Someone tells you the site needs WCAG compliance, and in the same breath “ADA” and “Section 508” come up like they’re interchangeable terms for the same thing. They aren’t. WCAG is a set of guidelines from a standards body, not a law, and nobody enforces it directly. ADA and Section 508 are laws, and each one borrows a different slice of WCAG, for a different audience, at a different level of strictness. Which one actually covers you comes down to a single question: who are you? A private business, a government agency, a federal contractor, or an organization doing business in Canada each land on a different rule — and a different version number.
WCAG Is a Guideline, Not a Law
The Web Content Accessibility Guidelines are published by the W3C’s Web Accessibility Initiative — a standards body, not a regulator. The current version is WCAG 2.2, published October 5, 2023, and last updated December 12, 2024. It’s organized into three conformance levels — A, AA, AAA — under four principles: content has to be perceivable, operable, understandable, and robust. AA is the level that shows up in nearly every government standard that names one at all.
Even the people who wrote WCAG don’t ask for the top level everywhere. Their own guidance is direct: “It is not recommended that Level AAA conformance be required as a general policy for entire sites because it is not possible to satisfy all Level AAA success criteria for some content” — w3.org. If a vendor is pitching AAA across an entire site, that’s a bigger ask than the standard itself makes. Which level you actually build to is a decision taken with the pages, not after them — it is part of how we scope a website build.
WCAG Compliance for a Private Business: Which Version to Aim At
Title III of the ADA covers businesses generally open to the public — restaurants, clinics, retailers, and a list of similar categories — plus commercial facilities. Here’s the part that surprises people: the Department of Justice has no designated technical standard for this group. Its own position: it “does not have a regulation setting out detailed standards, but the Department’s longstanding interpretation of the general nondiscrimination and effective communication provisions applies to web accessibility” — ada.gov. A business “can currently choose how they will ensure” their online offerings are accessible, but it’s still obligated to make sure they are.
An online store falls under the exact same rule. There’s no separate ecommerce statute — a storefront is just a website belonging to a business open to the public. Where courts have leaned, when cases get argued, is toward WCAG as a reference point for what “accessible” looks like in practice. That’s different from a regulation naming a version, and it’s worth holding the two apart rather than treating them as one fact.
Practically, that leaves you choosing a target rather than being handed one — and the cheapest moment to choose it is while the pages are being made, not after. That is how accessibility gets handled in a website build: as decisions about contrast, focus, headings and labels taken alongside the copy, rather than as a retrofit priced separately later.
If You’re a State or Local Government Agency
This is ADA Title II, and it’s the one rule in this whole list with an actual named standard. It covers state and local governments — any of their agencies or departments — plus special purpose districts, Amtrak, and other commuter authorities. The Department of Justice’s 2024 rule says it plainly: “WCAG 2.1, Level AA is the technical standard for state and local governments’ web content and mobile apps” — ada.gov.
The deadlines moved in April 2026. DOJ published an interim final rule extending the compliance date for entities with a population of 50,000 or more to April 26, 2027, and for entities under 50,000, plus any special district government, to April 26, 2028 — ada.gov. Anything written before that update is quoting dates that no longer apply. And this is the one boundary worth repeating: those dates are for Title II. They don’t move to private business just because a blog post says so.
If You’re a Federal Contractor
Section 508 covers federal executive branch agencies, including the US Postal Service, plus any vendor or contractor supplying digital products or services to the federal government. The standard it names is older than Title II’s: “The Revised 508 Standards incorporate by reference the WCAG 2.0 Level AA Success Criteria” — section508.gov. Not 2.1, not 2.2 — 2.0. The same page notes a page failing even one of the 38 applicable success criteria doesn’t conform. Some agencies treat the newer WCAG versions as good practice, but that’s a preference, not the legal requirement.
One mix-up worth naming directly: Section 508 isn’t the rule for organizations that simply receive federal funding. That’s Section 504, a separate provision — a common error, and an easy one to repeat if you’re pattern-matching on the word “federal.”
If You’re a Federally Regulated Organization in Canada
Banks, telecom carriers, broadcasters, and interprovincial airlines and railways fall under federal jurisdiction in Canada, and a new regulation applies to them directly: SOR/2025-255. It adopts CAN/ASC – EN 301 549:2024 as the technical standard, which itself incorporates WCAG 2.1 AA — canada.ca.
Size decides who’s exempt. Federal public sector bodies have no threshold at all. Private organizations are split into medium (100–499 employees) and large (500+), averaged over three years — and small organizations, averaged at 99 employees or fewer, are fully exempt from all digital accessibility requirements under this regulation. The clock: staff training by December 5, 2027; new and updated web pages by December 5, 2027 for the public sector and December 5, 2028 for large and medium private organizations; documents and mobile apps by December 5, 2028.
If You Operate in Ontario
This one applies by employee count, not sector. Ontario’s AODA covers designated public sector organizations and any business or non-profit with 50 or more employees. The requirement, stated directly: public website content posted after January 1, 2012 has to meet WCAG 2.0 Level AA — ontario.ca. It’s the narrowest rule here by geography, and the one most often skipped by anything written for a US audience. There’s also a reporting side to it: Ontario organizations with 20 or more employees file an accessibility compliance report, and the next deadline is December 31, 2026 — the nearest date anywhere on this page.
The Version That Keeps Showing Up
Strip the acronyms away and a pattern sits underneath: every rule that names a version points to WCAG 2.1 AA, or the older 2.0 AA a step behind it. Nobody has written a version requirement for private business under Title III — but the newest rules all cite 2.1 AA, and WCAG is the reference courts have leaned on when a case gets argued. That is the practical target, even where it is not a mandate.
This is a breakdown of what each rule says, not legal advice, and it’s worth holding one distinction firm: “built to WCAG 2.1 AA” describes a technical target, not a claim about legal status. In practice that distinction is what changes a build: a target belongs in the scope of the work, next to the browsers you support, and it is cheap there and expensive anywhere else.
If you want to know what actually needs to change on the pages themselves rather than which rule applies, what ADA compliance actually asks of your pages walks through it. And if a letter about your site’s accessibility has already landed in your inbox, what actually triggers a web accessibility lawsuit covers what to do first.
