Web and Mobile App Accessibility Regulations

On April 24, the U.S. Department of Justice (DOJ) published its final regulation on web and mobile application accessibility in the Federal Register. DOJ released a long-anticipated notice of proposed rulemaking (NPRM) on accessibility standards for websites and mobile applications on August 4, 2023. The final regulation, promulgated under Title II of the Americans with Disabilities Act (ADA), marks the first time that DOJ has issued formal regulations for accessibility in the digital realm. Title II of the ADA protects individuals with disabilities from being excluded from participating in or receiving the benefits of services or programs provided by state or local government entities. As such, the April 24 regulation applies only to public higher education institutions.

EDUCAUSE submitted comprehensive feedback to DOJ in response to the NPRM last fall.^Footnote1 Our comments focused primarily on changes that DOJ should include in the final regulation to appropriately reflect how institutions manage the accessibility challenges they must address. Specifically, our feedback discussed the volume and variety of digital content and technologies that campuses deploy to fulfill their missions and the unique nature of content generation in the higher education context, which is typically decentralized across numerous sources.

Despite our comments, DOJ ultimately maintained much of the substance of the NPRM in its final regulation. Following are more details about the regulation, including key components and noteworthy changes from the NPRM.

What's in the Final Rule?

Generally, the final rule outlines the accessibility requirements for websites and mobile applications that all public institutions must meet to comply with Title II of the ADA. Specifically, all of the web content and mobile apps that a public entity provides or makes available—whether "directly or through contractual, licensing, or other arrangements"—must be readily accessible and usable by individuals with disabilities. The phrase "directly or through contractual, licensing, or other arrangements" was added to the final rule to clarify that third-party content (that is not otherwise subject to a limited exception) is covered under the regulation. On that note, the NPRM included several limited exceptions to the WCAG 2.1 AA requirements, including one designed for password-protected course content.^Footnote2 While the final rule retains many of these exceptions for public entities, it omits the previously proposed password-protected course content category, which was a major focal point for higher education institutions.

Key Components of the Final Rule

Technical Standard: WCAG 2.1 AA Adopted

• The Final Rule: The final rule formally adopts Web Content Accessibility Guidelines (WCAG) 2.1 level AA (the middle level of conformance) as the standard to which all covered entities must adhere, which aligns with the NPRM proposal.
• EDUCAUSE Comments: EDUCAUSE supported this approach in our comments to DOJ. Additionally, we urged DOJ to incorporate a "best meets" provision that would allow an entity to procure content, apps, and other material that best meet the standard if a fully conforming option is not commercially available.
• Relevant DOJ Final Rule Commentary: DOJ noted that there are very limited circumstances in which "conforming alternate versions" of web content, as defined under WCAG 2.1, may be used to achieve accessibility. Under the rule, entities may rely on such content only when making web content directly accessible is not possible due to technical or legal limitations. DOJ said that this option should be used rarely.

Compliance Time Frames

• The Final Rule: In keeping with the NPRM, DOJ provides two time frames for covered entities to achieve compliance with the regulation. Small public entities—those with U.S. census-defined population sizes of less than 50,000 people—have three years to comply. Therefore, they must comply with the rule beginning April 26, 2027. Large public entities—those with census-determined populations of 50,000 or more—have two years to reach compliance. Accordingly, their effective compliance deadline is April 26, 2026.
• EDUCAUSE Comments: Our comments to DOJ drew on member feedback indicating that the bare minimum time needed for exceedingly well-resourced institutions to achieve compliance is three years, given the large and varied amount of digital content that campuses handle. As a result, we urged DOJ to consider the following modifications: (1) provide a longer time frame; (2) take a tiered or phased approach based on a minimum of three years to address core content and additional phases for any remaining content; and (3) provide a defined time frame to complete an audit or assessment and develop a subsequent remediation plan. Our comments also urged DOJ to establish an order of priorities for institutions to address their web-based content and technologies to help them work appropriately toward compliance.
• Relevant DOJ Final Rule Commentary: The final rule leaves the compliance windows unchanged. DOJ noted that the two- or three-year compliance window gives entities the flexibility to structure their compliance efforts in a manner that works for them. Therefore, DOJ refused to specify in the final rule which content types covered entities should prioritize.

Large versus Small Entities

• The Final Rule: With respect to higher education institutions—whose populations are not calculated by the U.S. Census Bureau—the final rule adopts the approach outlined in the NPRM, basing an institution's population size on the size of its governmental jurisdiction.
• EDUCAUSE Comments: EDUCAUSE expressed concern about this approach. We noted that it does not account for differences between institutions and other public entities—particularly concerning how they are financed. Our comments urged DOJ to consider adopting a classification system for colleges and universities that is already recognized in higher education, such as the Carnegie Classification of Institutions of Higher Education.
• Relevant DOJ Final Rule Commentary: DOJ rejected this suggestion outright. It noted that the Carnegie Classification system considers factors that are irrelevant to the rule, "such as the nature of the degrees offered (e.g., baccalaureate versus associate's degrees)." DOJ also reaffirmed that the final rule treats educational entities the same as other public entities to promote "consistency and reliability."^Footnote3

Limited Exceptions: Password-Protected Course Content

• The Final Rule: The NPRM included an exception for content housed on a password-protected website that is not available to the general public, such as password-protected course content. However, this exception was subject to certain limitations. As proposed, the exception would not apply if an institution received notice that an individual would require such content to be made accessible.^Footnote4 The final rule completely omits this exception. Therefore, institutions will need to ensure that all digital course content—including content on a password-protected website—is accessible under WCAG 2.1 AA.
• EDUCAUSE Comments: In our comments, we expressed appreciation for the exception originally proposed by DOJ, given its intention to mitigate the compliance burden on institutions without sacrificing accessibility for students with disabilities. However, we ultimately suggested that DOJ consider several modifications to the limitations in the exception to make the exception align more functionally with how course content is generated in practice. For example, we urged DOJ to provide institutions with at least ten to fifteen business days (longer than the proposed five days) to procure or provide accessible course content, identify a specific compliance time frame before a course would use a particular piece of content (acknowledging that all of the content in a course is not consumed on the first day of a term), and provide content remediation based on a given student's needs, rather than requiring full WCAG 2.1 AA compliance, regardless of the student's disabilities.
• Relevant DOJ Final Rule Commentary: DOJ noted that an overwhelming majority of stakeholders expressed opposition to the course content exceptions in their public comments. Most stakeholder comments also conveyed concern that the exception, as written, would inevitably delay access to course content for students and parents with disabilities. In addition, DOJ stressed that it disagrees with commenters who recommended extended or phased remediation time frames under the exception's limitations. Instead, the department argued that such an approach would delay access for students with disabilities. It said a more efficient approach is for institutions to use their respective two- or three-year compliance window to address such content. Ultimately, DOJ did not include the exception in the final rule.

Other Limited Exceptions

• The Final Rule: The final rule retains exceptions (largely as proposed in the NPRM) for the following types of content:
  • Archived web content
  • Preexisting conventional electronic documents
  • Content posted by a third party
  • Conventional electronic documents specific to a certain individual, their property, or their accounts that are password-protected or otherwise secured
  • Preexisting social media posts
• Minor Changes in the Final Rule: DOJ made minor changes from the NPRM, particularly concerning the third-party content exception. It clarified that the exception does not apply if the third party posts content as part of contractual, licensing, or other arrangements with the public entity. These revisions align with the changes made in the final rule pertaining to applicability.^Footnote5 Therefore, the exception only applies when a third party posts content that is independent from the actions of the public entity. Similarly, the final rule removes the exception in the NPRM for linked third-party content. DOJ noted, in keeping with the final rule, that determining accessibility requirements for that type of content involves analyzing whether third-party-linked content was made pursuant to contractual, licensing, or other arrangements with the entity.

Measuring and Assessing Compliance

Conformance to WCAG 2.1 AA

• The Final Rule: The NPRM laid out five possible pathways for determining compliance with the regulation. In the final rule, DOJ adopted a compliance framework that requires complete technical conformance with WCAG 2.1 AA for the department to consider an entity compliant with the regulation.
  • DOJ noted that while an entity can still be found compliant despite nonconformance under limited circumstances, this exception is intended to apply in very rare circumstances. A detailed analysis of the specific facts surrounding the impact of each alleged instance of nonconformance will be required.
  • Specifically, nonconformance must have a minimal impact on access, such that it would not interfere with an individual's ability to use the web content or a mobile app of the public entity in a manner substantially equivalent in timeliness, privacy, independence, and ease of use, particularly across the following activities: (1) accessing the same information as individuals without disabilities; (2) engaging in the same interactions as individuals without disabilities; (3) engaging in the same transactions as individuals without disabilities; and (4) otherwise participating in or benefiting from the same programs, services, and activities as people without disabilities. In the final rule, DOJ said it assumes most nonconformance would not be excused under this provision.
• EDUCAUSE Comments: Our comments expressed a strong preference for the "policies and practices" approach proposed in the NPRM. Under that strategy, an institution could demonstrate compliance by establishing and following robust policies and practices for accessibility feedback, testing, and remediation.
  • We noted that the success of this pathway would ultimately depend on how DOJ defines a sufficiently "robust" policy, but overall, this approach would be the most workable for institutions because it accommodates variability across small and large entities and is flexible enough to adapt to specific circumstances involving the digital content used and provided across campuses. We are disappointed that DOJ ultimately declined this strategy.
  • In the NPRM, DOJ acknowledged that requiring entities to achieve 100 percent compliance with the required standard 100 percent of the time is likely not a feasible assessment approach. We found this acknowledgement encouraging since "websites and mobile apps are dynamic and interconnected, and can contain a large amount of complex, highly technical, varied, and frequently changing content."^Footnote6 While the adopted approach does not technically require 100 percent compliance, it appears to mirror that pathway more than the other avenues proposed, particularly given the department's assertion that nonconformance to WCAG 2.1 AA will rarely be excused.
• Relevant DOJ Final Rule Commentary: In the final rule, DOJ said that while it did consider a policy-based approach to compliance, it rejected that pathway because it could not determine a "sufficient rationale that would justify adopting any specific set of accessibility policies in the generally applicable regulation."^Footnote7 The department noted that while many commenters supported the idea, stakeholders suggested a wide range of policies that differed across considerations ranging from who should conduct testing, how frequently that testing should be done, and what the remediation timelines would look like.

What's Next?

Depending on the size of their governing jurisdiction, public institutions now have a two- or three-year window to bring their digital content into compliance with the regulation.

While this regulation applies only to public higher education institutions, private institutions should take note. The EDUCAUSE Policy team expects this regulation to serve as a template for any forthcoming web accessibility regulation that DOJ may promulgate under Title III of the ADA. Title III prohibits discrimination against people with disabilities in places of public accommodation, including any privately operated entity that affects commerce. Therefore, any regulation issued under Title III would extend to private higher education institutions.

Meanwhile, the Department of Education plans to issue web accessibility regulations pursuant to Section 504 of the Rehabilitation Act. These regulations would ultimately extend to all higher education institutions that receive federal funds. They will almost certainly align with the final Title II regulations and could be implemented more quickly than the ADA Title III regulations.

Notes

1. EDUCAUSE, "Notice of Proposed Rulemaking, Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities RIN 1190-AA79 (CRT Docket No. 144)," letter to Rebecca Bond, Disability Rights Section, U.S. Department of Justice, October 3, 2023; Katie Branson, "DOJ's Proposed Web and Mobile App Accessibility Regulations: An Overview," EDUCAUSE Review, November 27, 2023. Jump back to footnote 1 in the text.↩
2. Civil Rights Division, Department of Justice, "Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entitles," final rule, 89 Federal Register 31320 (April 24, 2024); Civil Rights Division, Department of Justice, "Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities," proposed rule, 88 Federal Register 51948 (August 4, 2023). Jump back to footnote 2 in the text.↩
3. Department of Justice, "Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services," final rule, April 24, 2024. Jump back to footnote 3 in the text.↩
4. Under the NPRM, if such notice is provided via the regular course registration process, the content would need to be made accessible by the start of the term. If notice is provided after the term begins—such as during the add/drop period—the content would have to be made accessible within five business days. Jump back to footnote 4 in the text.↩
5. This change was largely designed to align this exception with the general changes that DOJ made to applicability—specifically, that all of the content a public entity provides or makes available, whether directly or through contractual, licensing, or other arrangements, must be readily accessible and usable by individuals with disabilities. Jump back to footnote 5 in the text.↩
6. Department of Justice, "Nondiscrimination on the Basis of Disability," proposed rule, August 4, 2023. Jump back to footnote 6 in the text.↩
7. Department of Justice, "Nondiscrimination on the Basis of Disability," final rule, April 24, 2024. Jump back to footnote 7 in the text.↩

---

Kathryn Branson is a Partner at Ulman Public Policy.