the outset.
For example, my wife’s school district, she’s a school principal, is relatively small in population compared with the much larger Portland Public Schools district nearby. Both are in the same city, so they have the same deadline despite wildly different resources to address the ruling.
When does the rule require compliance?
It’s all about the organization size, but there isn’t a lot of granularity:
- State and local governments more than 50,000 people need to be compliant by April 24, 2026.
- State and local governments smaller than 50,000 people need to be compliant by April 26, 2027.
- Special district governments need to be compliant by April 26, 2027.
Per the ruling, there is a definition for a special district.
Special district government means a public entity—other than a county, municipality, township, or independent school district—authorized by State law to provide one function or a limited number of designated functions with sufficient administrative and fiscal autonomy to qualify as a separate government and whose population is not calculated by the United States Census Bureau in the most recent decennial Census or Small Area Income and Poverty Estimates.
An example would be something like Metro in Oregon, which is a special district that includes three counties that are in the Portland metropolitan area. I find it a bit odd that a special district serving more than 50,000 people gets a longer deadline. I wonder a bit if this was to allow more time for organizations that may have less funding (in theory) than a state, county, or city. For instance, Metro has a much smaller communications and IT department than most of the counties it serves.
How can websites and mobile applications audit their compliance?
Per Drupal.org’s excellent guidance on running an accessibility review:
Many accessibility problems can be caught by running the page through automated tools. Some of the automated tools include WAVE, Tenon, Accessibility Insights, Google Lighthouse, Siteimprove and the Siteimprove Accessibility Checker extension for Chrome. Some of this can be automated by using axe-core. These tools will help you quickly catch some accessibility issues, such as the incorrect structure of the markup, missing ARIA attributes and insufficient color contrast.
Drupal Core has some accessibility checks that require manual testing when the user interface changes. There is automated coverage planned using Nightwatch tests— though Playwright is being considered as well.
At a minimum, government organizations need to start running at least rudimentary tests against all their web and mobile applications. (I’m really curious why desktop applications were completely omitted. Likely because they are rare, but I could see lawsuits arising.)
All state and local government organizations should start an accessibility audit strategy now. It will put you in a position to know your risks going into next year's initial deadline.
How are most governments faring now?
Sites running Drupal are already a step ahead of most other platforms in the tests I’ve run. Drupal sites are not perfect, but the community’s commitment to accessibility really shows in these sites—particularly ones running on modern Drupal rather than Drupal 7 or earlier.
The biggest risk to government accessibility of web and mobile content is the copious “custom off the shelf” (COTS) applications from third-party vendors that primarily sell to government organizations.
Some of these systems are great—many reduce the costs of providing services that would be expensive to build internally such as permitting systems, legislative records keeping, and tools to report government fraud and request records all have extremely limited accessibility awareness. However, many of these tools were built before accessibility became a priority. Just take GovQA, it has become a go to for records request systems in government. I’ve seen many implementations of GovQA that are woefully out of date and inaccessible. A recent review of a GovQA instance updated in the past two years has errors such as alt=”img” and layout tables. Layout tables are not only an accessibility issue, but they also represent code debt from at least a decade ago. (CSS layouts for forms and content have been the norm since at least 20 years ago.)
GovQA is not alone in these issues. Granicus (which also owns GovQA) has an agenda and meeting management system that has similar levels of accessibility errors and alerts for a typical installation.
I don't mean to pick on Granicus products. They have some great software trying to improve governement services. Their risk is a bit broader than many vendors because they have acquired so many applications from smaller companies over the past 10 to 15 years. The number of vendors and COTS applications in use by state and local governments is significant. Some even have what is known as a Voluntary Product Accessibility Template or VPAT for short. While some governments have just started to require these documents in procurement processes in the last five years or so, there is absolutely zero enforcement of accuracy for VPATs—after all, they are voluntary.
Is one, or even two, years enough time to become compliant?
No. I disagree strongly with the ruling’s assumption that the changes should be cost neutral for most government organizations. COTS applications alone represent years of development needed by third-party vendors that will have no motivation to improve their products when governments have little recourse or alternative products to deploy.
Developing alternative applications for smaller state and local governments is not feasible. Buying alternatives would both require an alternative to exist and that that alternative is similarly priced. Even if similarly priced alternatives exist, the typical government software procurement process—assuming no new hardware requirements—is at least six months and often a year or more.
Unfortunately, state and local governments within the U.S. should have known these requirements were coming for years. Broad accessibility compliance has simply not been a priority in IT departments that are struggling to keep up with overall demand for digital services.
Even if a state or local government makes accessibility remediation for compliance a priority in their web and mobile applications, it will take years of concentrated effort and better procurement gates to ensure new web and mobile applications are accessible from the start.
I expect the ruling's assumptions will get challenged as state and local governments report on the real costs and timelines for compliance.
Why should a government ensure they are compliant with the standards and the ruling?
Well, because it is the right thing to do. Accessible content and services improve the experience for everyone.
And… I truly believe the ruling could be unevenly enforced based on city demographics. There is a clear correlation between voting preferences and urban density. As a result, progressive cities already doing their best to be as equitable as possible could be targeted with lawsuits and hit with significant financial risks for the 2026 deadline. At a time when many of these organizations are already seeing drastic budget cuts, this possibility should not be taken lightly.
Or maybe I’m wrong. The current executive administration has little interest in promoting diversity, equity, and inclusion initiatives. They have even taken steps to remove language about equity from many federal websites. It's also possible that the ruling is not enforced in any significant way by the Department of Justice.
Even if the DOJ does not enforce the ruling actively, there will likely private lawsuits and significant court rulings to consider.
The time is ticking for the April 24, 2026 and April 26, 2027 deadlines. At the very least, state and local governments should be conducting manual or automated audits of every public facing web or mobile application they use to interact with their communities. Only by knowing the scope of the risk can they begin to address it.
Next steps
Step 1: Plan an audit
This post points to a few resources that can help you plan an audit. Your audit may include manual and/or automated tests. The scope of the audit should include all public facing web content (including web applications provided by third-party vendors hosting content on behalf of the government) as well as any mobile applications that can be used by the public.
If your organization does not have a well-defined list of all applications it supports, this is probably the starting point.
Step 2: Prioritize services
The biggest impact will be online services that may also serve to reduce costs associated with delivering those services. Think about your tools that are used most often: "pay my water bill", "sign up for garbage and recycling pick up day alerts", "look up your property taxes", etc.
Step 3: Know your risks
Review the ruling and your accessibility audit and remediation plan with your legal council (city or county attorney for example). Your organization may not be able to meet compliance for all of its web and mobile content before the deadline. Risk and impact will need to be balanced in planning compliance timelines.
Do you have a project or team that needs some expert help? Do you just want to chat about the DOJ Accessibility Ruling and what it might mean to your organization? Connect with me on LinkedIn or reach out to me on Drupal Slack (@joshuami).