Got an ADA website demand letter? What to check in the first 72 hours (technical side only)

If your small business just received a letter claiming your website violates the ADA, this is the technical half of what to do in the first 72 hours. The legal half belongs to a lawyer — get one before the deadline in that letter. What follows is the evidence side, which is the part most owners have nobody for.

You are not an edge case. Law firm Seyfarth Shaw counted 3,117 federal website-accessibility lawsuits filed in 2025, and for every filed case there are more demand letters that settle quietly. Most defendants are small businesses, and most cases start the same way: somebody ran an automated scan of your site and printed what it found.

Step 1 — Preserve everything, starting now. Save the letter and note its deadline. Screenshot your key pages with dates (home, contact, booking or checkout, your top service pages). If you fix things later, this dated "before" state is what proves the timeline.

Step 2 — Run the same kind of scan they ran. Free tools (WAVE, axe) will show you the usual findings in minutes: images with no alt text, form fields with no label, buttons a keyboard user can't reach, text with too little contrast, videos with no captions, a checkout that can't be completed without a mouse. Automated tools only catch part of the problem — but they're the part a plaintiff's scan catches too, so they're where you start.

Step 3 — Fix the source code, not the surface. An overlay widget is not a fix: in 2025 the FTC ordered the largest overlay vendor to pay $1 million over claims its product made sites compliant, and sites with overlays installed keep getting sued. The fixes that count are in the page itself — labels, alt text, focus order, contrast — done by you or your developer.

Step 4 — Document the work like evidence. Keep dated before/after scan results and a dated log of what was fixed, where, and when. Whatever happens next — settlement talks, a response through your lawyer — runs on this paper trail.

Step 5 — Re-scan and keep the records. A dated re-test after fixes closes the loop and is your proof of good faith.

One boundary worth knowing: there is no official "ADA certificate" for a private website, and nobody can sell you one. Courts and DOJ settlements use WCAG 2.1 AA as the benchmark — that standard, not a stamp, is what an audit should measure against.

I run AI Client Discovery. We do human-verified WCAG 2.1 AA audits for small businesses: the scan, a plain-language fix list your developer can apply, and the dated evidence pack your lawyer can work from. We don't give legal advice. If you're staring at one of these letters, the technical evidence is the part we can take off your plate — questions welcome in the comments, or at [email protected].