On October 21, 2025, WCAG 2.2 officially became ISO/IEC 40500:2025. What had been a W3C recommendation became an international standard, and for procurement officers around the world that single change moved accessibility from "nice to have" to "you cannot bid without it." Three months later, the 2025 federal ADA lawsuit count came in at 8,667 total ADA filings, with 5,000+ targeting websites - a near-20% year-over-year increase, and 45-46% of those targeting companies that had already been sued at least once.
If you build websites for a living, those two numbers are the new operating environment. WCAG 2.2 web design is not a 2026 trend. It is the legal floor in the United States, the procurement floor in the EU, and the ISO floor everywhere else. This is the practical guide to what changed, where the lawsuits actually land, and the fixes that move the needle.
The TL;DR
- WCAG 2.2 became ISO/IEC 40500:2025 on October 21, 2025. Procurement, public-sector, and enterprise contracts increasingly require it by name.
- 9 new success criteria were added to WCAG 2.2 beyond 2.1: focus appearance, focus not obscured, dragging movements, target size minimum, consistent help, redundant entry, accessible authentication, and two more on focus management.
- 8,667 federal ADA lawsuits filed in 2025; 5,000+ targeted websites. ~20% YoY increase. (WCAGsafe)
- 45-46% of 2025 lawsuits hit repeat defendants. Settling once does not protect you. Remediation has to actually fix the underlying issues.
- E-commerce is the dominant target category. 82% of digital ADA lawsuits historically target e-commerce; Shopify stores account for ~32% of platform-attributed filings.
- Geographic concentration: New York (31.6%), Florida (24.2%), California (18.9%), Illinois (11.8%, up 745% in H1 2025).
- The fix categories that move the needle: color contrast, focus management, semantic HTML, accessible forms, motion controls, and accessible authentication.
What changed in WCAG 2.2
WCAG 2.2 added nine new success criteria to the 86 already in WCAG 2.1. The full list lives in the W3C standard, but in practice these are the ones that show up in audits and lawsuits.
2.4.11 Focus Not Obscured (Minimum) - Level AA. When a control has keyboard focus, the focus indicator cannot be entirely hidden by sticky headers, footers, modals, or cookie banners. This is the #1 finding in 2026 audits because every site has a sticky cookie banner.
2.4.12 Focus Not Obscured (Enhanced) - Level AAA. No part of the focused element is hidden. Stricter version of 2.4.11.
2.4.13 Focus Appearance - Level AAA. The focus indicator must meet specific contrast and size thresholds. Most native browser focus rings pass; many designer-customized focus styles fail.
2.5.7 Dragging Movements - Level AA. Anything that requires dragging (sliders, kanban boards, drag-and-drop file uploads) must have a non-drag alternative. Click targets, keyboard support, or both.
2.5.8 Target Size (Minimum) - Level AA. Pointer targets must be at least 24x24 CSS pixels, with exceptions for inline links and equivalent alternatives. Tightens the prior 44x44 AAA recommendation to a stricter AA floor.
3.2.6 Consistent Help - Level A. If you offer help (chat, contact link, FAQ link), it must appear in a consistent location across pages.
3.3.7 Redundant Entry - Level A. Information you have already collected (email, address) cannot be required again in the same flow without good reason. Auto-fill counts.
3.3.8 Accessible Authentication (Minimum) - Level AA. Cognitive function tests cannot be the only way to authenticate. CAPTCHA-only login fails. Password managers must work. WebAuthn / passkeys / biometric / email magic link all satisfy.
3.3.9 Accessible Authentication (Enhanced) - Level AAA. No cognitive function test for authentication, period.
The pattern across all nine: they target the most-common-failure surfaces (focus, touch, forms, auth) where lawsuits actually land.
Where the lawsuits actually land
ADA digital lawsuits are not random. The pattern data from 2025 makes the targeting obvious.
| Filing state | Share of 2025 filings |
|---|---|
| New York | 31.6% |
| Florida | 24.2% |
| California | 18.9% |
| Illinois | 11.8% (up 745% H1 YoY) |
| All others | 13.5% |
Source: DarrowEverett 2025 analysis, WCAGsafe statistics.
The Illinois jump is the story of 2025. As New York courts tightened standing requirements, plaintiff firms physically relocated to Illinois and refiled. Expect this pattern to continue moving.
By industry, e-commerce is the dominant target. Historical data shows 82% of digital ADA lawsuits hit e-commerce sites, and 77% involve small online merchants with under $20M annual revenue. Shopify stores account for ~32% of platform-attributed filings; custom-coded sites account for ~35%. WordPress, Wix, BigCommerce, and Squarespace round out the rest.
The repeat-defendant pattern is the most operationally important. 45-46% of 2025 lawsuits hit companies that had already been sued at least once. This means settling without comprehensive remediation is a guaranteed re-lawsuit. The legal-fees-and-settlement model that says "pay it and move on" stopped working in 2024.
The five things 2026 audits flag most often
After running accessibility audits across many client sites, the same findings show up in roughly this frequency.
1. Color contrast on text and UI elements
The single most-cited issue. WCAG AA requires 4.5:1 for body text, 3:1 for large text (18pt+ or 14pt+ bold), and 3:1 for UI controls and graphical objects. Brand color palettes designed pre-2018 often miss the UI control threshold.
The fix: run your palette through a contrast checker. Pick two text colors per background, pre-verified. Pick three UI states (default, hover, focus) per interactive element, pre-verified. Bake them into the design system, do not let them be ad-hoc per page.
2. Focus indicators that disappear or get covered
The 2.4.11 finding. Every site with a sticky cookie banner, sticky header, or sticky footer that overlaps focused inputs is failing this. So is every site that ships outline: none without a replacement.
The fix:
/* Replace browser default with a designed focus ring that meets contrast */
:focus-visible {
outline: 2px solid var(--focus-ring);
outline-offset: 2px;
border-radius: 4px;
}
/* Ensure sticky elements do not overlap focused content */
html { scroll-padding-top: 80px; } /* match your sticky header height */
3. Forms without proper labels and error association
Inputs with placeholder instead of <label>. Error messages that appear visually but are not associated with the input via aria-describedby. Required fields marked with color (red asterisk) instead of required and accessible text.
The fix: every input gets a real <label for="...">, every error gets aria-describedby linking it to the input, every required field gets aria-required="true" and visible text saying so.
4. Images and icons without alt text or with bad alt text
Decorative images with verbose alt. Informative images with empty alt. Logo with alt="logo" instead of alt="Acme Inc". Icons used as buttons without an accessible name.
The fix:
{/* Decorative - empty alt */}
<img src="/divider.svg" alt="" role="presentation" />
{/* Informative - describe what it shows */}
<img src="/chart.png" alt="Revenue grew from $1M to $3M between 2024 and 2026" />
{/* Icon as button - aria-label */}
<button aria-label="Close menu">
<XIcon aria-hidden="true" />
</button>
5. Motion that cannot be disabled
Auto-playing video, parallax effects, scroll-triggered animations, marquee tickers - all of which trigger vestibular disorders for affected users. WCAG 2.3.3 requires that motion be respected per prefers-reduced-motion.
The fix:
import { useReducedMotion } from 'framer-motion';
function HeroAnimation() {
const reduce = useReducedMotion();
return (
<motion.div
initial={{ opacity: 0, y: reduce ? 0 : 20 }}
animate={{ opacity: 1, y: 0 }}
transition={{ duration: reduce ? 0 : 0.6 }}
>
Content
</motion.div>
);
}
What e-commerce sites get sued for specifically
E-commerce is the lawsuit hot zone, so it deserves its own list. The most common findings on e-commerce ADA filings:
- Product images without alt text describing the product. "image123.jpg" alt does not satisfy.
- Color-only product variant selection. "Choose color: red / blue / green" must work for users who cannot see color.
- Cart and checkout with inaccessible forms. The single most common e-commerce filing - users cannot complete purchase with a screen reader.
- Inaccessible filter and faceted search. Filters that require mouse hover, sliders without keyboard support (2.5.7 dragging), checkboxes without labels.
- PDF receipts that are scanned images. PDFs in the order flow must be tagged and accessible.
- Cookie banners that cover focus and trap keyboard users. The focus-not-obscured (2.4.11) finding.
- Inaccessible CAPTCHAs at login or checkout. The 3.3.8 accessible authentication failure.
If you run a Shopify store, the platform handles some but not all of these. Custom themes, custom apps, and most third-party integrations require their own audit. We covered the broader rebuild context in Signs Your Website Needs UI/UX Redesign and the prior accessibility deep-dive in WCAG 2.2 Practical Guide.
How to actually meet WCAG 2.2 AA in 2026
Three layers, in order.
Layer 1: Design system primitives
Bake accessibility into the design system, not into individual pages. The primitives that matter:
- Color tokens with verified contrast. Body text, link text, UI elements, focus rings - every token comes with a contrast-on-background note.
- Typography scale with minimum sizes. 16px body floor, with comfortable line-height (1.5+).
- Touch targets at 44x44 minimum. Even on desktop, this is the floor for anything tap-able.
- Form components with built-in label, error, and ARIA wiring. No raw
<input>in product code; everyone uses the design-system component. - Focus styles that pass 2.4.13. Designed once, applied everywhere via
:focus-visible.
Done at the design system level, accessibility becomes a property of any new page rather than a per-page audit.
Layer 2: Component and page-level discipline
What every page needs:
- Semantic HTML.
<main>,<nav>,<header>,<footer>,<button>for buttons,<a>for links. Not<div>everywhere. - Logical heading hierarchy. One
<h1>, then<h2>and<h3>in order. No skipping levels for visual styling. - Skip-to-content link at the top of every page for keyboard users.
- Alt text on every meaningful image. Empty alt only for decorative.
- Error messages associated with inputs via
aria-describedby. - No keyboard traps. Every interactive element is reachable and exitable with Tab + Shift+Tab.
Layer 3: Automated and manual testing in CI
What to run:
- Automated: axe-core (free), Lighthouse accessibility audit, Storybook a11y addon. Catches ~30-40% of issues.
- Manual keyboard test. Every page navigated end-to-end with Tab, Shift+Tab, Enter, Space, Arrow keys, Escape. Catches ~30%.
- Screen reader smoke test. VoiceOver (Mac), NVDA (Windows), or JAWS through every critical flow. Catches the remaining issues.
- WCAG 2.2 AA conformance audit annually. Use a third-party auditor for legal documentation. Internal teams cannot self-certify in a lawsuit.
The honest read on automated tooling: it catches roughly a third of issues. The other two-thirds require humans. If your accessibility program is "we run Lighthouse," you have a gap.
What this costs
Budget bands for getting an existing site to WCAG 2.2 AA:
- Marketing site (10-25 pages): $5k-$15k for audit + remediation. Two to four weeks.
- B2B SaaS application: $20k-$60k. Six to twelve weeks. Depends heavily on form complexity and component reuse.
- E-commerce site (100+ products, custom checkout): $30k-$120k. Eight to sixteen weeks. The lawsuit-likelihood premium justifies the spend.
- Enterprise application (multi-tenant, complex workflows): $80k-$300k+ and ongoing. AAA targets push this higher.
What drives cost: how much of the issue list is design system fixes (cheap once, applied everywhere) versus per-page fixes (expensive per page). Sites built before 2022 with no design system are typically the most expensive to remediate.
The math against settlement cost: median 2025 ADA settlements landed in the $25k-$75k range, plus mandatory remediation, plus repeat-defendant probability of ~45%. A $30k remediation that prevents two lawsuits pays for itself in year one.
Where to start
If you are responsible for a site and have not done an accessibility pass:
- Run a baseline scan today. axe DevTools, Lighthouse, or WAVE will give you a same-day issue count. Know the size of the problem.
- Triage by severity and frequency. Critical issues (no alt text on key images, forms unusable with keyboard) come first. Site-wide issues (focus styles, cookie banner) come next. Per-page issues come last.
- Fix at the design system layer first. Color tokens, focus styles, form components - one fix, applied everywhere.
- Get a third-party WCAG 2.2 AA audit. Internal teams can ship the work; only third parties produce the documentation that matters in a lawsuit.
- Bake accessibility into your CI. axe-core in unit tests, Lighthouse on PRs, Storybook a11y addon for components. Catch regressions before they ship.
If you are commissioning a new site, accessibility goes in the brief from day one. "WCAG 2.2 AA conformance with documentation" is a non-negotiable acceptance criterion. Agencies that cannot deliver should self-select out.
The deeper context lives in Web Design and UX for Business: 2026 Playbook, where accessibility is one of the four foundation areas. The first version of this guide, WCAG 2.2 Practical Guide, goes deeper on individual success criteria. For broader UX context, Conversational Chat Agent UI Design and Designing AI-First Products cover how accessibility intersects with newer interaction patterns.
If you are building or remediating a site to WCAG 2.2 AA, this is exactly the work we run inside our UX/UI Design, UX Redesign, and Front-End Development engagements. We will tell you straight when "you need a remediation, not a rebuild" - which is more often than not.
Want a second opinion on your accessibility risk? Contact us for a free 30-minute audit against the 2026 patterns in this guide.