ADA Title II vs Title III Websites: Which Law Applies

Most website owners I talk to say the same thing: "We need to be ADA compliant, right?" Wrong question. The ADA has two titles that touch websites, and they work completely differently. Title II binds state and local governments. Title III binds private businesses open to the public. The obligations, deadlines, enforcement bodies, and technical standards under each one diverge in ways that matter a lot if you pick the wrong playbook.

I have spent years remediating websites for accessibility lawsuits and DOJ complaints. The single most common failure I see is an organization applying Title III thinking (wait for a demand letter, then react) to what is actually a Title II obligation (a federal rule with a hard deadline and a fixed technical standard). This article breaks down which title applies to which organization, what the DOJ's Title II web rule actually requires, and where the overlap traps live.

The Two Titles, Plainly

Title II of the ADA covers state and local government entities: cities, counties, school districts, public universities, courts, public hospitals, transit authorities. The enforcement route is the Department of Justice and private lawsuits under Section 504 of the Rehabilitation Act as well.

Title III covers private businesses open to the public, what the statute calls "places of public accommodation." That means retail stores, restaurants, banks, hotels, healthcare providers, e-commerce sites. There is no federal technical regulation for Title III websites today. Courts apply the law case by case, and most circuits that have ruled (the First, Second, and Seventh among them) hold that websites must be accessible under Title III when they connect to a physical place of business.

The practical consequence: a private business has no single codified standard it must hit, while a government entity now has an exact one, locked in regulation.

The DOJ Title II Rule: WCAG 2.1 AA, With Deadlines

On April 24, 2024, the DOJ published a final rule under Title II requiring state and local government web content and mobile apps to conform to WCAG 2.1 Level AA. This ended years of uncertainty for public entities. The rule is codified at 28 CFR Part 35. The original deadlines were April 24, 2026 and April 26, 2027, but in 2026 the DOJ issued an Interim Final Rule that pushed each one back by a year. The deadlines now depend on population:

The extension gives large entities roughly six more months from the date of this post, not a reason to wait. A city or county serving over 50,000 people that still has inaccessible PDFs, missing form labels, or keyboard traps should be remediating now, because a full audit and fix cycle takes most agencies six to twelve months. Check the DOJ's current Title II web rule page for any further changes before you set a budget.

The rule also names specific exceptions: archived web content, preexisting conventional electronic documents, third-party content the entity did not create, and individualized password-protected documents like a utility bill. Those exceptions are narrower than most IT departments assume. An archived page that is still used to apply for a permit is not "archived" under the rule.

Title III in 2027: No Rule, But Plenty of Lawsuits

Title III has no web accessibility regulation. The DOJ under the Biden administration issued guidance in March 2022 stating that the ADA covers websites, but guidance is not a regulation. What actually shapes behavior is litigation. Web accessibility lawsuits filed in federal court numbered roughly 4,600 in 2023, and filings have stayed at similar levels since, per data tracked by law firms reporting on the space, and state court filings in New York and California add thousands more. Serial plaintiffs file hundreds of suits against small businesses, often targeting e-commerce sites with missing alt text, inaccessible checkout flows, or PDF menus.

The de facto technical target in these cases is WCAG 2.1 AA, because courts, settlements, and the DOJ's own consent decrees keep pointing there. If you build a private business site to WCAG 2.1 AA, you satisfy the standard nearly every plaintiff's expert will test against. Our WCAG complete guide maps the criteria that matter most in real audits.

The Overlap Traps

This is where organizations get hurt. Four traps come up constantly in my remediation work.

Trap 1: Public-private partnerships. A city that contracts its permitting portal to a private vendor still carries Title II responsibility for that portal's accessibility. Vendors sign contracts, cities get sued. If you run a SaaS product sold to municipalities, your accessibility posture is now your customer's legal exposure. I have watched a county nearly lose a vendor contract over 47 unresolved WCAG errors.

Trap 2: Educational dual status. A private university is Title III, but its public charter school arm is Title II. One organization, two legal regimes, two deadlines. Compliance teams that scope an audit to "the main .edu site" miss the division entirely.

Trap 3: Transit and healthcare. A publicly owned hospital (Title II entity) runs patient portals and bill-pay tools that are effectively Title III-flavored services when contracted to private operators. The DOT and DOJ have both pursued enforcement where airline or transit booking tools were inaccessible, regardless of who built them.

Trap 4: Assuming the small-population extension is a pass. Entities under 50,000 get until April 2028, but Section 504 of the Rehabilitation Act has no size exception, and disability advocates are already filing complaints against small districts. The extension buys time, not immunity.

What Most Guides Get Wrong

Most "ADA website compliance" guides flatten everything into one checklist. Three errors repeat across nearly all of them.

First, they treat WCAG conformance as the legal obligation itself. It is not. WCAG is the technical standard; the legal obligation comes from Title II, Title III, Section 504, or state law like the California Unruh Act or New York State and City human rights laws. Those state statutes carry statutory damages, $4,000 minimum per violation under Unruh, which is why California filings dominate the dockets.

Second, they claim the 2024 rule applies to businesses. It does not. It applies only to state and local governments. Private businesses citing the April 2027 deadline are citing a rule that does not bind them, while ignoring the lawsuit exposure that does.

Third, they skip document remediation. In Title II audits, PDFs and scanned forms account for a majority of failures. The rule explicitly covers documents used to apply for services. A conformant website attached to a form-fillable-but-inaccessible PDF application is still nonconformant.

A Decision Framework

When a client asks which regime applies, I run four questions:

1. Who owns the site? A government entity means Title II and the Part 35 rule applies. A private business means Title III and litigation risk analysis applies.
2. Who uses the site? Public-facing services, applications, payments, or bookings trigger web accessibility obligations under either title.
3. Who built the tools? Third-party widgets, schedulers, and payment embeds transfer zero liability. The entity is responsible under both regimes.
4. What state are you in? California, New York, and Florida plaintiffs file the most suits. State anti-discrimination law layers on top of federal exposure.

Getting to Conformance Without Wasting Budget

For Title II entities past the deadline, triage beats perfection. Pull your top 20 task pages, the ones residents actually use: payments, permits, utilities, meeting agendas. Run an automated pass with axe-core or WAVE to catch the mechanical failures, missing alt text, empty headings, low contrast. Automated tools catch 30 to 40 percent of WCAG failures, so manual keyboard testing and screen reader checks (NVDA is free) cover the rest. Budget realistically: a mid-size municipal site audit and remediation typically runs $15,000 to $60,000 depending on page count and PDF volume, based on what I see quoted across the accessibility vendor market.

For Title III businesses, prevention costs a fraction of defense. Defense counsel in a single web accessibility suit runs $30,000 to $80,000 before any settlement, and settlements commonly add $5,000 to $20,000 plus a remediation commitment. Compare that to a $5,000 audit and a week of developer fixes on a small e-commerce site. The math is not close. The same discipline that protects you in a small business cybersecurity checklist applies here: fix the known, testable exposures before someone tests them for you.

One nuance worth repeating: overlay widgets, the JavaScript toolbars that promise instant ADA compliance for $50 a month, do not deliver conformance. They fail automated scans on the very pages they claim to fix, and several major overlay vendors have themselves been named in lawsuits. Real remediation touches the underlying HTML, forms, and documents.

Overlap With Your Broader Risk Picture

Accessibility rarely sits alone. The same websites that fail WCAG scans often carry outdated software, missing privacy policies, and weak incident response. Small organizations that treat compliance as one integrated program, accessibility, security, data handling, tend to spend less per finding than organizations that fund each silo separately. If you are already running a technical SEO audit, accessibility fits naturally into that pass, because many WCAG failures (missing page titles, broken headings, empty links) are also SEO failures. One crawl, two reports, half the cost.

Conclusion

Title II gives public entities a codified standard, WCAG 2.1 AA, and deadlines of April 26, 2027 and April 26, 2028. Title III gives private businesses no regulation but thousands of lawsuits a year and a court system that keeps landing on the same standard anyway. The overlap traps are partnerships, dual-status organizations, and the false comfort of deadline extensions. Identify which title governs your site, test against WCAG 2.1 AA, remediate your documents, and skip the overlay shortcuts. That sequence, executed once, removes the majority of legal exposure on either track.