DOJ's Proposed Web and Mobile App Accessibility Regulations: An Overview

On August 4, the U.S. Department of Justice (DOJ) released its long-anticipated notice of proposed rulemaking (NPRM) on accessibility standards for website and mobile applications under Title II of the Americans with Disability Act (ADA). DOJ had issued a supplemental advance notice of proposed rulemaking (SANPRM) soliciting public input on potential web accessibility regulations in 2016.^Footnote1 A SANPRM is an interim step in the regulatory process in which an agency seeks information on a potential regulatory issue before proceeding with an actual proposal. DOJ formally announced that it would pursue an NPRM on the topic in 2022.^Footnote2

Background

The NPRM from DOJ focuses on web and mobile app accessibility under Title II of the ADA, which protects individuals with disabilities from being excluded from participating in or receiving the benefits of services or programs provided by a state or local government entity.^Footnote3 If implemented, the proposed rules would apply to public higher education institutions. However, the NPRM should be a focal point for all colleges and universities, as the EDUCAUSE policy team expects that any final rule will serve as a template for web accessibility regulations to be promulgated under Title III of the ADA. Title III prohibits discrimination against persons with disabilities in places of public accommodation, including any privately operated entity affecting commerce. Thus, web and mobile app accessibility requirements under Title III would apply to private higher education institutions. The Department of Education has also indicated that it plans to issue web accessibility regulations pursuant to Section 504 of the Rehabilitation Act, which prohibits discrimination in all public and private programs receiving federal financial assistance.^Footnote4 Those regulations will also align with any final DOJ regulation stemming from the ADA Title II rulemaking and apply to any public or private higher education institution receiving federal funds (which is almost all of them).

In the thirty-three years since the ADA was enacted, DOJ has never issued regulations regarding the obligations of public entities to ensure accessibility in the digital realm. In the absence of formal agency guidance, the Web Content Accessibility Guidelines (WCAG) have become the go-to standard for web content accessibility. The courts have even accepted them as such; in fact, many lawsuits are settled on the condition of WCAG compliance. Since WCAG 1.0 was released in 1999, the Web Accessibility Initiative (WAI) of the World Wide Web Consortium (W3C) has issued three subsequent versions of the guidelines: WCAG 2.0 (2008), WCAG 2.1 (2018), and WCAG 2.2 (October 2023).

Key Parts of the NPRM

DOJ released its web and mobile app accessibility NPRM on August 4, providing the public with only a sixty-day comment period. While agencies regularly set comment periods of thirty to sixty days, they commonly grant more time for public comment on particularly complex regulations. Given that the NPRM marked DOJ's first formal proposal concerning web accessibility regulations under the ADA, the proposal itself was extremely long and detailed (spanning more than two hundred pages), and the proposal was issued at a challenging time for higher education professionals (as campuses were readying for the new academic year), EDUCAUSE asked DOJ to extend the comment period so subject matter experts from the higher education IT community would have adequate time to provide comprehensive feedback. Unfortunately, DOJ declined this request, so EDUCAUSE submitted comments to the agency by the October 3 deadline.

Before discussing the substance of those comments, a review of key aspects of the NPRM is in order.

• Technical Standard: The NPRM proposes WCAG 2.1 level AA (the middle level of conformance) as the standard to which covered entities must adhere. That said, DOJ asked in the NPRM whether it should adopt the then-pending next iteration of the WCAG standard (2.2) instead. WCAG 2.2 was released in early October following the comment deadline.
• Compliance Time Frames: DOJ provides two time frames for covered entities to achieve compliance with the regulation. Small public entities—those with U.S. Census-defined population sizes of less than 50,000 people—would receive three years to comply. Large public entities—those with Census-determined populations of 50,000 or more—would get two years to reach compliance.
• Large versus Small Entities: DOJ would base the size of a higher education institution on the size of its governing jurisdiction. For example, the size of a state college, and therefore the amount of time it would have to achieve compliance, would be based on the population of that state.
• Limited Exceptions: The NPRM proposes limited exceptions to the WCAG 2.1 AA requirements for public entities. Such exceptions would include archived web content, preexisting conventional documents, web content posted by a third party, and content housed on a password-protected website that is not available to the general public, such as password-protected course content. The password-protected course content is of particular interest to higher education institutions.
• Measuring and Assessing Compliance: Notably, DOJ acknowledges in the NPRM that a compliance assessment approach that requires entities to achieve 100 percent compliance with the required standard 100 percent of the time probably is not feasible given that "websites and mobile apps are dynamic and interconnected, and can contain a large amount of complex, highly technical, varied, and frequently changing content."^Footnote5 Given this, DOJ has requested public feedback on the feasibility of the following five potential compliance pathways: robust policies and practices, 100 percent compliance, percentage-based compliance, fulfillment of a performance standard, and achievement of a certain level of organizational maturity (as defined by an organizational maturity model).

Comments from EDUCAUSE

In consultation with its members, EDUCAUSE submitted comprehensive feedback to DOJ in response to its NPRM. EDUCAUSE members are dedicated to providing students with access to content regardless of disability status and support the efforts of the DOJ to clarify and define web and mobile app accessibility obligations under Title II of the ADA.^Footnote6 That said, our response to the NPRM focuses mainly on how DOJ should tailor any final regulation to acknowledge the unique operational characteristics that dictate how higher education institutions approach accessibility. Campuses provide students and the public with a massive amount and wide variety of digital content and technologies, and these things are frequently procured from external sources. In addition, because various departments and programs must produce highly specialized and targeted materials to fulfill their missions and serve their constituents, content generation at colleges and universities is typically decentralized and occurs across numerous sources. Ensuring appropriate accessibility awareness and training across all sources is a constant challenge.

These realities serve as the context for our examination of and response to the NPRM.

• Technical Standard: Our comments support the adoption of a realistic, recognized, and universally understood standard for the accessibility of web-based/digital content.^Footnote7 We agree with the proposal from DOJ to adopt WCAG 2.1 AA as the standard, while registering concern that DOJ is considering adopting WCAG 2.2—which had not been finalized at the time the NPRM was released—without full notice-and-comment rulemaking on it. Our comments raised the possibility of creating a safe harbor for entities adhering to future WCAG standards above and beyond 2.1 AA as the regulatory standard to avoid the complications that might result from adopting WCAG 2.2 without first going through the full notice-and-comment process. Creating a safe harbor would allow DOJ to encourage institutions with the capability of moving farther and faster to do so without worrying about formal and often lengthy rulemaking each time a new version of WCAG appears on the horizon. Finally, recognizing that institutions procure large volumes of digital content and that most of their mobile apps are deployed from external sources, we urged DOJ to incorporate a "best meets" provision in any final regulation, which would be consistent with the accessibility regulations that the federal government follows. Under such a provision, an institution would be permitted to procure content, apps, and so forth that "best meets" the standard when a fully conforming option is not commercially available.
• Compliance Time Frames: Notwithstanding the assertion in the NPRM that most higher education institutions could achieve compliance within the two-year time frame afforded to large entities regardless of institution size, feedback from EDUCAUSE members indicates that the bare minimum time that exceedingly well-resourced institutions would need to comply with the NPRM is three years.^Footnote8 This is mainly due to the large and varied amount of digital content colleges and universities handle and the reality that many institutions will need to engage external consultants to help them prepare for and achieve compliance. The consultant market is quite limited, and high demand from state and local government entities, in addition to colleges and universities, would rapidly exhaust capacity, leading to additional delays and service bottlenecks. With these factors in mind, our comments suggest that DOJ consider the following compliance time frame options:
  • A longer time frame. As noted, three years represents the bare minimum amount of time that large, well-resourced institutions would require. Realistically, many such institutions will need additional time (years) beyond that, and less resourced and rural institutions will likely need an even longer phase-in period, given their more limited access to external expertise and services.
  • A tiered or phased approach that includes a minimum of three years to address core content and functionalities and additional time in one or more succeeding phases to address remaining content.
  • An appropriate amount of time to complete an audit or assessment and develop a remediation plan. Practically speaking, the feasibility of a compliance time frame is contingent on the degree and extent of remediation required. With that in mind, EDUCAUSE suggested that DOJ consider establishing an appropriate time frame for an entity to obtain and complete an assessment and establish a plan to address remediation. The time for institutions to complete the remediation would depend on the particular circumstances of the audit, as well as institutional financial resources and human capital.
  • DOJ should establish an order of priorities for institutions to address their web-based content and technologies to help institutions work appropriately toward compliance, given the large volume and varied nature of content and technologies across postsecondary institutions.
• Large versus Small Entities: Our comments on the NPRM register concern about basing the population size of an institution on its governmental jurisdiction, as doing so does not account for differences between institutions and other public entities—particularly with respect to how they are financed. As such, we urge DOJ to reconsider its approach and consider adopting a classification system for colleges and universities that is already recognized in higher education, such as the Carnegie Classification of Institutions of Higher Education.
• Limited Exceptions: Our comments place a particular focus on the password-protected course content exception, given our significant concerns about how the NPRM describes limitations to that exception (although interested parties should review the comment document for additional input regarding the other exceptions DOJ proposes to grant). The NPRM states that the postsecondary course content exception no longer applies when an institution receives notice that an individual will require such content to be made accessible. If such notice is provided via the regular course registration process, the content would need to be made accessible by the start of the term. If notice is provided after the term begins—such as during the add/drop period—content would have to be made accessible within five business days. Our comments express serious concern that the proposed limitations do not adequately or reasonably consider the practicalities surrounding how and when course content is generated, the volume of that content, the frequency and manner in which the content can be changed, and the lead time required to convert or obtain accessible content formats. We also note that the NPRM fails to acknowledge that at many institutions, a student may preregister for a class until the course begins. Therefore, we suggest that DOJ consider the following approaches:
  • Provide institutions with at least ten to fifteen days to procure or provide accessible course content.
  • Identify a specific compliance time frame before the course will utilize a particular piece of content, given that all course content is not consumed on the first day of the term.
  • Provide for content remediation based on a registered student's particular needs and not full WCAG 2.1 AA compliance. (The proposed regulation would require content remediated under the limitations to comply fully with 2.1 AA, regardless of the specific accessibility needs of the student in question.)
• Measuring and Assessing Compliance: DOJ proposes five possible pathways for determining compliance with the potential rules. Our comments indicate a strong preference for the "policies and practices" approach, where an institution could demonstrate compliance by establishing and following robust policies and practices for accessibility feedback, testing, and remediation. However, we note that this path still poses challenges for higher education institutions, and its feasibility rests on how DOJ ultimately defines what constitutes a sufficiently "robust" policy. These concerns notwithstanding, our view is that this approach is the only proposed compliance pathway that accommodates variability across small and large entities and is flexible enough to adapt to the particular circumstances and content to which it is applied.

While this article summarizes the core components of the NPRM and the feedback submitted by EDUCAUSE, we encourage interested stakeholders to review our full comments for a more comprehensive discussion of the NPRM and its potential impacts on public postsecondary higher education institutions.

The comment period for DOJ's NPRM closed on October 3. It is unclear how long DOJ will take to review the hundreds of comments submitted in response to the proposal and develop any final regulation. EDUCAUSE will keep members apprised of developments related to DOJ's NPRM and any other web and mobile app accessibility policy actions the Biden administration may pursue.

Notes

1. Jarret Cummings, "EDUCAUSE Comments: ADA Web Regulations Supplemental Advance Notice," EDUCAUSE Review, October 12, 2016; EDUCAUSE submitted comments on the 2016 SANPRM along with several major higher education associations: EDUCAUSE letter to Rebecca Bond, Disability Rights Section, U.S. Department of Justice, "Re: RIN 1190-AA65 (CRT Docket ID No. 128)," October 7, 2016. Jump back to footnote 1 in the text.↩
2. U.S. Department of Justice, "Nondiscrimination on the Basis of Disability: Accessibility of Web Information and Services of State and Local Governments," in Office of Information and Regulatory Affairs Office of Management and Budget, Spring 2022 Unified Agenda of Regulatory and Deregulatory Actions, 1190-AA78, Spring 2022. Jump back to footnote 2 in the text.↩
3. U.S. Department of Justice, Proposed Rule, "Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities," Federal Register 88, no. 149 (August 4, 2023): 51948. Jump back to footnote 3 in the text.↩
4. U.S. Department of Education, "Nondiscrimination on the Basis of Disability in Programs or Activities Receiving Federal Financial Assistance from the Department of Education," in Office of Information and Regulatory Affairs Office of Management and Budget, RIN1870-AA18, Spring 2023. Jump back to footnote 4 in the text.↩
5. Proposed Rule, "Nondiscrimination on the Basis of Disability," August 4, 2023. Jump back to footnote 5 in the text.↩
6. EDUCAUSE letter to Rebecca Bond, Disability Rights Section, U.S. Department of Justice, "Notice of Proposed Rulemaking, Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities RIN 1190-AA79 (CRT Docket No. 144)," October 3, 2023. Jump back to footnote 6 in the text.↩
7. Ibid. Jump back to footnote 7 in the text.↩
8. Proposed Rule, "Nondiscrimination on the Basis of Disability," August 4, 2023; EDUCAUSE letter to Rebecca Bond, "Notice of Proposed Rulemaking, Nondiscrimination on the Basis of Disability," October 3, 2023. Jump back to footnote 8 in the text.↩

Kathryn Branson is a Partner with Ulman Public Policy.