ADA Safe Harbor: What It Covers and What It Doesn’t

The ADA safe harbor is real, but it is a rule about physical facilities, not websites. It lets certain building elements that already met the 1991 accessibility standards stay as they are. No comparable provision shields a business website from an accessibility lawsuit. What you can build instead is a record of good-faith work: testing, fixing, re-checking, and publishing a clear accessibility statement.

This guide explains where the term comes from, why it gets confused with web accessibility, what the law says about websites today, and the practical steps that reduce your exposure.

TL;DR

• ADA safe harbor applies to building elements, judged one element at a time. It is not a legal shield for websites.
• Courts are divided on whether Title III of the ADA covers websites, and Congress has not enacted a notice-and-cure or litigation safe harbor for web accessibility.
• The Department of Justice has no regulation setting detailed web standards for private businesses, but it points to WCAG as helpful guidance.
• Your best protection is permanent fixes in your code, ongoing monitoring, and dated documentation of what you did and when.
• If you receive a demand letter, respond promptly, document your site, and talk to an attorney experienced in ADA cases.

Table of Contents

• What ADA safe harbor actually means
• Is there a safe harbor for websites?
• Government websites are different
• What reduces your risk without a safe harbor
• If you receive a demand letter
• A realistic first month
• Our perspective
• How AccessWiser fits in
• FAQ
• Sources

What ADA safe harbor actually means

When the Department of Justice updated the ADA’s design rules, it issued the 2010 Standards for Accessible Design. Businesses that had already built or altered facilities to the earlier 1991 Standards faced an obvious question: do we have to rebuild everything? Safe harbor is the answer.

According to the ADA.gov primer for small businesses, elements in facilities built or altered in the past 20 years that comply with the 1991 Standards, or elements whose barriers were removed under those Standards, can remain unchanged under the 2010 Standards unless they are altered. The same primer explains that this is applied on an element-by-element basis.

That last detail matters. A restaurant might have a compliant 1991-era door and a noncompliant restroom. Safe harbor protects the door. It says nothing about the restroom.

For public entities, the DOJ’s primer for state and local governments says the safe harbor applies element by element if a facility complied with the 1991 Standards or UFAS as of March 15, 2012. It does not apply to facility types that had no previous accessibility standards.

Why the term gets mixed up with websites

The phrase “safe harbor” sounds like exactly what a worried website owner wants: a point at which you are done and protected. People searching for it after a demand letter, or after reading about lawsuits, often assume a web version exists. It does not.

The building safe harbor depends on specific physical standards with measurable dimensions that existed in 1991. Websites have no 1991 standard to be grandfathered under, and the ADA’s design standards do not set technical requirements for web content.

Is there a safe harbor for websites?

No. Here is where the law stands, as far as the primary sources show.

Courts disagree on whether Title III covers websites

The Congressional Research Service notes that courts are divided on whether Title III covers websites, and that some courts apply a nexus test that looks at a website’s connection to a physical business.

The Eleventh Circuit illustrates the narrow view. In Gil v. Winn-Dixie Stores, decided April 7, 2021, the court held that the grocery chain’s website was not a place of public accommodation and, on the facts presented, did not work as an intangible barrier to the physical stores.

Other courts have reasoned differently. That means your risk depends partly on where a plaintiff files. A decision from one circuit does not bind the rest of the country, so a favorable ruling elsewhere is not a plan.

Congress has not created a cure period

Bills that would have required notice and an opportunity to cure before a lawsuit could proceed have been proposed. The American Bar Association reported on August 13, 2025, that earlier notice-and-opportunity-to-cure bills had not gained enough bipartisan support to reach a floor vote, and that H.R. 3417 did not include a litigation safe harbor. The CRS report cited above likewise says the listed website-accessibility bills were not enacted.

In practice, a business that receives a complaint cannot count on a statutory window to fix the site first.

What the DOJ has said

The DOJ’s 2022 guidance on web accessibility and the ADA says that state and local governments and businesses have flexibility in meeting the ADA’s general nondiscrimination and effective communication requirements. It also says the DOJ has no regulation setting out detailed web-accessibility standards. The same guidance says businesses and governments can use the Web Content Accessibility Guidelines (WCAG) and the Section 508 Standards as helpful guidance.

That is the closest thing to a reference point private businesses have. It is guidance, not a guarantee, and following it does not confer immunity. It does give you a recognized yardstick and a reasoned way to show you took the obligation seriously. For a plain-language look at how the ADA and WCAG relate, see our four steps to defensible ADA compliance.

The ADA’s general duties still apply to what your site does for customers. A local web design firm’s overview of ADA nondiscrimination and effective communication shows how those requirements reach business websites and online services.

Government websites are different

If you run a public entity, the picture is firmer. The DOJ’s 2024 rule on web accessibility for state and local governments requires conformance with WCAG 2.1 Level AA. According to the rule text, the compliance dates are April 24, 2026, for entities with populations of 50,000 or more, and April 26, 2027, for smaller entities and special districts. There are exceptions for archived content and other specified categories.

This rule covers Title II entities. It does not set a standard for private businesses under Title III. If you sell to or contract with government bodies, expect them to ask about WCAG conformance, and see our overview of WCAG and Section 508 requirements for the federal side.

What reduces your risk without a safe harbor

Without a legal shield, the goal shifts. You want a site that works for people with disabilities, and you want evidence that you worked on it consistently. The DOJ guidance and the practitioner sources point to the same handful of habits.

1. Build to a recognized standard

The research points businesses to integrate inclusive design and remediate assets to WCAG 2.2 AA. The DOJ guidance lists practices such as adequate color contrast, text alternatives for images, keyboard navigation, and captions for video. Those four cover a large share of the issues that appear in demand letters.

Start with the basics that are easy to verify. Can someone tab through your menu, booking form, and checkout without a mouse? Do images that carry meaning have descriptive alt text? Does your text meet contrast minimums? Our guide to nontext contrast and WCAG 1.4.11 covers one of the most commonly missed criteria, including how to test it and fix it in code.

2. Test automatically and manually

Automated scanners are fast and consistent, and they catch many code-level problems, such as missing labels, broken heading structure, and low contrast. They do not catch everything. Whether a link’s purpose is clear in context, or whether a screen reader user can finish a purchase, takes human judgment. A discussion of accessibility checkers and their limits explains why manual testing finds additional barriers.

Use a scanner for breadth and regular coverage, then add keyboard and screen reader passes on your key journeys: ordering, booking, contact, and checkout. If your team ships code, our website accessibility testing guide for developers and the three-part WCAG 2.2 testing workflow show how to put checks into your pipeline.

3. Fix issues in the code, not around it

A runtime overlay that hides problems on the surface leaves the underlying markup unchanged. Permanent fixes are different: you correct the label, the contrast token, or the focus order in the site’s own code, and the fix holds for every visitor and every assistive technology.

That approach also matters for your legal posture. A plaintiff’s expert tests the real page, and an overlay does not alter what they find in the source.

4. Monitor for regressions

Sites change. A new banner, a theme update, or a redesigned menu can quietly break something you fixed last quarter. The practical advice from the DOJ-aligned research includes ongoing monitoring, a formal risk management program, an accessibility coordinator, and staff training. Scheduled re-checks make that monitoring routine instead of a once-a-year scramble.

As a planning aid, a guide on meeting DOJ deadlines for web accessibility lays out technical guidance that businesses and government entities can use when making sites and online services accessible.

5. Keep dated records

If a complaint arrives, you will want to show what you knew, when you found it, and when you fixed it. Keep scan reports, a change log tied to specific criteria, and a published accessibility statement with a way for visitors to contact you. This is evidence of effort. It is not proof of conformance, and it should not be described as such.

If you receive a demand letter

A demand letter is stressful, but a calm, organized response matters. The National Federation of Independent Business guide on responding to ADA lawsuits recommends taking the complaint seriously and responding, documenting the website, contacting an attorney experienced in ADA cases, and discussing prompt corrections with counsel. It also cautions against assuming that fixing only the listed items is enough.

That last point is easy to miss. Letters often cite a few examples from a larger set of problems. Fix the pattern, not just the sample.

Two defenses come up in practice. According to a law firm analysis of defenses to ADA website claims, website owners may assert lack of standing, and mootness may apply when barriers are remediated and there is no reasonable expectation the violation will recur. The same analysis notes that an owner may show mootness with an affidavit stating that it remedied all alleged violations, ensured no additional barriers exist, and committed to access going forward.

Notice what makes that affidavit credible: real fixes, ongoing monitoring, and dated records. Whether a defense works in your case is a question for your attorney. Our walkthrough of the first 7 to 14 days after an ADA website lawsuit covers the practical triage.

A realistic first month

If you are starting from scratch, here is a sequence a small team can follow.

1. Week 1: Scan. Run a full-site scan against WCAG 2.2 AA and export the results with dates.
2. Week 1: Triage. Sort findings by how much they block key journeys such as checkout, booking, and contact forms.
3. Weeks 2 and 3: Fix. Correct issues in your theme, templates, and content. Re-scan after each batch.
4. Week 3: Test by hand. Walk your key paths with a keyboard and a screen reader.
5. Week 4: Publish and schedule. Post an accessibility statement with a contact route, and set recurring re-checks.

Color is a frequent trouble spot for brands and agencies alike, so if your designs rely on color to convey status or errors, read our guide on preventing color blindness failures. For visitors who need stronger contrast on your pages, these high contrast CSS patterns can be added without depending on an operating system setting.

Our perspective

We hear the same hope from many owners: is there a point where I am finished and safe? We understand why. A single checkbox would be far easier than a program.

But we think the honest answer is more useful. The ADA safe harbor is a building rule, and no equivalent exists for websites. Anyone who promises that a single scan, badge, or script makes you immune is overstating what automation can establish. Automated checks detect a substantial subset of barriers, not all of them, and we say so plainly.

What we believe in is permanent remediation. Each finding should tie to a specific element and WCAG criterion, with guidance in plain language so you or your developer can fix it in the site’s own code. Then re-checks catch regressions, and dated records show your effort over time. That record does not replace legal advice, and it does not guarantee an outcome. It does show a business that took accessibility seriously, and it benefits the people who use your site every day.

Accessibility is also good business. A site that works with a keyboard, a screen reader, and a small phone screen serves more customers. We would rather help you build that than sell you a shortcut.

— The AccessWiser Team

How AccessWiser fits in

AccessWiser scans your site against WCAG 2.2 AA, with Section 508 and EN 301 549 mappings, and ties each issue to the element and criterion it affects. You get plain-language guidance for fixing it in your own code, scheduled re-checks, and dated records of scans and fixes, plus accessibility statement generation. An optional visitor widget lets people adjust contrast, text, and motion to suit them.

Plans start at $24 per month for Starter, with Basic at $49 per month and Pro at $119 per month. Business is custom, and extra scans are available one-off: $12 for specific pages and $19 for a full site. Every plan starts with a 7-day free trial. See the pricing page to compare, or generate your accessibility statement once your fixes are in.

FAQ

Is there an ADA safe harbor for websites?

No. The safe harbor in the ADA design standards applies to building elements that met the 1991 Standards. Congress has also not enacted a notice-and-cure or litigation safe harbor for web accessibility, so a business cannot rely on a statutory grace period.

Does following WCAG make my website immune from an ADA lawsuit?

No, but it helps. The DOJ says businesses can use WCAG as helpful guidance, and conformance addresses the barriers lawsuits typically describe. Because courts are divided on Title III’s reach to websites and no regulation sets a private-sector standard, WCAG work lowers risk without removing it.

Does the 2024 DOJ web rule apply to my private business?

No. The rule covers state and local governments, with WCAG 2.1 AA compliance dates of April 24, 2026, or April 26, 2027, depending on population. Private businesses fall under Title III, where the DOJ has no regulation setting detailed web standards.

What should I do first if I get a demand letter?

Take it seriously and respond. Document your website as it stands, contact an attorney experienced in ADA cases, and discuss prompt corrections with them. Do not assume that fixing only the items listed will resolve the matter.

Sources

• ADA Update: A Primer for Small Business, ADA.gov
• ADA Update: A Primer for State and Local Governments
• The Americans with Disabilities Act (ADA) and Public Accommodations, Congressional Research Service
• Gil v. Winn-Dixie Stores, Inc., 11th Cir. (April 7, 2021)
• Digital Accessibility Under Title III of the ADA, American Bar Association
• Guidance on Web Accessibility and the ADA, ADA.gov
• Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities
• Responding to ADA Lawsuits, NFIB
• Websites Under Attack: Defenses to ADA Claims for Retailers and Online Businesses, Katten

Recommended

• 4 Steps to Defensible ADA Compliance for Website Owners: ADA vs WCAG
• Target WCAG 2.2 AA First: When Implementers Should Add AAA

Articles on this blog are general information about web accessibility, not legal advice. Laws change and their application depends on your specific situation — for decisions with legal consequences, consult a qualified legal professional.